Function at 0x4069e0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0xe2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0xe50]
push edi
push esi
mov dword [esp + 0x1c], 1
call fcn.00403c90
mov ebp, eax
push 0x400
lea eax, [esp + 0x644]
push eax
push str.AppInit_DLLs
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov dword [esp + 0x34], ebp
call fcn.004067e0
mov edi, eax
add esp, 0x18
mov dword [esp + 0x14], edi
test edi, edi
je 0x406a3a
xor ecx, ecx
mov word [esp + 0x63c], cx
lea eax, [esp + 0x63c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a44
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 4]
push edx
call fcn.004318ee
mov ebx, eax
add esp, 4
xor eax, eax
mov word [ebx], ax
lea eax, [esp + 0x63c]
mov dword [esp + 0x10], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a75
sub eax, edx
sar eax, 1
inc eax
push eax
lea ecx, [esp + 0x640]
push ecx
push ebx
call fcn.004316e2
mov eax, dword [esp + 0xe64]
add esp, 0xc
test eax, eax
je 0x406abb
mov edx, dword [esp + 0xe5c]
push edx
lea ecx, [esp + 0x640]
push ecx
push eax
call fcn.004316e2
add esp, 0xc
test ebp, ebp
je 0x406ad6
test dword [esp + 0xe44], 0x400
je 0x406ad6
xor edx, edx
mov word [esp + 0x63c], dx
push 0x104
test esi, esi
jne 0x406b03
lea eax, [esp + 0x28]
push eax
call fcn.00403e90
mov edi, eax
add esp, 8
mov dword [esp + 0x14], eax
test edi, edi
je 0x406b11
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe2c
ret
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.004316e2
add esp, 0xc
test ebp, ebp
mov ebp, dword [esp + 0xe40]
je 0x406c49
test esi, esi
jne 0x406b7c
push 1
push 1
lea edx, [esp + 0x43c]
push 0x104
push edx
call fcn.00401fd0
mov edi, eax
add esp, 0x10
mov dword [esp + 0x14], edi
test edi, edi
jne 0x406af6
lea eax, [esp + 0x434]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406b51
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x438]
push str.drpreinject.dll
push edx
call fcn.00433280
jmp 0x406b8f
push 0x104
lea eax, [esp + 0x438]
push esi
push eax
call fcn.004316e2
add esp, 0xc
push 1
push 0
lea ecx, [esp + 0x234]
push 0x104
push ecx
call fcn.00401fd0
add esp, 0x10
test edi, edi
jne 0x406af6
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406bc0
sub eax, edx
sar eax, 1
mov edx, 0x104
sub edx, eax
push edx
lea eax, [esp + 0x230]
push str.drpreinject.dll
push eax
call fcn.00433280
add esp, 0xc
test ebp, ebp
je 0x406c0a
push 0
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x406c18
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x24]
push ecx
call fcn.00401850
add esp, 4
test eax, eax
je 0x406c49
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.00401850
add esp, 4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004316e2
add esp, 0xc
push 0x2c
lea ecx, [esp + 0x28]
push ecx
push ebx
test ebp, ebp
je 0x406e04
call fcn.00405580
add esp, 0xc
test eax, eax
je 0x406cca
cmp dword [esp + 0x1c], 0
je 0x406c7a
mov eax, dword [esp + 0xe44]
mov esi, 1
jmp 0x406cdd
push 0x104
push eax
lea edx, [esp + 0x234]
push edx
call fcn.004316e2
lea eax, [esp + 0x238]
push 0x2c
push eax
call fcn.004319bb
add esp, 0x14
test eax, eax
je 0x406ca8
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x22c]
push edx
call fcn.00401920
xor ecx, ecx
add esp, 4
test al, al
mov eax, dword [esp + 0xe44]
sete cl
mov esi, ecx
jmp 0x406cdd
mov eax, dword [esp + 0xe44]
mov edx, 0
test al, 3
setne dl
mov esi, edx
mov ecx, eax
shr ecx, 0xc
and ecx, 1
or esi, ecx
test al, 1
jne 0x406cf3
test al, 2
je 0x406cf3
xor ebp, ebp
jmp 0x406cf8
mov ebp, 1
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d00
sub eax, edx
sar eax, 1
je 0x406df1
test esi, esi
je 0x406d29
push 0x2c
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.004056d0
add esp, 0xc
push 0x2c
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00405580
add esp, 0xc
test eax, eax
jne 0x406e0c
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d46
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x24]
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d60
sub eax, esi
sar eax, 1
lea esi, [eax + edx + 2]
lea ecx, [esi + esi]
push ecx
call fcn.004318ee
mov edi, eax
mov eax, ebx
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d86
sub eax, edx
sar eax, 1
jne 0x406db9
push esi
lea edx, [esp + 0x28]
push edx
push edi
call fcn.004316e2
add esp, 0xc
push ebx
call fcn.004317aa
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x18]
add esp, 4
jmp 0x406e0c
test ebp, ebp
je 0x406dc5
mov ecx, ebx
lea eax, [esp + 0x24]
jmp 0x406dcb
lea ecx, [esp + 0x24]
mov eax, ebx
push ecx
push 0x2c
push eax
push str._s_c_s
push esi
push edi
call fcn.00431593
add esp, 0x18
push ebx
call fcn.004317aa
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x18]
add esp, 4
jmp 0x406e0c
lea eax, [esp + 0x24]
push eax
call fcn.0044b978
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x406e0c
call fcn.004056d0
add esp, 0xc
mov ebx, dword [esp + 0xe44]
mov ebp, dword [esp + 0x10]
test bl, 8
je 0x406e40
mov eax, dword [esp + 0xe4c]
test eax, eax
je 0x406e69
mov edx, ebx
push 0x2c
shr edx, 4
and edx, 1
push edx
push 1
push eax
push ebp
call fcn.00405750
add esp, 0x14
jmp 0x406e72
test bl, 4
je 0x406e6e
mov eax, dword [esp + 0xe48]
test eax, eax
je 0x406e69
mov ecx, ebx
push 0x2c
shr ecx, 4
and ecx, 1
push ecx
push 0
push eax
push ebp
call fcn.00405750
add esp, 0x14
jmp 0x406e72
mov edi, 0x57
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0xe50]
test esi, esi
je 0x406e87
test eax, eax
jne 0x406e87
mov dword [esi], 0xfffffffa
cmp edi, 0x57
jne 0x406e9c
pop edi
pop esi
pop ebp
mov eax, 0x57
pop ebx
add esp, 0xe2c
ret
test eax, eax
jne 0x406eb5
test bl, 0x40
je 0x406eb5
push 0x2c
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.004056d0
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x406f16
test ebx, 0x100
jne 0x406e8c
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406ed0
sub eax, edx
sar eax, 1
cmp eax, 0x1f
jbe 0x406f16
test esi, esi
je 0x406eee
mov dword [esi], 0xfffffff9
test ebx, 0x200
je 0x406f08
push 0x2c
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.004056d0
add esp, 0xc
jmp 0x406f16
test ebx, 0x800
je 0x406f16
xor ecx, ecx
mov word [ebp + 0x3e], cx
lea ecx, [esp + 0x63c]
mov eax, ebp
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406f46
test dx, dx
je 0x406f42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406f46
add eax, 4
add ecx, 4
test dx, dx
jne 0x406f20
xor eax, eax
jmp 0x406f4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406f68
push ebp
push str.AppInit_DLLs
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.004066e0
add esp, 0x10
test eax, eax
jne 0x406f73
push ebp
call fcn.004317aa
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe2c
ret