Function at 0x402d62
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push 0x7b8
mov eax, 0x40a233
call fcn.00409e70
mov ebx, ecx
mov dword [ebp - 0x7c4], ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x62c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
cmp ebx, 1
je 0x402db9
cmp ebx, 2
je 0x402db9
xor eax, eax
jmp 0x402dbc
xor eax, eax
inc eax
test eax, eax
mov ecx, str.http:__acroipm2.adobe.com_assets_AWBM_
mov ebx, str.http:__acroipm2.adobe.com_assets_AWBM_R_
mov edx, str.S1.txt
cmove ebx, ecx
mov ecx, ebx
call fcn.0040248a
lea ecx, [ebp - 0x62c]
call fcn.00403a12
lea ecx, [ebp - 0x218]
call fcn.00401ea5
test al, al
je 0x40335c
lea ecx, [ebp - 0x218]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x402e00
sub ecx, edx
sar ecx, 1
je 0x40335c
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x218]
push str.GoogleChromeUser_Data_
mov edi, 0x104
push edi
push eax
call esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call esi
push str.Bookmarks
lea eax, [ebp - 0x218]
push edi
push eax
call esi
xor eax, eax
push 0xb8
push eax
lea eax, [ebp - 0x7b8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x2c
lea ecx, [ebp - 0x7b8]
call fcn.004048c5
xor eax, eax
push ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x7b8]
call fcn.0040488e
cmp dword [ebp - 0x75c], 0
je 0x403337
mov eax, dword [ebp - 0x7b8]
xor ecx, ecx
mov word [ebp - 0x630], 1
push dword [ebp - 0x630]
mov byte [ebp - 0x7bb], cl
mov eax, dword [eax + 4]
push ecx
mov eax, dword [ebp + eax - 0x780]
test eax, eax
sete byte [ebp - 0x7bc]
push dword [ebp - 0x7bc]
push eax
push ecx
lea ecx, [ebp - 0x66c]
call fcn.00405d4b
xor eax, eax
mov byte [ebp - 4], 1
push 0x30
push eax
lea eax, [ebp - 0x700]
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x700]
call fcn.00404740
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x65c]
add eax, 2
push eax
call fcn.004093af
mov ecx, dword [ebp - 0x65c]
mov esi, eax
add ecx, 2
xor eax, eax
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x658], 0xf
lea ecx, [ebp - 0x66c]
push dword [ebp - 0x65c]
cmova ecx, dword [ebp - 0x66c]
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [ebp - 0x638], esi
add esp, 0x1c
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x630], esi
lea ecx, [ebp - 0x700]
push eax
call fcn.004069a5
xor esi, esi
cmp dword [eax + 0x28], esi
jne 0x403313
mov esi, str.roots
lea ecx, [ebp - 0x700]
push esi
call fcn.0040561d
test eax, eax
je 0x403313
push esi
lea ecx, [ebp - 0x700]
call fcn.004047d4
mov esi, eax
mov edi, str.bookmark_bar
push edi
mov ecx, esi
call fcn.0040561d
test eax, eax
je 0x40330c
push edi
mov ecx, esi
call fcn.004047d4
mov esi, eax
mov edi, str.children
push edi
mov ecx, esi
call fcn.0040561d
test eax, eax
je 0x403305
push edi
mov ecx, esi
call fcn.004047d4
mov dword [ebp - 0x630], eax
cmp dword [eax + 0xc], 4
jne 0x403305
xor ecx, ecx
cmp dword [eax + 4], ecx
jbe 0x403305
push 0x30
push ecx
lea eax, [ebp - 0x69c]
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x69c]
call fcn.00404740
xor eax, eax
lea edi, [ebp - 0x69c]
push 3
pop ecx
mov dword [ebp - 0x690], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x648], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x654]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x654]
push dword [ebp - 0x68c]
push str.13346689990798272
push str.date_added
call fcn.00405dcc
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x40c350
push str.date_last_used
call fcn.00405dcc
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.d4d3e7d2_cdf9_4163_bb68_73a465fc09dc
push str.guid
call fcn.00405dcc
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x40c3a0
push 0x40c3a4
call fcn.00405dcc
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.Adobe_Acrobat
push str.name
call fcn.00405dcc
push dword [ebp - 0x68c]
mov edi, 0x40c3c0
lea ecx, [ebp - 0x654]
push edi
push str.type
call fcn.00405dcc
mov esi, dword [ebp - 0x7c4]
cmp esi, 1
je 0x4030ee
cmp esi, 2
jne 0x403105
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationReader
push edi
call fcn.00405dcc
cmp esi, 4
je 0x40310f
cmp esi, 3
jne 0x403126
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationAcrobat
push edi
call fcn.00405dcc
push dword [ebp - 0x68c]
mov ecx, dword [ebp - 0x630]
lea eax, [ebp - 0x654]
push eax
call fcn.00404777
lea ecx, [ebp - 0x7b8]
call fcn.0040483d
xor eax, eax
push 0x20c
push eax
lea eax, [ebp - 0x424]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov esi, 0x104
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4032f8
push str.temp_awbm_copy.txt
lea eax, [ebp - 0x424]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x40c4ac
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0x18
cmp dword [ebp - 0x7bc], 0
je 0x4032f8
xorps xmm0, xmm0
xor eax, eax
add esi, 0xfffffffc
mov dword [ebp - 0x634], eax
push 1
movups xmmword [ebp - 0x644], xmm0
mov dword [ebp - 0x630], esi
call fcn.00409120
push dword [ebp - 0x630]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x630]
add ecx, eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 5
lea edi, [ebp - 0x6d0]
push 7
mov dword [ebp - 0x638], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x644]
push ecx
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6d0], eax
call fcn.004055b4
lea eax, [ebp - 0x6d0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x700]
call fcn.00405e7d
push ecx
lea ecx, [ebp - 0x644]
call fcn.00405d03
xor ecx, ecx
mov byte [eax], cl
lea ecx, [ebp - 0x6b4]
push dword [ebp - 0x63c]
dec dword [ebp - 0x638]
call fcn.004053e5
push dword [ebp - 0x7bc]
cmp dword [ebp - 0x6a0], 0xf
lea eax, [ebp - 0x6b4]
push 1
push dword [ebp - 0x6a4]
cmova eax, dword [ebp - 0x6b4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x7bc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
xor eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, str.S7.txt
mov ecx, ebx
call fcn.0040248a
lea ecx, [ebp - 0x6b4]
call fcn.004053c2
lea ecx, [ebp - 0x6cc]
call fcn.00404725
lea ecx, [ebp - 0x644]
call fcn.00405169
lea ecx, [ebp - 0x68c]
call fcn.00404725
jmp 0x40331f
mov edx, str.S6.txt
jmp 0x403318
mov edx, str.S5.txt
jmp 0x403318
mov edx, str.S4.txt
mov ecx, ebx
call fcn.0040248a
lea ecx, [ebp - 0x6f0]
call fcn.00404725
lea ecx, [ebp - 0x66c]
call fcn.004053c2
jmp 0x403343
mov edx, str.S3.txt
mov ecx, ebx
call fcn.0040248a
lea ecx, [ebp - 0x748]
call fcn.0040485e
lea ecx, [ebp - 0x748]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x403377
mov edx, 0x40b468
mov ecx, str.AddEntryToChromeBookmark::_FAILED_to_get_local_appdata_folder_path
call fcn.0040172d
mov edx, str.S2.txt
mov ecx, ebx
call fcn.0040248a
call fcn.00409e2e
ret