Function at 0x404e36
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbd8
mov eax, dword [0x41c098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
call fcn.00408b0e
push eax
call fcn.00408203
pop ecx
pop ecx
call fcn.00404c58
xor ecx, ecx
inc ecx
test al, al
jne 0x404e7d
mov eax, dword [0x41d180]
test eax, eax
cmove eax, ecx
mov dword [0x41d180], eax
lea eax, [ebp - 0xbd8]
push eax
call fcn.00408b0e
mov dword [esp], 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00408150
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call fcn.00404d64
push eax
call fcn.004023f8
mov esi, 0x41d150
push esi
lea ecx, [ebp - 0xbc0]
call fcn.00402c94
push esi
lea ecx, [ebp - 0xbbc]
call fcn.00402c94
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xba0]
call fcn.00402d1e
push 0x5c
push dword [ebp - 0xba0]
call fcn.00408975
pop ecx
pop ecx
test eax, eax
jne 0x404f05
or eax, 0xffffffff
jmp 0x404f0b
sub eax, dword [ebp - 0xba0]
push str.utils.exe
inc eax
push eax
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0xba0]
call fcn.00403c60
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00402e69
add esp, 0xc
lea ecx, [ebp - 0xba0]
push eax
call fcn.00402d6e
mov ecx, dword [ebp - 0xba4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbb8]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
lea eax, [ebp - 0xbc0]
push eax
call fcn.00403709
push edi
mov edi, dword [ebp - 0xbc0]
push edi
lea eax, [ebp - 0xbbc]
push str._parent_s__s
push eax
call fcn.004033d3
mov esi, dword [0x41d180]
mov eax, esi
imul eax, esi
add esp, 0x14
cdq
push 0x12
pop ecx
idiv ecx
cmp edx, 2
jne 0x404fcb
mov eax, ebx
test esi, esi
je 0x404fc6
mov edi, ebx
mov eax, esi
mov ecx, esi
cdq
sub eax, edx
and ecx, 1
mov esi, eax
add edi, ecx
sar esi, 1
jne 0x404fa2
mov dword [ebp - 0xba4], edi
mov edi, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xba4]
mov dword [0x41d180], eax
push ebx
push str._brwtype
lea ecx, [ebp - 0xbbc]
call fcn.00403334
test eax, eax
js 0x405279
push str._runexe
lea ecx, [ebp - 0xbac]
mov byte [ebp - 0xba5], bl
call fcn.00402d1e
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0xbb4]
push eax
call fcn.00403593
mov ecx, dword [ebp - 0xbac]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov eax, dword [ebp - 0xbb4]
cmp dword [eax - 0xc], ebx
je 0x405256
lea eax, [ebp - 0xbb4]
push eax
call fcn.00403115
pop ecx
test al, al
je 0x405256
push 0x103
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.00408150
mov esi, dword [0x41d180]
add esp, 0xc
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push 0x16
cdq
pop ecx
idiv ecx
cmp edx, 5
jne 0x4050a1
mov ecx, ebx
mov eax, dword [ebp + ecx*4 - 0xb9c]
imul eax, eax, 0x81
add esi, eax
inc ecx
cmp ecx, 0x248
jb 0x405083
mov dword [0x41d180], esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x405256
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xbb0]
call fcn.00402d1e
mov eax, dword [ebp - 0xbb0]
lea ecx, [ebp - 0xbb0]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.0040353f
cmp al, 0x5c
je 0x4050f7
push 0x416528
lea ecx, [ebp - 0xbb0]
call fcn.00402f2c
lea eax, [ebp - 0xbb0]
push eax
call fcn.00403286
pop ecx
test al, al
je 0x40523f
push 0x41d150
lea ecx, [ebp - 0xbac]
call fcn.00402c94
call fcn.004081e0
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [ebp - 0xbac]
push edx
push str._d.exe
push eax
call fcn.004033d3
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0xbb0]
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00402dbe
add esp, 0x18
push ebx
push dword [eax]
push dword [ebp - 0xbb4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0xba4]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00403fa4
test esi, esi
je 0x405214
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0xbb0]
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00402dbe
push eax
call fcn.00403115
mov ecx, dword [ebp - 0xba4]
add esp, 0x10
add ecx, 0xfffffff0
mov bl, al
call fcn.00403fa4
test bl, bl
je 0x4051ff
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0xbb0]
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00402dbe
add esp, 0xc
lea ecx, [ebp - 0xba0]
push eax
call fcn.00402d6e
mov ecx, dword [ebp - 0xba4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov byte [ebp - 0xba5], 1
call fcn.00404c9a
test al, al
jne 0x405212
call fcn.004081e0
mov dword [0x41d180], eax
xor ebx, ebx
call fcn.00404c36
test al, al
jne 0x405231
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x50
xor edx, edx
pop ecx
div ecx
inc edx
mov dword [0x41d180], edx
mov ecx, dword [ebp - 0xbac]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbb0]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
cmp byte [ebp - 0xba5], 0
jne 0x40526b
push 0x4164c8
push str._brwtype
lea ecx, [ebp - 0xbbc]
call fcn.00403fc0
mov ecx, dword [ebp - 0xbb4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov eax, dword [ebp - 0xba0]
cmp dword [eax - 0xc], ebx
jne 0x405309
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xba0]
call fcn.004041f7
push 0x5c
push dword [ebp - 0xba0]
call fcn.00408975
pop ecx
pop ecx
test eax, eax
jne 0x4052b2
or eax, 0xffffffff
jmp 0x4052b8
sub eax, dword [ebp - 0xba0]
push str.utils.exe
inc eax
push eax
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0xba0]
call fcn.00403c60
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00402e69
add esp, 0xc
lea ecx, [ebp - 0xba0]
push eax
call fcn.00402d6e
mov ecx, dword [ebp - 0xba4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbb8]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0xba0]
push eax
call fcn.0040411f
pop ecx
pop ecx
test al, al
jne 0x405556
call fcn.00404d46
test al, al
jne 0x40533b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xba0]
mov dword [ebp - 0xbcc], eax
push dword [ebp - 0xba0]
call fcn.004083c8
neg eax
sbb al, al
inc al
pop ecx
pop ecx
push 0x41d150
lea ecx, [ebp - 0xbac]
mov dword [ebp - 0xbd0], eax
call fcn.00402c94
lea eax, [ebp - 0xba4]
push eax
call fcn.004045bb
lea eax, [ebp - 0xbb8]
push eax
call fcn.004043c4
lea eax, [ebp - 0xbc4]
push eax
call fcn.0040475f
lea eax, [ebp - 0xbc8]
push eax
call fcn.00404332
lea eax, [ebp - 0xbb0]
push eax
call fcn.0040467f
mov esi, dword [0x41d180]
mov eax, esi
imul eax, esi
add esp, 0x14
cdq
push 0xd
pop ecx
idiv ecx
cmp edx, 7
jne 0x4053e8
mov ecx, ebx
mov eax, dword [ebp + ecx*4 - 0x264]
imul eax, eax, 0xb0
add esi, eax
inc ecx
cmp ecx, 0x58
jb 0x4053cd
mov dword [0x41d180], esi
lea eax, [ebp - 0xbb4]
push eax
call fcn.00403a6a
mov eax, dword [ebp - 0xbb4]
pop ecx
cmp dword [eax - 0xc], ebx
jne 0x405416
push 0x416534
lea ecx, [ebp - 0xbb4]
call fcn.004041f7
mov eax, dword [ebp - 0xbb4]
push dword [ebp - 0xbd8]
xor ecx, ecx
cmp byte [ebp - 0xbd0], cl
setne cl
push ecx
push dword [ebp - 0xbcc]
push eax
push dword [ebp - 0xbb0]
lea eax, [ebp - 0xbac]
push dword [ebp - 0xbc4]
push dword [ebp - 0xbb8]
push dword [ebp - 0xbc8]
push dword [ebp - 0xba4]
push str._s_ie_error.gif_t_t_actionuninstallation_t_tapp_s_t_tbic_s_t_tverifier_s_t_tver_s_t_tos_s_t_terrorrun_uninstall_from_proxy_t_tlasterror0x_x_t_tfileexists_d_t_trnd_d
push eax
call fcn.004033d3
mov esi, dword [ebp - 0xbac]
add esp, 0x2c
push ebx
push ebx
push 0x4164c8
push esi
push ebx
call fcn.00404d64
mov ecx, eax
call fcn.00402739
mov ecx, dword [0x41d180]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 0xa
jne 0x4054fa
mov edi, ebx
call fcn.004081e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc edi
movsd qword [ebp + edi*8 - 0x95c], xmm0
mov edx, 0xde
cmp edi, edx
jb 0x405497
mov edi, dword [ebp - 0xbc0]
lea ecx, [edx - 1]
mov eax, ecx
cmp ebx, ecx
jge 0x4054f5
movsd xmm0, qword [ebp + eax*8 - 0x954]
movsd xmm1, qword [ebp + eax*8 - 0x95c]
comisd xmm0, xmm1
jbe 0x4054f0
movsd qword [ebp + eax*8 - 0x954], xmm1
movsd qword [ebp + eax*8 - 0x95c], xmm0
dec eax
cmp eax, ebx
jg 0x4054c6
inc ebx
cmp ebx, edx
jl 0x4054c0
mov ecx, dword [ebp - 0xbb4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbb0]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbc8]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbc4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbb8]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xba4]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
lea ecx, [esi - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xba0]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 0xbbc]
lea ecx, [ecx - 0x10]
call fcn.00403fa4
lea ecx, [edi - 0x10]
call fcn.00403fa4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004064bb
leave
ret 0x10