Function at 0x431ea0
Capabilities:
Check if file exists
Copy file
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x414]
push esi
push edi
push 0x208
push 0
push eax
call fcn.00483520
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00483520
add esp, 0x18
call fcn.0045360c
test al, al
je 0x431efb
aad 0x33
invalid
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x431f06
mov ecx, dword [ecx]
lea edx, [ebp - 0x414]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431f10
cmp dword [ebx + 0x14], 8
jb 0x431f2b
mov edx, dword [ebx]
jmp 0x431f2d
mov edx, ebx
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x431f30
lea edi, [ebp - 0x414]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x431f46
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x431f6b
mov ecx, dword [ecx]
lea edx, [ebp - 0x20c]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431f71
cmp dword [ebx + 0x14], 8
jb 0x431f8a
mov ebx, dword [ebx]
mov esi, ebx
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x431f90
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x431fa6
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00453aa1
test al, al
je 0x431fe6
ror dword [esi + 5], 0x47
inc edx
and al, 0xb2
mov ch, 0xd1
pushal
cmpsd dword [esi], dword es:[edi]
adc eax, 0xde4558bb
inc esp
push 0x44
xchg ebx, eax
mov eax, 0xdeeca9d5
jb 0x432014
push ebx
dec ebp
call fcn.00453bb5
test al, al
je 0x43200d
pushal
das
lodsb al, byte [esi]
mov ebp, 0x9605991
mov esp, ebx
adc cl, cl
lahf
loopne 0x43201a
xchg edx, eax
loopne 0x43201a
cli
mov al, 1
ljmp 0xc6e5
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [ebx + 0x50]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43212c
sti
invalid
nop dword [eax]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43212c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00455af0
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00483520
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str._s.bak_d
push eax
call fcn.00407e80
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0048fea6
add esp, 0x2c
lea eax, [ebp - 0x61c]
push 5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x43212c
invalid
call fcn.00453aa1
test al, al
je 0x4320d4
push ss
cmp eax, 0xdf443344
ljmp 0xd3a
call fcn.00453903
test al, al
je 0x4320f2
cmp eax, 0xed156386
jae 0x432088
adc eax, 0x2ca473ed
sub al, 0x4f
sub al, 0x2c
dec edi
cmpsb byte [esi], byte es:[edi]
jae 0x43215a
pop esp
jnp 0x432165
std
sub eax, 0xe8738c04
sbb dword gs:[edx], eax
add byte [eax + eax*8 + 0x33331274], al
call fcn.00453a5c
test al, al
je 0x43210d
xor esi, dword [ebx]
pop ss
add bl, bl
pushal
nop
push edx
and eax, 0x7e63e409
jg 0x4320e0
add al, byte [esi - 0x72ff957e]
test esp, esi
std
invalid
push 0
lea eax, [ebp - 0x20c]
inc ebx
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x432030
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 0xc
add byte [bp + di], dh
lds ecx, [ecx + 0x5653f045]