Function at 0x401f2d
Capabilities:
Copy file
Create process on windows
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e14
call fcn.0040e930
push edi
call fcn.0040300e
test eax, eax
jne 0x40213e
push 0x43e104
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x401f72
push 0x43e108
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e8b0
add esp, 8
test eax, eax
je 0x401fa0
push 0x43e10c
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x402016
push 0x43e110
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x402016
mov byte [ebp - 0x1ba8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1ba7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1aa4], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1aa3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x1ba8]
push ecx
push 1
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea edx, [ebp - 0x1aa4]
push edx
push 2
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x30
lea eax, [ebp - 0x1aa4]
push eax
lea ecx, [ebp - 0x1ba8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 0x199c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x199b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x199c]
push eax
call fcn.00402ea9
add esp, 8
test eax, eax
je 0x402065
push 8
push ecx
mov ecx, esp
mov dword [ebp - 0x1dc8], esp
lea edx, [ebp - 0x199c]
push edx
call fcn.004219ab
call fcn.00403091
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x199c]
push eax
call fcn.0040e060
add esp, 0xc
lea ecx, [ebp - 0x199c]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x199c]
push edx
lea ecx, [ebp - 0x19a0]
call fcn.004219ab
push 0x43e114
push 1
lea eax, [ebp - 0x1dd0]
push eax
lea ecx, [ebp - 0x19a0]
call fcn.0041e835
push eax
call fcn.00403360
mov byte [ebp - 0x1dcc], al
lea ecx, [ebp - 0x1dd0]
call fcn.0042193d
mov ecx, dword [ebp - 0x1dcc]
and ecx, 0xff
test ecx, ecx
je 0x4020ef
push 0x43e118
lea ecx, [ebp - 0x19a0]
call fcn.00421d19
push str.setup.log
lea ecx, [ebp - 0x19a0]
call fcn.00421d19
push 8
push ecx
mov ecx, esp
mov dword [ebp - 0x1dd4], esp
lea edx, [ebp - 0x19a0]
push edx
call fcn.004216b2
call fcn.00403091
add esp, 8
mov dword [ebp - 0x1dd8], 0
lea ecx, [ebp - 0x19a0]
call fcn.0042193d
mov eax, dword [ebp - 0x1dd8]
jmp 0x402ae9
mov byte [ebp - 0x1574], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1573]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x444868]
mov ecx, dword [eax]
push ecx
push 0x43e128
lea edx, [ebp - 0x1574]
push edx
call fcn.0040e859
add esp, 0xc
push 0x442828
lea ecx, [ebp - 0x1898]
call fcn.004219ab
cmp dword [0x444864], 0
je 0x402255
mov dword [ebp - 0x1bac], 1
jmp 0x4021ab
mov eax, dword [ebp - 0x1bac]
add eax, 1
mov dword [ebp - 0x1bac], eax
mov ecx, dword [ebp - 0x1bac]
cmp ecx, dword [0x444864]
jge 0x402255
push 0x43e164
mov edx, dword [ebp - 0x1bac]
mov eax, dword [0x444868]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00416970
add esp, 8
test eax, eax
jne 0x4021ee
lea edx, [ebp - 0x1898]
push edx
call fcn.00401b22
add esp, 4
jmp 0x402255
push 0x43e168
mov eax, dword [ebp - 0x1bac]
mov ecx, dword [0x444868]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x402230
push 0x43e16c
mov eax, dword [ebp - 0x1bac]
mov ecx, dword [0x444868]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0040e8b0
add esp, 8
test eax, eax
je 0x402250
mov eax, dword [ebp - 0x1bac]
mov ecx, dword [0x444868]
mov edx, dword [ecx + eax*4]
add edx, 3
push edx
lea ecx, [ebp - 0x1898]
call fcn.00421ac6
jmp 0x402255
jmp 0x40219c
mov byte [ebp - 0x1470], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x146f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1470]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x1898]
call fcn.004016e0
test eax, eax
je 0x402341
lea ecx, [ebp - 0x1470]
push ecx
lea ecx, [ebp - 0x1898]
call fcn.00421ac6
push 1
lea edx, [ebp - 0x1de0]
push edx
lea ecx, [ebp - 0x1898]
call fcn.0041e835
push eax
push 0x43e170
call fcn.00403380
mov byte [ebp - 0x1ddc], al
lea ecx, [ebp - 0x1de0]
call fcn.0042193d
mov eax, dword [ebp - 0x1ddc]
and eax, 0xff
test eax, eax
je 0x4022f4
push 0x43e174
lea ecx, [ebp - 0x1898]
call fcn.00421d19
lea ecx, [ebp - 0x1bb0]
push ecx
call fcn.00403138
add esp, 4
lea ecx, [ebp - 0x1bb0]
call fcn.004016e0
test eax, eax
jne 0x402326
lea edx, [ebp - 0x1bb0]
push edx
lea ecx, [ebp - 0x1898]
call fcn.00421d55
jmp 0x402336
push str.GSC_TEMP
lea ecx, [ebp - 0x1898]
call fcn.00421d19
lea ecx, [ebp - 0x1bb0]
call fcn.0042193d
push ecx
mov ecx, esp
mov dword [ebp - 0x1de4], esp
lea eax, [ebp - 0x1898]
push eax
call fcn.004216b2
call fcn.00401bfd
add esp, 4
push 0
lea ecx, [ebp - 0x1898]
call fcn.00421d6d
push eax
call fcn.00401876
add esp, 4
and eax, 0xff
test eax, eax
jne 0x4023ab
push 0
push 0
push str.Can_not_create_temp_folder__
call fcn.0042c551
mov dword [ebp - 0x1de8], 0xffffffff
lea ecx, [ebp - 0x1898]
call fcn.0042193d
mov eax, dword [ebp - 0x1de8]
jmp 0x402ae9
lea ecx, [ebp - 0x111c]
call fcn.00409f60
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1dec], esp
lea edx, [ebp - 0x1898]
push edx
call fcn.004216b2
lea ecx, [ebp - 0x111c]
call fcn.0040a83a
cmp eax, 0x3ea
je 0x40240c
mov dword [ebp - 0x1df0], 0xffffffff
lea ecx, [ebp - 0x111c]
call fcn.00409fe6
lea ecx, [ebp - 0x1898]
call fcn.0042193d
mov eax, dword [ebp - 0x1df0]
jmp 0x402ae9
lea eax, [ebp - 0x1898]
push eax
lea ecx, [ebp - 0x1330]
call fcn.004216b2
push 0x43e1a4
push 1
lea ecx, [ebp - 0x1df8]
push ecx
lea ecx, [ebp - 0x1330]
call fcn.0041e835
push eax
call fcn.00403360
mov byte [ebp - 0x1df4], al
lea ecx, [ebp - 0x1df8]
call fcn.0042193d
mov edx, dword [ebp - 0x1df4]
and edx, 0xff
test edx, edx
je 0x40246e
push 0x43e1a8
lea ecx, [ebp - 0x1330]
call fcn.00421d19
push 0x43e1ac
lea ecx, [ebp - 0x1330]
call fcn.00421d19
push 0
lea ecx, [ebp - 0x1330]
call fcn.00421d6d
push eax
lea ecx, [ebp - 0x1228]
call fcn.00405460
lea ecx, [ebp - 0x1680]
call fcn.00401680
mov byte [ebp - 0x167c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x167b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1790], 0x104
lea eax, [ebp - 0x1790]
push eax
lea ecx, [ebp - 0x167c]
push ecx
push 0x43e1b8
lea ecx, [ebp - 0x1228]
call fcn.00405c5a
lea edx, [ebp - 0x1898]
push edx
lea ecx, [ebp - 0x1680]
call fcn.00421a76
push 0x43e1c4
push 1
lea eax, [ebp - 0x1e00]
push eax
lea ecx, [ebp - 0x1680]
call fcn.0041e835
push eax
call fcn.00403360
mov byte [ebp - 0x1dfc], al
lea ecx, [ebp - 0x1e00]
call fcn.0042193d
mov ecx, dword [ebp - 0x1dfc]
and ecx, 0xff
test ecx, ecx
je 0x402545
push 0x43e1c8
lea ecx, [ebp - 0x1680]
call fcn.00421d19
lea edx, [ebp - 0x167c]
push edx
lea ecx, [ebp - 0x1680]
call fcn.00421d19
mov byte [ebp - 0x1894], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1893]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10c], 0x104
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x1894]
push ecx
push str.SILENCE
lea ecx, [ebp - 0x1228]
call fcn.00405c5a
push str.TRUE
lea edx, [ebp - 0x1894]
push edx
call fcn.00416970
add esp, 8
test eax, eax
jne 0x4025c6
push 0x43e1dc
lea eax, [ebp - 0x1894]
push eax
call fcn.0040e270
add esp, 8
jmp 0x4025dc
push 0x104
push 0
lea ecx, [ebp - 0x1894]
push ecx
call fcn.0040e060
add esp, 0xc
mov byte [ebp - 0x1784], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1783]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x178c], 0x104
lea edx, [ebp - 0x178c]
push edx
lea eax, [ebp - 0x1784]
push eax
push str.BACKUP
lea ecx, [ebp - 0x1228]
call fcn.00405c5a
mov byte [ebp - 0x132c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x132b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x43e1e8
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40268a
push 0x43e1ec
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40268a
push 0x43e1f0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40268a
push 0x43e1f4
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e8b0
add esp, 8
test eax, eax
je 0x40269e
push 0x43e1f8
lea edx, [ebp - 0x132c]
push edx
call fcn.0040e270
add esp, 8
push 0x43e1fc
lea eax, [ebp - 0x1894]
push eax
call fcn.00416970
add esp, 8
test eax, eax
je 0x402750
push 0x43e200
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40270e
push 0x43e204
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40270e
push 0x43e208
mov eax, dword [ebp + 0x10]
push eax
call fcn.0040e8b0
add esp, 8
test eax, eax
jne 0x40270e
push 0x43e20c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040e8b0
add esp, 8
test eax, eax
je 0x40273a
push 0x104
push 0
lea edx, [ebp - 0x1894]
push edx
call fcn.0040e060
add esp, 0xc
push 0x43e210
lea eax, [ebp - 0x1894]
push eax
call fcn.0040e270
add esp, 8
jmp 0x402750
push 0x104
push 0
lea ecx, [ebp - 0x1894]
push ecx
call fcn.0040e060
add esp, 0xc
push 0x43e214
lea ecx, [ebp - 0x1578]
call fcn.004219ab
lea edx, [ebp - 0x1894]
push edx
lea ecx, [ebp - 0x1578]
call fcn.00421d19
mov dword [ebp - 0x136c], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x1368]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x136c], 0x3c
push 0
lea ecx, [ebp - 0x1680]
call fcn.00421d6d
mov dword [ebp - 0x135c], eax
mov dword [ebp - 0x1350], 5
push 0
lea ecx, [ebp - 0x1578]
call fcn.00421d6d
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x1368], 0x40
lea eax, [ebp - 0x136c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x402837
mov dword [ebp - 0x1e04], 0xffffffff
lea ecx, [ebp - 0x1578]
call fcn.0042193d
lea ecx, [ebp - 0x1680]
call fcn.0042193d
lea ecx, [ebp - 0x1228]
call fcn.004054c8
lea ecx, [ebp - 0x1330]
call fcn.0042193d
lea ecx, [ebp - 0x111c]
call fcn.00409fe6
lea ecx, [ebp - 0x1898]
call fcn.0042193d
mov eax, dword [ebp - 0x1e04]
jmp 0x402ae9
cmp dword [ebp - 0x1334], 0
je 0x40284f
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1334]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00402f8a
mov dword [ebp - 0x1788], eax
mov edx, dword [ebp - 0x1334]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x108], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00402ea9
add esp, 8
test eax, eax
je 0x4028b8
mov edx, dword [ebp - 0x1788]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x1e08], esp
lea eax, [ebp - 0x108]
push eax
call fcn.004219ab
call fcn.00403091
add esp, 8
lea ecx, [ebp - 0x1784]
push ecx
call fcn.0040e6a0
add esp, 4
test eax, eax
je 0x402a75
mov byte [ebp - 0x1cb4], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1cb3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x1cb4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x1db8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1db7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x1db8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43e218
lea ecx, [ebp - 0x1db8]
push ecx
call fcn.0040e280
add esp, 8
lea edx, [ebp - 0x1784]
push edx
lea eax, [ebp - 0x1db8]
push eax
call fcn.0040e280
add esp, 8
lea ecx, [ebp - 0x1db8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1dbc], eax
mov edx, dword [ebp - 0x1dbc]
and edx, 0xfffffffe
mov dword [ebp - 0x1dbc], edx
mov eax, dword [ebp - 0x1dbc]
and al, 0xfd
mov dword [ebp - 0x1dbc], eax
mov ecx, dword [ebp - 0x1dbc]
and ecx, 0xfffffffb
mov dword [ebp - 0x1dbc], ecx
mov edx, dword [ebp - 0x1dbc]
push edx
lea eax, [ebp - 0x1db8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [ebp - 0x1db8]
push ecx
lea edx, [ebp - 0x1cb4]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402a75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc4], eax
lea ecx, [ebp - 0x1dc0]
call fcn.00401680
mov eax, dword [ebp - 0x1dc4]
push eax
lea ecx, [ebp - 0x1db8]
push ecx
lea edx, [ebp - 0x1cb4]
push edx
push str.Fail_to_backup__s_to__s__Error:___d_
lea eax, [ebp - 0x1dc0]
push eax
call fcn.0041ed27
add esp, 0x14
lea ecx, [ebp - 0x1dc0]
call fcn.00401700
push eax
call fcn.004017c0
add esp, 4
mov dword [ebp - 0x1e0c], 0xffffffff
lea ecx, [ebp - 0x1dc0]
call fcn.0042193d
lea ecx, [ebp - 0x1578]
call fcn.0042193d
lea ecx, [ebp - 0x1680]
call fcn.0042193d
lea ecx, [ebp - 0x1228]
call fcn.004054c8
lea ecx, [ebp - 0x1330]
call fcn.0042193d
lea ecx, [ebp - 0x111c]
call fcn.00409fe6
lea ecx, [ebp - 0x1898]
call fcn.0042193d
mov eax, dword [ebp - 0x1e0c]
jmp 0x402ae9
call fcn.00402d61
push ecx
mov ecx, esp
mov dword [ebp - 0x1e10], esp
lea edx, [ebp - 0x1898]
push edx
call fcn.004216b2
call fcn.00401bfd
add esp, 4
mov dword [ebp - 0x1e14], 0
lea ecx, [ebp - 0x1578]
call fcn.0042193d
lea ecx, [ebp - 0x1680]
call fcn.0042193d
lea ecx, [ebp - 0x1228]
call fcn.004054c8
lea ecx, [ebp - 0x1330]
call fcn.0042193d
lea ecx, [ebp - 0x111c]
call fcn.00409fe6
lea ecx, [ebp - 0x1898]
call fcn.0042193d
mov eax, dword [ebp - 0x1e14]
pop edi
mov esp, ebp
pop ebp
ret 0x10