Function at 0x40f770
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x491024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.CStealthManager::checkAndUpdateNewBinary
push str._s_enter_
push str.stealth_manager
call fcn.00402590
push 0x47e570
lea edx, [ebx + 0x58]
lea ecx, [ebp - 0x28]
call fcn.00407760
push 0x4928d4
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00405f30
push 0x47e570
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00403970
add esp, 0x18
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x40f805
mov ecx, dword [ebp - 0x58]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40f831
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push str.temp_
lea edx, [ebp - 0x70]
mov dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00407760
add esp, 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4102d6
test al, 0x10
je 0x4102d6
push 0
push str.flag_delete_:__d
push str.stealth_manager
call fcn.00402590
push 0x492a0c
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x130]
call fcn.00407870
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
cmovae eax, dword [ebp - 0x130]
push ecx
push eax
call esi
add esp, 0x18
test eax, eax
jne 0x40f997
push 0x492a0c
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x164], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f91e
mov eax, dword [ecx]
jmp 0x40f920
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40f962
mov eax, dword [ecx]
jmp 0x40f964
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 7
call fcn.00410330
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40f997
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x492874
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x118]
call fcn.00407870
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push ecx
cmovae eax, dword [ebp - 0x118]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40fa9a
push 0x492874
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fa21
mov eax, dword [ecx]
jmp 0x40fa23
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fa65
mov eax, dword [ecx]
jmp 0x40fa67
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0xa
call fcn.00410330
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40fa9a
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x492934
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x100]
call fcn.00407870
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0xec], 0x10
lea eax, [ebp - 0x100]
push ecx
cmovae eax, dword [ebp - 0x100]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40fb9d
push 0x492934
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fb24
mov eax, dword [ecx]
jmp 0x40fb26
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fb68
mov eax, dword [ecx]
jmp 0x40fb6a
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0xd
call fcn.00410330
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40fb9d
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x49297c
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xe8]
call fcn.00407870
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
push ecx
cmovae eax, dword [ebp - 0xe8]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40fca0
push 0x49297c
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fc27
mov eax, dword [ecx]
jmp 0x40fc29
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fc6b
mov eax, dword [ecx]
jmp 0x40fc6d
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x10
call fcn.00410330
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40fca0
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x4928a4
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xd0]
call fcn.00407870
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
push ecx
cmovae eax, dword [ebp - 0xd0]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40fda3
push 0x4928a4
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fd2a
mov eax, dword [ecx]
jmp 0x40fd2c
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x14
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fd6e
mov eax, dword [ecx]
jmp 0x40fd70
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x13
call fcn.00410330
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40fda3
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x492814
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xb8]
call fcn.00407870
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
push ecx
cmovae eax, dword [ebp - 0xb8]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40fea6
push 0x492814
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0x16
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fe2d
mov eax, dword [ecx]
jmp 0x40fe2f
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0xb8]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40fe71
mov eax, dword [ecx]
jmp 0x40fe73
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x16
call fcn.00410330
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40fea6
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x4928bc
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x88]
call fcn.00407870
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
push ecx
cmovae eax, dword [ebp - 0x88]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40ff52
push 0x4928bc
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x88]
push 0
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x74], 0x10
push ecx
cmovae eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
sete al
movzx eax, al
push eax
push str.copy_hookDll32_:__d
push str.stealth_manager
call fcn.00402590
mov byte [ebp - 4], 0x18
add esp, 0xc
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40ff52
mov ecx, dword [ebp - 0x28]
inc edx
push 1
call fcn.004024a0
add esp, 4
cmp byte [ebx + 0xc], 0
je 0x410001
push 0x4929f4
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.00407870
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x40ffe7
push 0x4929f4
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x28]
call fcn.00407870
add esp, 4
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x58]
push 0
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
sete al
movzx eax, al
push eax
push str.copy_hookDll64_:__d
push str.stealth_manager
call fcn.00402590
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00403090
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x410001
mov ecx, dword [ebp - 0x58]
inc edx
push 1
call fcn.004024a0
add esp, 4
push 0x4928ec
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xa0]
call fcn.00407870
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x160]
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
push ecx
cmovae eax, dword [ebp - 0xa0]
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x410110
push 0x4928ec
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x148]
call fcn.00407870
add esp, 4
push 0
sub esp, 0x18
mov byte [ebp - 4], 0x1d
mov ecx, esp
mov dword [ebp - 0x168], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x41008e
mov eax, dword [ecx]
jmp 0x410090
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.004032e0
sub esp, 0x18
mov byte [ebp - 4], 0x1e
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4100d2
mov eax, dword [ecx]
jmp 0x4100d4
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x148]
push 0
push eax
call fcn.004032e0
mov byte [ebp - 4], 0x1d
call fcn.00410330
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x410110
mov ecx, dword [ebp - 0x148]
inc edx
push 1
call fcn.004024a0
add esp, 4
push str.CStealthManager::checkAndUpdateNewBinary
push str._s_exit_
push str.stealth_manager
call fcn.00402590
mov edx, dword [ebp - 0x8c]
add esp, 0xc
cmp edx, 0x10
jb 0x410143
mov ecx, dword [ebp - 0xa0]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
cmp edx, 0x10
jb 0x410177
mov ecx, dword [ebp - 0x88]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
cmp edx, 0x10
jb 0x4101a8
mov ecx, dword [ebp - 0xb8]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
cmp edx, 0x10
jb 0x4101df
mov ecx, dword [ebp - 0xd0]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0xf
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xd0], 0
cmp edx, 0x10
jb 0x410216
mov ecx, dword [ebp - 0xe8]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xd4], 0xf
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xe8], 0
cmp edx, 0x10
jb 0x41024d
mov ecx, dword [ebp - 0x100]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x104]
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], 0
mov byte [ebp - 0x100], 0
cmp edx, 0x10
jb 0x410284
mov ecx, dword [ebp - 0x118]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x104], 0xf
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x118], 0
cmp edx, 0x10
jb 0x4102bb
mov ecx, dword [ebp - 0x130]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4102ec
mov ecx, dword [ebp - 0x40]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x410314
mov ecx, dword [ebp - 0x70]
inc edx
push 1
call fcn.004024a0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004787cb
mov esp, ebp
pop ebp
ret