Function at 0x41d3a0
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5cf2f0
push eax
mov eax, 0x27d0
mov dword fs:[0], esp
call fcn.0055b070
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
lea ecx, [esp + 0x88]
mov dword [esp + 0x24], ebp
call fcn.004de5e0
mov eax, dword [0x677e28]
mov dword [esp + 0x27e8], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x438]
mov byte [esp + 0x27e8], 3
cmp eax, ebp
jne 0x41d405
xor edx, edx
jmp 0x41d41e
mov ecx, dword [esi + 0x43c]
sub ecx, eax
mov eax, 0x54abfd5b
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edx, eax
push ebp
push edx
call fcn.0047f880
mov ecx, eax
call fcn.00455c90
push ebp
mov ecx, esi
call fcn.0059d3da
mov edi, dword [esi + 0x48c]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x40], 0x5ecdf0
mov dword [esp + 0x44], 0x5ecde8
call fcn.004018e0
mov dword [esp + 0x24], 1
push ebp
lea ecx, [esp + 0x44]
mov byte [esp + 0x27ec], 4
call fcn.00401950
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x27ec], 5
call fcn.00401a40
mov ecx, dword [esp + 0x40]
push edi
mov byte [esp + 0x27ec], 6
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x44], 0x5ecdd4
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 4]
lea ecx, [eax - 0xc]
mov dword [esp + eax + 0x40], ecx
mov edx, dword [esp + 0x44]
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x44]
call fcn.0048f9c0
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x24]
mov bl, 7
push ecx
mov eax, dword [edx + 4]
mov byte [esp + 0x27ec], bl
lea ecx, [esp + eax + 0x44]
call fcn.004900d0
mov ecx, dword [eax]
push 0x652b54
push ecx
call fcn.0055b250
add esp, 8
cmp eax, ebp
sete dl
lea ecx, [esp + 0x24]
mov byte [esp + 0x2c], dl
call fcn.0059d7fd
lea eax, [esp + 0x18]
lea ecx, [esp + 0x3c]
push eax
push 0x655238
call fcn.004959a0
test eax, eax
je 0x41d982
lea ecx, [esp + 0x14]
push ecx
push 0x655238
lea ecx, [esp + 0x44]
call fcn.004959a0
test eax, eax
je 0x41d982
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x88]
push edx
call fcn.004de6c0
mov eax, dword [esi + 0x43c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebp
mov ebp, dword [esi + 0x438]
xor ebx, ebx
cmp ebp, eax
mov dword [esp + 0x38], ebp
je 0x41d748
lea edi, [ebp + 0x60c]
mov dword [esp + 0x30], edi
call fcn.0047f870
mov edx, dword [eax]
lea ecx, [edi + 0x2d8]
push ecx
push edi
mov ecx, eax
call dword [edx + 4]
test eax, eax
mov dword [esp + 0x10], eax
je 0x41d71d
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x41d5f9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
push 0
mov ebp, 1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
test edi, edi
je 0x41d5f4
mov edx, dword [edi]
mov ecx, edi
xor ebx, ebx
call dword [edx + 4]
test eax, eax
je 0x41d5cd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
inc ebx
test eax, eax
jne 0x41d5c1
mov ecx, dword [esp + 0x10]
push edi
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp ebx, 0x15
jl 0x41d5e1
cmp ebx, 0x3c
jle 0x41d5f9
mov ecx, dword [esp + 0x10]
mov eax, ebp
push eax
inc ebp
mov edx, dword [ecx]
call dword [edx + 0xc]
mov edi, eax
test edi, edi
jne 0x41d5b4
mov ebx, 0x19
mov ecx, esi
call fcn.0041d390
mov ecx, dword [esp + 0x10]
mov edi, eax
mov eax, dword [ecx]
mov ebp, dword [edi]
call dword [eax + 4]
and eax, 0xffff
mov ecx, edi
push eax
push 1
call dword [ebp + 8]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41d65b
mov ecx, dword [esp + 0x10]
push 0
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov edi, dword [ecx]
call dword [edi + 4]
mov ecx, dword [esp + 0x10]
dec eax
push eax
call dword [edi + 0x18]
inc eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
add eax, 0x2d8
push eax
call fcn.0059d986
mov ecx, dword [esp + 0x10]
xor ebp, ebp
mov edx, dword [ecx]
call dword [edx + 4]
test ax, ax
jbe 0x41d6dd
mov ecx, dword [esp + 0x10]
push ebp
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
test edi, edi
je 0x41d6ce
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
inc ecx
test eax, eax
mov dword [esp + 0x1c], ecx
je 0x41d69a
mov ecx, dword [esp + 0x34]
mov eax, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov dword [edi + 0x10], eax
mov ecx, esi
call fcn.0041d390
lea ecx, [esp + 0x68]
mov edx, dword [eax]
push ecx
mov ecx, ebp
and ecx, 0xffff
inc ecx
push ecx
mov ecx, eax
call dword [edx + 0xc]
push edi
lea ecx, [esp + 0x8c]
call fcn.004de6f0
mov ecx, dword [esp + 0x10]
push edi
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, dword [esp + 0x10]
inc ebp
mov eax, dword [ecx]
call dword [eax + 4]
cmp bp, ax
jb 0x41d66b
mov ecx, esi
call fcn.0041d390
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
call fcn.0047f870
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call dword [edx + 8]
mov ecx, esi
call fcn.0041d390
mov ecx, dword [esp + 0x30]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x24]
inc ecx
push ecx
mov ecx, eax
call dword [edx + 0x18]
mov ebp, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov eax, dword [esi + 0x43c]
add ebp, 0xc18
add edi, 0xc18
inc ecx
cmp ebp, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], ecx
jne 0x41d56f
mov ecx, dword [esi + 0x47c]
test ecx, ecx
je 0x41d759
mov edx, dword [ecx]
push 1
call dword [edx + 4]
lea ecx, [esp + 0x88]
mov dword [esi + 0x47c], 0
call fcn.004de6e0
lea eax, [esi + 0x51c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov eax, dword [esi + 0x4a0]
mov ecx, dword [esp + 0x14]
and al, 0xef
push 0
push ecx
mov word [esi + 0x52c], 0
mov word [esi + 0x534], 0xffff
mov dword [esi + 0x4a0], eax
call fcn.0055b320
add esp, 8
test eax, eax
jne 0x41d7ba
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
movsx eax, word [esi + 0x5dc]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push 1
lea edi, [esi + 0x490]
push 0
push 0xd5
push edi
and ecx, 0xff
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x8c]
call fcn.004dbf40
test eax, eax
je 0x41d9eb
mov eax, dword [esi + 0x48c]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.0047f880
mov ecx, eax
call fcn.00455d80
push 1
mov ecx, esi
call fcn.0059d3da
mov eax, dword [esi + 0x48c]
mov edx, dword [esi + 0x480]
mov ecx, dword [esi + 0x468]
mov esi, dword [esi + 0x5d0]
push 0
push 1
push 0
push esi
mov esi, dword [esp + 0x2c]
mov ebp, dword [ecx]
push 0
push ebx
push esi
mov esi, dword [esp + 0x40]
push esi
push eax
push edx
push 1
push edi
call dword [ebp]
test al, al
jne 0x41d8c0
lea edx, [esp + 0x4c]
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x60]
mov byte [esp + 0x27e8], 0xd
call fcn.0059d7fd
lea ecx, [esp + 0x5c]
mov byte [esp + 0x27e8], 0xc
call fcn.0059d7fd
lea ecx, [esp + 0x58]
mov byte [esp + 0x27e8], 0xb
call fcn.0059d7fd
lea ecx, [esp + 0x54]
mov byte [esp + 0x27e8], 0xa
call fcn.0059d7fd
lea ecx, [esp + 0x50]
mov byte [esp + 0x27e8], 3
call fcn.0059d7fd
jmp 0x41d9fc
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
lea edx, [esp + 0x4c]
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x60]
mov byte [esp + 0x27e8], 0x11
call fcn.0059d7fd
lea ecx, [esp + 0x5c]
mov byte [esp + 0x27e8], 0x10
call fcn.0059d7fd
lea ecx, [esp + 0x58]
mov byte [esp + 0x27e8], 0xf
call fcn.0059d7fd
lea ecx, [esp + 0x54]
mov byte [esp + 0x27e8], 0xe
call fcn.0059d7fd
lea ecx, [esp + 0x50]
mov byte [esp + 0x27e8], 3
call fcn.0059d7fd
lea ecx, [esp + 0x28]
mov byte [esp + 0x27e8], 2
call fcn.0059d7fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x27e8], 1
call fcn.0059d7fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x27e8], 0
call fcn.0059d7fd
lea ecx, [esp + 0x88]
mov dword [esp + 0x27e8], 0xffffffff
call fcn.004de650
mov al, 1
jmp 0x41da48
mov eax, dword [0x677e28]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x27e8], 8
push ecx
lea ecx, [esp + 0x40]
call fcn.00495ce0
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push eax
push str.Unable_to_open_temp_file__please_delete_some_files_in__s
push edx
mov byte [esp + 0x27f4], 9
call fcn.00596175
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x27e8], 8
call fcn.0059d7fd
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push eax
call fcn.005ab679
lea ecx, [esp + 0x1c]
mov byte [esp + 0x27e8], bl
call fcn.0059d7fd
lea ecx, [esp + 0x4c]
mov byte [esp + 0x27e8], 3
call fcn.004019c0
lea ecx, [esp + 0x28]
mov byte [esp + 0x27e8], 2
call fcn.0059d7fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x27e8], 1
call fcn.0059d7fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x27e8], 0
call fcn.0059d7fd
lea ecx, [esp + 0x88]
mov dword [esp + 0x27e8], 0xffffffff
call fcn.004de650
xor al, al
mov ecx, dword [esp + 0x27e0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x27dc
ret