Function at 0x401170
Capabilities:
Copy file
Execute command
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402c07
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Chcp_1251
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004018f0
mov edi, eax
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x2c
jb 0x40120f
lea eax, [ecx + 0x2c]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x4011f6
mov eax, dword [edi]
push 0x2c
lea esi, [eax + ecx]
push str.System32Windows.ApplicationModel.Store.dll
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2c], 0
jmp 0x40122e
push 0x2c
push str.System32Windows.ApplicationModel.Store.dll
mov byte [ebp - 0x14c], 0
mov ecx, edi
push dword [ebp - 0x14c]
push 0x2c
call fcn.00401c50
mov edi, eax
mov dword [ebp - 0x138], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x134], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x148], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x138], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x168]
cmp ecx, 0xf
jbe 0x4012b4
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4012aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4012aa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401ea8
add esp, 8
lea eax, [ebp - 0x114]
mov dword [ebp - 0x16c], 0
push eax
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
call fcn.004018f0
mov edi, eax
mov byte [ebp - 4], 3
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x2c
jb 0x40131e
lea eax, [ecx + 0x2c]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401305
mov eax, dword [edi]
push 0x2c
lea esi, [eax + ecx]
push str.SysWOW64Windows.ApplicationModel.Store.dll
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x2c], 0
jmp 0x40133d
push 0x2c
push str.SysWOW64Windows.ApplicationModel.Store.dll
mov byte [ebp - 0x14c], 0
mov ecx, edi
push dword [ebp - 0x14c]
push 0x2c
call fcn.00401c50
mov edi, eax
mov dword [ebp - 0x120], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x11c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x130], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x120], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x180]
cmp ecx, 0xf
jbe 0x4013c3
mov edx, dword [ebp - 0x194]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4013b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4013b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x403270
push 0x401c20
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0xf
mov byte [ebp - 0x194], 0
call fcn.00401a00
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.yes__no_____
call fcn.00401a00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
cmp dword [ebp - 0x118], 0x796573
jne 0x401814
push str.Hack_Sys32
lea ecx, [ebp - 0x17c]
call fcn.004018f0
mov edi, eax
mov byte [ebp - 4], 6
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x29
jb 0x40147b
lea eax, [ecx + 0x29]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x401462
mov eax, dword [edi]
push 0x29
lea esi, [eax + ecx]
push str.Sys32Windows.ApplicationModel.Store.dll
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x29], 0
jmp 0x40149a
push 0x29
push str.Sys32Windows.ApplicationModel.Store.dll
mov byte [ebp - 0x14c], 0
mov ecx, edi
push dword [ebp - 0x14c]
push 0x29
call fcn.00401c50
mov edi, eax
mov dword [ebp - 0x154], 0
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x150], 0
lea eax, [ebp - 0x164]
xorps xmm0, xmm0
movups xmmword [ebp - 0x164], xmm0
push 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x164], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x154], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp dword [ebp - 0x134], 0xf
cmova ecx, dword [ebp - 0x148]
cmp dword [ebp - 0x150], 0xf
push ecx
cmova eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x150]
mov esi, eax
cmp ecx, 0xf
jbe 0x40154a
mov edx, dword [ebp - 0x164]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401540
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401595
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x168]
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0xf
mov byte [ebp - 0x164], 0
cmp ecx, 0xf
jbe 0x4015a5
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40159b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40159b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x403320
push 0x401c20
test esi, esi
jne 0x4015be
mov edx, 0x403340
call fcn.00401a00
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.Hack_WOW64
lea ecx, [ebp - 0x1ac]
call fcn.004018f0
mov edi, eax
mov byte [ebp - 4], 7
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x29
jb 0x401618
lea eax, [ecx + 0x29]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x4015ff
mov eax, dword [edi]
push 0x29
lea esi, [eax + ecx]
push str.WOW64Windows.ApplicationModel.Store.dll
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x29], 0
jmp 0x401637
push 0x29
push str.WOW64Windows.ApplicationModel.Store.dll
mov byte [ebp - 0x14c], 0
mov ecx, edi
push dword [ebp - 0x14c]
push 0x29
call fcn.00401c50
mov edi, eax
mov dword [ebp - 0x154], 0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x150], 0
lea eax, [ebp - 0x164]
xorps xmm0, xmm0
movups xmmword [ebp - 0x164], xmm0
push 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x164], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x154], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp dword [ebp - 0x11c], 0xf
cmova ecx, dword [ebp - 0x130]
cmp dword [ebp - 0x150], 0xf
push ecx
cmova eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x150]
mov esi, eax
cmp ecx, 0xf
jbe 0x4016e7
mov edx, dword [ebp - 0x164]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4016dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401732
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x198]
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0xf
mov byte [ebp - 0x164], 0
cmp ecx, 0xf
jbe 0x401742
mov edx, dword [ebp - 0x1ac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401738
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401738
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x403390
push 0x401c20
test esi, esi
jne 0x40175b
mov edx, 0x4033b0
call fcn.00401a00
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x4017a2
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401798
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401899
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp ecx, 0xf
jbe 0x4017f7
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4017ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401899
push ecx
push edx
call fcn.00401ea8
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401e6a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x40184a
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401840
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401899
push ecx
push edx
call fcn.00401ea8
add esp, 8
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp ecx, 0xf
jbe 0x4017f7
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4017ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4017ed
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3