Function at 0x412008
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x6dffbc
mov dword [ebp - 0x30], ecx
push esi
mov ebx, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412036
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x634348
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.00412855
add esp, 0x10
mov ecx, 0x633e78
cmp byte [0x6e0891], 0
mov eax, 0x633e74
cmove eax, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push 0x633e7c
lea eax, [ebp - 0x2c]
push eax
call esi
mov edi, 0x6dffbc
lea eax, [ebp - 0x2c]
push edi
push 0x6ded30
push str.pdtname
push eax
call esi
push edi
push 0x6dfb40
push str.proctype
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x2c]
sub ebx, 1
je 0x4120c7
sub ebx, 1
mov ebx, edi
push ebx
je 0x4120c0
push str.crash
jmp 0x4120d2
push str.hang
jmp 0x4120d2
mov ebx, 0x6dffbc
push ebx
push str.trycatch
push str.crashtype
push eax
call esi
push dword [0x6dfba4]
mov edi, 0x6e48b0
push 0x634348
push edi
call fcn.00412837
add esp, 0xc
lea eax, [ebp - 0x2c]
push ebx
push edi
push str.trycatchcnt
push eax
call esi
mov edi, 0x6e08b0
mov ecx, 0x6dc324
push 0x2000
mov edx, edi
call fcn.004116eb
pop ecx
push ebx
push edi
push str.cururl
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6dede4
push 0x633f20
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6ded80
push str.pdtver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6dfab4
push 0x633f40
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6e0840
push str.ExcptCode
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6e03cc
push str.module
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6e07dc
push str.modulever
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6e0868
push 0x633f80
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6df7e4
push str.osver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6df9ec
push str.iever
lea eax, [ebp - 0x2c]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x633fa8
push 0xffffffffffffffff
mov edi, 0x6e48b0
push edi
call fcn.0040ce80
add esp, 0x10
lea eax, [ebp - 0x2c]
push ebx
push edi
push 0x633fb0
push eax
call esi
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41222a
cmp dword [ebx], 0
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
je 0x41220c
push 0x6dffbc
push 0x50
push dword [ebx]
lea eax, [ebp - 0x2c]
push str.ExceptionRecord
push eax
call edi
cmp dword [ebx + 4], 0
je 0x41222a
push 0x6dffbc
push 0x2cc
push dword [ebx + 4]
lea eax, [ebp - 0x2c]
push str.ContextRecord
push eax
call edi
mov edi, 0x6dfdb4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call fcn.00411667
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x6dfbac
push str._s_u__d__s
push 0x104
mov ebx, 0x6e48b0
push ebx
call fcn.0040ce80
add esp, 0x1c
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
test eax, eax
je 0x412281
push 0x6dffbc
push ebx
push str.dump
lea eax, [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret