Function at 0x4070c0
Capabilities:
Copy file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x441044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x613]
push ebx
push eax
mov byte [ebp - 0x614], bl
call fcn.004238b0
add esp, 0xc
cmp dword [0xc35770], 1
jne 0x40710e
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bcde
mov esp, ebp
pop ebp
ret
mov eax, 0xc31e80
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x407116
sub eax, edx
sar eax, 1
cmp eax, 7
jb 0x4070fa
push esi
push edi
lea ecx, [ebp - 0x614]
push ecx
push 0xc31e80
call fcn.004098d0
push 0x206
lea eax, [ebp - 0x81a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x81c], dx
call fcn.004238b0
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0xc369e0
lea ecx, [ebp - 0x81c]
push str._sPolicySystemPolicyContainer.opt
push ecx
call edi
lea edx, [ebp - 0x81c]
push 0x43668c
push edx
call fcn.0041c08e
mov esi, eax
add esp, 0x28
cmp esi, ebx
jne 0x40719e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bcde
mov esp, ebp
pop ebp
ret
push 2
push ebx
push esi
call fcn.0041c8a4
push esi
call fcn.0041c7b5
push esi
mov dword [ebp - 0x820], eax
call fcn.0041d4da
push esi
call fcn.0041ca3b
add esp, 0x18
cmp dword [ebp - 0x820], 0x1f4
ja 0x407332
push 0x206
lea ecx, [ebp - 0x412]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x414], ax
call fcn.004238b0
push 0x206
lea eax, [ebp - 0x20a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x20c], dx
call fcn.004238b0
push 0xc38c90
lea ecx, [ebp - 0x20c]
push str._sPolicySystemPolicyContainer.opt
push ecx
call edi
push 0xc369e0
lea edx, [ebp - 0x414]
push str._sPolicySystemPolicyContainer.opt
push edx
call edi
lea eax, [ebp - 0x820]
push 0x30
push eax
mov dword [ebp - 0x820], ebx
call fcn.00405570
lea ecx, [ebp - 0x824]
push 0x88
push ecx
mov dword [ebp - 0x824], ebx
call fcn.00405570
mov esi, dword [ebp - 0x824]
add esp, 0x40
lea edi, [ebp - 0x614]
call fcn.00405620
mov edi, dword [ebp - 0x820]
mov edx, dword [esi + 0x10]
mov eax, dword [edi + 0x20]
add eax, dword [edi + 0x18]
push edx
push esi
push eax
call fcn.00422d00
mov ecx, dword [esi + 0x10]
add dword [edi + 0x18], ecx
mov eax, 1
add dword [edi + 0x28], eax
add dword [edi + 0x2c], eax
mov edx, dword [esi + 0x10]
push edx
push ebx
push esi
call fcn.004238b0
push esi
call fcn.0041d5ca
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x18]
add esp, 0x1c
push ebx
push 0x8000080
push 2
push ebx
push 1
push 0xc0000000
lea ecx, [ebp - 0x414]
push ecx
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4072f7
push ebx
lea edx, [ebp - 0x820]
push edx
mov dword [ebp - 0x820], ebx
mov eax, dword [edi + 0x10]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi + 0x10]
push ecx
push ebx
push edi
call fcn.004238b0
push edi
call fcn.0041d5ca
add esp, 0x10
push ebx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041bcde
mov esp, ebp
pop ebp
ret