Function at 0x429dd6
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file

Disassembly:
push 0xfc
mov eax, 0x65892f
call fcn.005bea6f
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x100]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push 0
push 0
push 0xc2d
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push 0x12fac74
push dword [0x12fa964]
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], eax
call fcn.004203f9
mov eax, dword [ebp + 0x1c]
lea ecx, [edi + 4]
and dword [ebp - 4], 0
push esi
movzx eax, al
push eax
push dword [ebp + 0x18]
mov eax, dword [ecx]
push dword [ebp + 0x14]
push ebx
call dword [eax + 0x104]
push eax
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str._s_FileFormat_s_CurrentPage_d_TotalPages_d_ToMultiPageFile_d_FileName_s
push 0xc30
lea eax, [ebp - 0x100]
push 0x200
push eax
call fcn.0042077f
add esp, 0x28
mov esi, 0x80004001
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 7
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
mov byte [ebp - 4], 0x1d
mov word [eax], cx
push dword [ebp - 0x104]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x1e
call fcn.0041bcf1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00481e91
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x20
call fcn.0041de91
push 0
mov byte [ebp - 4], 0x21
push 1
lea ecx, [ebp - 0x70]
call fcn.0041746a
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x26
call fcn.0041746a
mov byte [ebp - 4], 0x1e
cmp ebx, 0x20
jg 0x429f94
je 0x429fab
test ebx, ebx
jle 0x42a389
cmp ebx, 2
jle 0x429f23
cmp ebx, 4
je 0x429f23
cmp ebx, 8
je 0x429f23
cmp ebx, 0x10
je 0x429fab
jmp 0x42a389
cmp byte [edi + 0x371], 0
je 0x429f53
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
mov ecx, edi
push 0
cmovae eax, dword [ebp - 0x40]
push eax
push dword [ebp - 0x108]
mov byte [ebp - 4], 0x1e
call fcn.004299a5
mov esi, eax
jmp 0x429f55
xor esi, esi
test esi, esi
jne 0x42a389
mov ecx, edi
call fcn.0042c81e
push dword [ebp + 0x1c]
mov ecx, dword [edi + 0x2d4]
push dword [ebp + 0x14]
push ebx
push dword [ebp - 0x108]
mov eax, dword [ecx]
push dword [ebp - 0x104]
call dword [eax + 0xc0]
push ecx
mov ecx, edi
mov esi, eax
call fcn.0042c8ce
jmp 0x42a389
mov eax, ebx
sub eax, 0x40
je 0x429fab
sub eax, 0x40
je 0x429fab
sub eax, 0x180
jne 0x42a389
xor edx, edx
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x14], 7
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], edx
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov byte [ebp - 4], 0x4a
mov word [eax], cx
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x44], 7
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x48], edx
cmovae eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x68
mov word [eax], cx
mov byte [ebp - 4], 0x69
cmp byte [edi + 0x371], cl
je 0x42a14d
mov esi, dword [ebp - 0x104]
lea ecx, [ebp - 0x70]
push esi
call fcn.0041bcf1
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00481dd8
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x6b
call fcn.0041de91
push 0
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x6c
call fcn.0041746a
push 0
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x71
call fcn.0041746a
push dword [ebp - 0x108]
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x69
call fcn.0041bcf1
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00481e91
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x77
call fcn.0041de91
push 0
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x78
call fcn.0041746a
push 0
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x7d
call fcn.0041746a
mov byte [ebp - 4], 0x82
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, edi
push 1
cmovae eax, dword [ebp - 0x28]
push eax
push esi
mov byte [ebp - 4], 0x69
call fcn.004299a5
mov esi, eax
test esi, esi
je 0x42a111
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x85
call fcn.0041746a
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x8a
call fcn.0041746a
jmp 0x42a385
lea eax, [ebp - 0x58]
push 0
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
call fcn.00481c2a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x8f
call fcn.0041de91
push 0
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x90
call fcn.0041746a
mov byte [ebp - 4], 0x69
jmp 0x42a168
push dword [ebp - 0x104]
call fcn.004169f0
pop ecx
push eax
push dword [ebp - 0x104]
lea ecx, [ebp - 0x28]
call fcn.0041c91b
mov eax, ebx
sub eax, 0x10
je 0x42a189
sub eax, 0x10
je 0x42a189
sub eax, 0x20
je 0x42a189
sub eax, 0x40
je 0x42a189
sub eax, 0x180
jne 0x42a2a3
push dword [ebp - 0x104]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a1dd
cmp byte [ebp + 0x1c], 0
jne 0x42a1dd
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42a1dd
push dword [ebp - 0x104]
lea eax, [ebp - 0x100]
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str.File_Delete_Failed__s
push 0xc67
push 0x200
push eax
call fcn.0042077f
add esp, 0x18
mov esi, 0x80004005
cmp esi, 0x80004005
je 0x42a2a3
mov ecx, edi
call fcn.0042c81e
cmp ebx, 0x10
jne 0x42a25d
mov ecx, dword [0x12fa704]
push 0x2df
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x42a25d
mov ecx, dword [0x12fa704]
push 0x2d8
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x42a25d
mov ecx, dword [0x12fa704]
push 0x2dc
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x42a25d
push dword [ebp + 0x1c]
mov byte [ebp - 4], 0x95
lea eax, [ebp - 0x28]
push dword [ebp + 0x18]
cmp dword [ebp - 0x14], 8
mov ecx, edi
push dword [ebp + 0x14]
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x108]
mov byte [ebp - 4], 0x69
push eax
call fcn.0042a3b2
jmp 0x42a299
mov byte [ebp - 4], 0x98
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0x2df
cmovae esi, dword [ebp - 0x28]
mov byte [ebp - 4], 0x69
mov ecx, dword [0x12fa704]
mov eax, dword [ecx]
call dword [eax + 8]
push eax
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp - 0x108]
push esi
call fcn.0042a509
push ecx
mov ecx, edi
mov esi, eax
call fcn.0042c8ce
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
je 0x42a2b5
cmp byte [ebp + 0x1c], 0
jne 0x42a365
cmp byte [edi + 0x371], 0
je 0x42a365
test esi, esi
jne 0x42a365
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae ecx, dword [ebp - 0x40]
mov byte [ebp - 4], 0x9e
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x69
call fcn.004299a5
mov esi, eax
test esi, esi
jne 0x42a34b
mov ebx, dword [ebp - 0x104]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa1
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
mov byte [ebp - 4], 0x69
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x42a34b
push ebx
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str.File_Copy_Failed__s
push 0xc83
lea eax, [ebp - 0x100]
push 0x200
push eax
call fcn.0042077f
add esp, 0x18
mov esi, 0x80004005
mov byte [ebp - 4], 0xa4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x69
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa7
call fcn.0041746a
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xac
call fcn.0041746a
mov byte [ebp - 4], 0x1e
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb1
call fcn.0041746a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.004204d2
mov eax, esi
call fcn.005bea19
ret 0x18