Function at 0x40d3c0
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42fe2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c0
push ebp
push esi
push edi
push 0x440e2c
lea ecx, [esp + 0x14]
mov dword [esp + 0x4d8], 0
mov edi, 1
xor esi, esi
call fcn.004266b1
push edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4d8], 1
call fcn.00423272
push edi
lea ecx, [esp + 0x78]
mov byte [esp + 0x4d8], 2
call fcn.00423378
mov eax, dword [0x434b40]
mov ecx, dword [esp + 0x4dc]
push eax
push 0x21
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x4e0], 3
call fcn.00423336
lea edx, [esp + 0xc]
push edx
call fcn.0040e910
add esp, 4
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4d8], 4
call fcn.00426730
lea ecx, [esp + 0xc]
mov byte [esp + 0x4d4], 3
call fcn.00426643
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.004263b8
lea ecx, [esp + 0x10]
push ecx
call fcn.0040e0f0
push eax
mov byte [esp + 0x4e0], 5
call fcn.0040eaf0
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x4d4], 3
call fcn.00426643
mov edx, dword [0x434b40]
mov eax, dword [esp + 0x10]
push edx
push 2
push eax
lea ecx, [esp + 0x80]
call fcn.0042343c
mov ecx, dword [esp + 0x18]
or ebp, 0xffffffff
mov eax, dword [ecx + 4]
mov ecx, dword [esp + eax + 0x1c]
cmp dword [ecx + 0x4c], ebp
je 0x40d64b
mov edx, dword [esp + 0x74]
mov ecx, dword [edx + 4]
mov ecx, dword [esp + ecx + 0x78]
cmp dword [ecx + 0x4c], ebp
je 0x40d64b
test byte [esp + eax + 0x20], 1
jne 0x40d61f
mov ebp, dword [esp + 0x4e0]
call fcn.0040f1d0
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov ecx, dword [esp + eax + 0x4c]
lea eax, [esp + eax + 0x18]
test ecx, ecx
jge 0x40d52b
add eax, 0x38
push eax
call fcn.004234c7
add esp, 4
mov ecx, dword [esp + 0x1c]
push 0xa
inc ecx
push 0x3ff
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x24]
call fcn.004234dd
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov ecx, dword [esp + eax + 0x4c]
lea eax, [esp + eax + 0x18]
test ecx, ecx
jge 0x40d56b
add eax, 0x38
push eax
call fcn.004234d2
add esp, 4
lea ecx, [esp + 0xcc]
push ecx
lea ecx, [esp + 0x10]
call fcn.004266b1
lea edx, [esp + 0xc]
mov byte [esp + 0x4d4], 6
push edx
call fcn.0040ce80
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x4d4], 3
call fcn.00426643
test esi, esi
je 0x40d5e0
push 0
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
push ecx
lea eax, [esp + 0xd8]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004266b1
push esi
call fcn.0040cb30
add esp, 8
push ebp
call fcn.0040ff50
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
test edi, edi
je 0x40d60a
lea edx, [esp + 0xcc]
lea ecx, [esp + 0x74]
push edx
call fcn.0042373e
push 0x40ca10
push 0xa
mov ecx, eax
call fcn.0042359e
mov ecx, eax
call fcn.0040c9f0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
test byte [esp + ecx + 0x20], 1
je 0x40d507
or ebp, 0xffffffff
lea ecx, [esp + 0x74]
call fcn.0042347e
lea ecx, [esp + 0x18]
call fcn.0042347e
mov edx, dword [esp + 0x4dc]
mov eax, dword [esp + 0x10]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x7c]
mov byte [esp + 0x4d4], 2
call fcn.00423429
lea ecx, [esp + 0x7c]
call fcn.004231f9
lea ecx, [esp + 0x24]
mov byte [esp + 0x4d4], 1
call fcn.00423323
lea ecx, [esp + 0x24]
call fcn.004231f9
lea ecx, [esp + 0x10]
mov byte [esp + 0x4d4], 0
call fcn.00426643
lea ecx, [esp + 0x4dc]
mov dword [esp + 0x4d4], ebp
call fcn.00426643
mov ecx, dword [esp + 0x4cc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x4cc
ret