Function at 0x412620
Capabilities:
Copy file
Link many functions at runtime
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x457db3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x230], 0
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x10]
mov byte [esp + 0x230], 1
push eax
call fcn.00428960
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendA]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.Drivers
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call ebp
mov edi, dword [esp + 0x238]
mov eax, dword [edi - 8]
test eax, eax
je 0x4126ce
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x124]
push 0x104
push ecx
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x124]
push str.system32drivers
push edx
call ebp
call fcn.004125e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41279e
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push 0x46d900
call ebx
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push 0x46d900
mov edi, eax
call ebx
push eax
call esi
test edi, edi
mov ebx, eax
je 0x4127e3
test ebx, ebx
je 0x4127e3
lea eax, [esp + 0x1c]
push eax
call edi
cmp eax, 1
jne 0x4127e3
lea ecx, [esp + 0x20]
push str.PCASp50a64.sys
push ecx
call ebp
lea edx, [esp + 0x124]
push str.PCASp50a64.sys
push edx
call ebp
lea eax, [esp + 0x124]
push 1
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x412795
push str.CPhoenixApp::failed_to_copy_RawEther_sys_file_n
push 1
push 2
call fcn.004048e0
add esp, 0xc
mov edx, dword [esp + 0x1c]
push edx
call ebx
jmp 0x4127e3
lea eax, [esp + 0x20]
push str.PCASp50.sys
push eax
call ebp
lea ecx, [esp + 0x124]
push str.PCASp50.sys
push ecx
call ebp
lea edx, [esp + 0x124]
push 1
lea eax, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4127e3
push str.CPhoenixApp::failed_to_copy_RawEther_sys_file_n
push 1
push 2
call fcn.004048e0
add esp, 0xc
push str.W32N55.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41286c
push str.W32N_OpenAdapterA
push edi
call esi
push str.W32N_GetServiceNameA
push edi
mov ebp, eax
call esi
push str.SCM_SetNullDacl
push edi
mov ebx, eax
call esi
push str.SCM_CreateDriverService
push edi
mov dword [esp + 0x1c], eax
call esi
mov esi, eax
test ebp, ebp
mov dword [esp + 0x18], esi
je 0x412865
push str.dummy
call ebp
test ebx, ebx
je 0x412865
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x412865
test esi, esi
je 0x412865
call ebx
mov esi, eax
push esi
call dword [esp + 0x1c]
push esi
call ebp
test eax, eax
jne 0x412854
push str.Succeeded_in_registering_RawEther_service_n
jmp 0x412859
push str.Failed_to_register_RawEther_service_n
push 1
push 2
call fcn.004048e0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x238]
mov dword [esp + 0x230], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret