Function at 0x466a74
Capabilities:
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0x1d220
mov dword [ebp - 0xc], 0x141d6
mov dword [ebp - 0x10], 0x1733b
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_CreateCaret
test eax, eax
jne 0x466ac2
mov dword [0x469084], edi
mov word [0x46901c], 0xfbc6
mov dword [esp - 0x28], eax
mov edx, edi
mov esi, dword [esp + 0xc]
mov dword [0x46905b], edi
mov dword [0x469104], ebx
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 3
jne 0x466a7f
mov dword [0x46905a], ecx
mov dword [0x469086], edi
mov dword [0x469029], ecx
mov dword [ebp - 0x14], 0x10de5
mov dword [ebp - 0x1c], 0x1d045
mov dword [ebp - 0x20], 0x1ba01
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_CreateCaret
call fcn.004675cc
xchg dword [0x46905e], eax
xchg dword [esp - 0x20], edi
mov dword [0x4690f8], eax
mov dword [0x4690bd], ecx
inc dword [0x4690ea]
mov eax, 0x466e04
mov dword [ebp - 0x24], eax
mov eax, 0x466e18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x40102c
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x116e4
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CopyFileExA
mov dword [0x4690fa], ebx
test ecx, ecx
je 0x466b93
mov dword [0x469103], edx
mov dword [0x469109], eax
mov dword [0x469070], ecx
mov dword [0x46903a], 0x16f12
xchg dword [0x4690a8], edx
and dword [0x4690d6], edi
mov dword [0x46906a], esi
mov byte [0x469090], 0x64
mov dword [0x469073], edx
call sub.kernel32.dll_GetThreadLocale
sub ecx, 0x42
mov dword [0x46902b], edx
mov dword [0x469101], 0x162ac
lea eax, [0x469035]
mov dword [eax + 8], 0xb4
dec esi
mov dword [0x4690e4], 0x14bd4
mov dword [0x469041], 0x136ba
xor eax, eax
mov dword [ebp - 0x64], eax
call sub.user32.dll_GetDesktopWindow
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 3
jne 0x466c01
mov esi, dword [esp + 0xc]
mov dword [0x46905b], edi
mov dword [0x469104], ebx
call fcn.00401288
mov dword [0x469103], esi
cmp dword [ebp + 0x28], 0
jge 0x466c34
mov edi, dword [esp + 8]
mov dword [0x469100], eax
mov dword [esp - 0x10], ebx
mov dword [0x46901d], edx
lea edi, [0x4690b0]
add dword [edi + 8], 0xe9
mov dword [0x4690fb], 0x17946
mov dword [0x46902f], edx
mov dword [0x4690f4], ebx
mov dword [0x4690b1], edx
mov eax, 0x466e2c
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x12e87
mov dword [ebp - 0x4c], 0xffffffff
mov eax, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
jne 0x466ccf
mov dword [0x4690e3], edx
lea esi, [0x469090]
sub dword [esi + 0x12], 0x30
mov dword [0x469036], 0x14973
mov dword [0x469099], ecx
and ebx, dword [0x469040]
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_GetCaretPos
test eax, eax
jne 0x466d14
and dword [0x469085], ebx
mov dword [0x46907e], esi
cmp word [0x469037], 0
jle 0x466cff
mov byte [0x4690a6], 0xc
sub dword [0x4690c0], eax
mov dword [0x469031], ecx
add dword [0x46901e], edi
mov word [0x46907f], 0xe382
sub dword [0x4690c6], eax
mov ecx, dword [0x4690d5]
mov word [0x469054], 0x24b5
mov dword [0x46903c], 0x1436e
and edi, ebx
call sub.kernel32.dll_GetThreadLocale
call fcn.00465108
mov eax, 0x466e3c
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetFileAttributesW
call fcn.004675cc
mov esi, dword [esp + 0xc]
mov dword [0x46905b], edi
mov dword [0x469104], ebx
push 0
push 0
push 0
call fcn.00464b84
mov dword [0x4690a4], ebx
mov dword [0x46901a], ecx
mov dword [0x469023], edx
lea eax, [ebp - 0x60]
push eax
call sub.user32.dll_GetCaretPos
test eax, eax
je 0x466da7
mov esi, eax
mov dword [0x46905b], eax
mov dword [0x46903f], ecx
xchg dword [esp - 8], edx
inc dword [0x46909a]
call fcn.00402374
mov dword [0x4690fa], ebx
test ecx, ecx
je 0x466dc2
mov dword [0x469103], edx
mov dword [0x469109], eax
mov dword [0x469070], ecx
mov dword [0x46903a], 0x16f12
xchg dword [0x4690a8], edx
and dword [0x4690d6], edi
mov dword [0x46906a], esi
mov byte [0x469090], 0x64
mov dword [0x469073], edx
mov ecx, 0x46908f
push 1
call fcn.00401c1c
mov esp, ebp
pop ebp
ret