Function at 0x401870
Capabilities:
Copy file
Delete file
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb78
push esi
push edi
lea edi, [ebp - 0xb78]
mov ecx, 0x2de
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], str._unset_
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004049d6
add esp, 8
test eax, eax
jne 0x4018e0
mov esi, esp
push 0x40
push 0x42d12c
push 0x42d134
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004041c0
mov eax, 1
jmp 0x401f60
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004049d6
add esp, 8
test eax, eax
je 0x401908
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004049d6
add esp, 8
test eax, eax
jne 0x40192c
mov esi, esp
push 0x40
push 0x42d160
push 0x42d168
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004041c0
xor eax, eax
jmp 0x401f60
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004044d0
add esp, 0xc
mov dword [ebp - 0x218], str.driversetchosts
mov esi, esp
push 0x100
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, esp
call fcn.004041c0
test eax, eax
jne 0x401982
push str._get_system32_directory_error_._n
call fcn.0040104b
add esp, 4
mov eax, 1
jmp 0x401f60
push 0x40
mov edx, dword [ebp - 0x218]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004049bb
add esp, 4
lea ecx, [ebp + eax*2 - 0x210]
push ecx
call fcn.0040446b
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x41c]
push edx
call fcn.004044d0
add esp, 0xc
push 0x64
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call fcn.0040446b
add esp, 0xc
push 0x10
push str..0.bak
lea edx, [ebp - 0x41c]
push edx
call fcn.004049bb
add esp, 4
lea eax, [ebp + eax*2 - 0x41c]
push eax
call fcn.0040446b
add esp, 0xc
mov esi, esp
push 1
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], 0xffffffff
mov esi, esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
jne 0x401a8b
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041c0
push eax
push 0x42d218
call fcn.0040104b
add esp, 8
mov eax, 1
jmp 0x401f60
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x438], 0x2000
mov ecx, dword [ebp - 0x438]
push ecx
call fcn.0040493b
add esp, 4
mov dword [ebp - 0xb68], eax
mov edx, dword [ebp - 0xb68]
mov dword [ebp - 0x43c], edx
push 4
push 0
mov eax, dword [ebp - 0x43c]
push eax
call fcn.004044d0
add esp, 0xc
mov esi, esp
push 0
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x43c]
push eax
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x401b67
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041c0
push eax
push str.Could_not_etchosts.0.bak_file__error__d__n
call fcn.0040104b
add esp, 8
mov esi, esp
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004041c0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0xb6c], eax
mov ecx, dword [ebp - 0xb6c]
push ecx
call fcn.004048bb
add esp, 4
mov eax, 1
jmp 0x401f60
mov edx, dword [ebp - 0x438]
sub edx, dword [ebp - 0x430]
sub edx, 1
push edx
push 0
mov eax, dword [ebp - 0x43c]
add eax, dword [ebp - 0x430]
push eax
call fcn.004044d0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004041c0
push 0x200
push 0
lea edx, [ebp - 0x640]
push edx
call fcn.004044d0
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x848]
push eax
call fcn.004044d0
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0xa50]
push ecx
call fcn.004044d0
add esp, 0xc
mov esi, esp
push 0
push 0
push 0x200
lea edx, [ebp - 0x640]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, esp
call fcn.004041c0
mov esi, esp
push 0
push 0
push 0x200
lea ecx, [ebp - 0x848]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, esp
call fcn.004041c0
mov esi, esp
push 0
push 0
push 0x200
lea eax, [ebp - 0xa50]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0xb60], str.0.0.0.0
mov edx, dword [ebp - 0xb60]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004049d6
add esp, 8
test eax, eax
je 0x401d15
lea ecx, [ebp - 0x848]
push ecx
call fcn.00404830
add esp, 4
add eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x438]
jae 0x401d15
push 0x100
push 0
lea edx, [ebp - 0xb58]
push edx
call fcn.004044d0
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x848]
push ecx
push str._r_n_s__t_t__s_r_n
push 0x100
lea edx, [ebp - 0xb58]
push edx
call fcn.00404714
add esp, 0x14
lea eax, [ebp - 0xb58]
push eax
call fcn.00404830
add esp, 4
push eax
lea ecx, [ebp - 0xb58]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call fcn.00404830
add esp, 4
add eax, dword [ebp - 0x43c]
push eax
call fcn.00404550
add esp, 0xc
mov eax, dword [ebp - 0xb60]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004049d6
add esp, 8
test eax, eax
je 0x401dd2
lea edx, [ebp - 0x848]
push edx
call fcn.00404830
add esp, 4
mov esi, eax
add esi, dword [ebp - 0x430]
lea eax, [ebp - 0xa50]
push eax
call fcn.00404830
add esp, 4
add esi, eax
cmp esi, dword [ebp - 0x438]
jae 0x401dd2
push 0x100
push 0
lea ecx, [ebp - 0xb58]
push ecx
call fcn.004044d0
add esp, 0xc
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0xa50]
push eax
push str._s__t_t__s_r_n
push 0x100
lea ecx, [ebp - 0xb58]
push ecx
call fcn.00404714
add esp, 0x14
lea edx, [ebp - 0xb58]
push edx
call fcn.00404830
add esp, 4
push eax
lea eax, [ebp - 0xb58]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00404830
add esp, 4
add eax, dword [ebp - 0x43c]
push eax
call fcn.00404550
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0xb64], 0xffffffff
mov esi, esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0xb64], 0xffffffff
jne 0x401e6b
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041c0
push eax
push 0x42d2e0
call fcn.0040104b
add esp, 8
mov ecx, dword [ebp - 0x43c]
mov dword [ebp - 0xb70], ecx
mov edx, dword [ebp - 0xb70]
push edx
call fcn.004048bb
add esp, 4
mov eax, 1
jmp 0x401f60
mov dword [ebp - 0x430], 0
mov esi, esp
push 0
lea eax, [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.00404830
add esp, 4
push eax
mov edx, dword [ebp - 0x43c]
push edx
mov eax, dword [ebp - 0xb64]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004041c0
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x401f0f
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004041c0
push eax
push str.Could_not_write_file__error__d__n
call fcn.0040104b
add esp, 8
mov esi, esp
mov ecx, dword [ebp - 0xb64]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004041c0
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0xb74], edx
mov eax, dword [ebp - 0xb74]
push eax
call fcn.004048bb
add esp, 4
mov eax, 1
jmp 0x401f60
mov esi, esp
mov ecx, dword [ebp - 0xb64]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004041c0
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0xb78], edx
mov eax, dword [ebp - 0xb78]
push eax
call fcn.004048bb
add esp, 4
mov esi, esp
push 0x40
push 0x42d364
push 0x42d36c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.004041c0
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x401f90]
call fcn.004041e3
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004044b7
add esp, 0xb78
cmp ebp, esp
call fcn.004041c0
mov esp, ebp
pop ebp
ret