Function at 0x401c1c
Capabilities:
Copy file
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
call sub.kernel32.dll_GetThreadLocale
mov dword [0x4690fa], ebx
test ecx, ecx
je 0x401c3d
mov dword [0x469103], edx
mov dword [0x469109], eax
mov dword [0x469070], ecx
mov dword [0x46903a], 0x16f12
xchg dword [0x4690a8], edx
and dword [0x4690d6], edi
mov dword [0x46906a], esi
mov byte [0x469090], 0x64
mov dword [0x469073], edx
mov byte [0x4690ec], 0xa0
mov dword [0x4690b2], 0x10bdd
mov esi, 0x121
mov edx, 0x469027
push esi
call fcn.00464b84
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [0x4690ea], edx
mov dword [0x46908e], ecx
and dword [0x4690a3], eax
mov eax, 0x402028
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetDriveTypeW_1
test eax, eax
jne 0x401cd9
mov dword [0x469065], 0x17f5e
mov dword [0x4690da], eax
mov dword [esp - 0x12], ebx
mov dword [0x4690c8], eax
xchg dword [0x4690a9], edx
mov byte [0x4690ec], 0xa0
mov dword [0x4690b2], 0x10bdd
mov esi, 0x121
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 2
jne 0x401c92
mov dword [0x4690e8], edi
mov ebx, dword [0x4690d6]
mov dword [0x469044], esi
sub dword [0x469069], ebx
mov dword [esp - 0x10], edi
call sub.kernel32.dll_GetThreadLocale
mov dword [0x4690ad], ecx
lea eax, [0x469107]
and dword [eax + 0x24], esi
cmp edx, 0xffffffff
jle 0x401d2f
mov edx, ebx
mov dword [0x4690e9], ebx
mov ebx, eax
sub dword [0x469106], eax
mov esi, dword [esp + 0xc]
mov dword [0x46905b], edi
mov dword [0x469104], ebx
call fcn.00464b84
mov dword [0x46910a], ebx
xchg dword [0x4690d1], esi
xchg dword [0x469059], ebx
mov eax, 0x402048
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileAttributesW
test eax, eax
je 0x401d8b
and dword [0x4690f0], edx
and dword [0x469102], ecx
mov dword [0x46907a], edx
call fcn.00464dc0
lea edx, [0x4690e9]
mov dword [edx], 0xeb
mov esi, dword [esp + 4]
mov dword [0x469093], edx
mov ecx, dword [0x46906a]
mov edi, edx
push ecx
push 1
mov ecx, 0x469090
call fcn.00464b84
mov word [0x469096], 0x7ecd
mov dword [0x469039], 0x17f96
mov dword [0x46904a], eax
mov dword [0x469025], ecx
mov edi, dword [0x469095]
mov dword [ebp - 0xc], 0x1d260
mov dword [ebp - 0x14], 0x17540
mov dword [ebp - 0x18], 0x103df
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CreateCaret
test eax, eax
jne 0x401e3c
cmp eax, dword [0x4690d1]
jl 0x401e22
mov dword [0x469020], 0x14d23
jmp 0x401e34
mov dword [0x4690b2], edi
mov dword [0x46907a], esi
sub ebx, 0xbc
inc dword [0x469096]
mov ebx, esi
call fcn.00465108
mov eax, 0xd7
mov dword [0x46903c], edi
cmp dword [0x4690c8], edx
jne 0x401e6d
and dword [0x4690cf], edi
mov dword [0x469108], ecx
lea edi, [0x4690cb]
sub dword [edi + 0x18], 0x87
mov dword [0x4690e5], 0x11729
mov ebx, dword [0x4690cf]
mov eax, 0x402054
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetFileAttributesW
test eax, eax
jne 0x401ea4
mov dword [0x469027], eax
mov dword [0x469098], ebx
mov dword [0x469092], edx
lea eax, [0x469035]
mov dword [eax + 8], 0xb4
dec esi
mov dword [0x4690e4], 0x14bd4
mov dword [0x469041], 0x136ba
mov dword [0x469068], ecx
cmp dword [0x46908b], 0
jle 0x401ee7
xchg dword [0x469029], edi
mov dword [0x4690eb], 0x13ddf
jmp 0x401efd
mov word [0x4690ba], 0x1fd4
mov byte [0x4690d3], 0x85
mov dword [0x4690fe], ecx
mov dword [0x469085], 0x152a2
mov dword [esp - 0x12], esi
mov dword [0x469081], eax
mov eax, 0x402080
mov dword [ebp - 0x20], eax
mov eax, 0x40208c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x40102c
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x18c5d
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CopyFileExA
mov eax, 0x402098
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
call sub.shlwapi.dll_PathUndecorateA
call sub.kernel32.dll_GetThreadLocale
xor eax, eax
mov dword [ebp - 0x50], eax
test dl, dl
jne 0x401f83
mov dword [0x46906c], ebx
sub edi, dword [0x469098]
jmp 0x401f93
inc edx
mov dword [0x4690e0], 0x145e5
mov ebx, 0xa0
lea esi, [0x4690cc]
mov dword [esi + 0x1c], edi
mov esi, 0x126
xchg dword [0x469105], ecx
mov dword [0x469026], edx
mov eax, 0x4020a0
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0x11e7d
mov dword [ebp - 0x4c], 0xffffffff
mov eax, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_ObjectPrivilegeAuditAlarmA
test eax, eax
jne 0x402009
mov dword [0x4690b3], 0x12fb7
mov dword [0x469010], esi
dec byte [0x4690de]
mov dword [0x469081], 0x12e55
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 3
jne 0x401f71
push edi
mov edx, 0x469015
call fcn.00464b84
mov esp, ebp
pop ebp
ret