Function at 0x402491
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push 0x7b8
mov eax, 0x408bf2
call fcn.00408900
mov ebx, ecx
mov dword [ebp - 0x7c4], ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x62c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
cmp ebx, 1
je 0x4024e8
cmp ebx, 2
je 0x4024e8
xor eax, eax
jmp 0x4024eb
xor eax, eax
inc eax
test eax, eax
mov ecx, str.http:__acroipm2.adobe.com_assets_AWBM_
mov ebx, str.http:__acroipm2.adobe.com_assets_AWBM_R_
mov edx, str.S1.txt
cmove ebx, ecx
mov ecx, ebx
call fcn.00402407
lea ecx, [ebp - 0x62c]
call fcn.00402e81
lea ecx, [ebp - 0x218]
call fcn.00401e21
test al, al
je 0x402a8b
lea ecx, [ebp - 0x218]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x40252f
sub ecx, edx
sar ecx, 1
je 0x402a8b
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x218]
push str.GoogleChromeUser_Data_
mov edi, 0x104
push edi
push eax
call esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call esi
push str.Bookmarks
lea eax, [ebp - 0x218]
push edi
push eax
call esi
xor eax, eax
push 0xb8
push eax
lea eax, [ebp - 0x7b8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x2c
lea ecx, [ebp - 0x7b8]
call fcn.0040444f
xor eax, eax
push ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x7b8]
call fcn.004043ad
cmp dword [ebp - 0x75c], 0
je 0x402a66
mov eax, dword [ebp - 0x7b8]
xor ecx, ecx
mov word [ebp - 0x630], 1
push dword [ebp - 0x630]
mov byte [ebp - 0x7bb], cl
mov eax, dword [eax + 4]
push ecx
mov eax, dword [ebp + eax - 0x780]
test eax, eax
sete byte [ebp - 0x7bc]
push dword [ebp - 0x7bc]
push eax
push ecx
lea ecx, [ebp - 0x66c]
call fcn.00404f87
xor eax, eax
mov byte [ebp - 4], 1
push 0x30
push eax
lea eax, [ebp - 0x700]
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x700]
call fcn.00403a3a
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x65c]
add eax, 2
push eax
call fcn.00407e3d
mov ecx, dword [ebp - 0x65c]
mov esi, eax
add ecx, 2
xor eax, eax
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x658], 0xf
lea ecx, [ebp - 0x66c]
push dword [ebp - 0x65c]
cmova ecx, dword [ebp - 0x66c]
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [ebp - 0x638], esi
add esp, 0x1c
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x630], esi
lea ecx, [ebp - 0x700]
push eax
call fcn.00405a9f
xor esi, esi
cmp dword [eax + 0x28], esi
jne 0x402a42
mov esi, str.roots
lea ecx, [ebp - 0x700]
push esi
call fcn.0040485a
test eax, eax
je 0x402a42
push esi
lea ecx, [ebp - 0x700]
call fcn.00403ace
mov esi, eax
mov edi, str.bookmark_bar
push edi
mov ecx, esi
call fcn.0040485a
test eax, eax
je 0x402a3b
push edi
mov ecx, esi
call fcn.00403ace
mov esi, eax
mov edi, str.children
push edi
mov ecx, esi
call fcn.0040485a
test eax, eax
je 0x402a34
push edi
mov ecx, esi
call fcn.00403ace
mov dword [ebp - 0x630], eax
cmp dword [eax + 0xc], 4
jne 0x402a34
xor ecx, ecx
cmp dword [eax + 4], ecx
jbe 0x402a34
push 0x30
push ecx
lea eax, [ebp - 0x69c]
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x69c]
call fcn.00403a3a
xor eax, eax
lea edi, [ebp - 0x69c]
push 3
pop ecx
mov dword [ebp - 0x690], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x648], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x654]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x654]
push dword [ebp - 0x68c]
push str.13346689990798272
push str.date_added
call fcn.00405008
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x409c30
push str.date_last_used
call fcn.00405008
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.d4d3e7d2_cdf9_4163_bb68_73a465fc09dc
push str.guid
call fcn.00405008
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x409c80
push 0x409c84
call fcn.00405008
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.Adobe_Acrobat
push str.name
call fcn.00405008
push dword [ebp - 0x68c]
mov edi, 0x409ca0
lea ecx, [ebp - 0x654]
push edi
push str.type
call fcn.00405008
mov esi, dword [ebp - 0x7c4]
cmp esi, 1
je 0x40281d
cmp esi, 2
jne 0x402834
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationReader
push edi
call fcn.00405008
cmp esi, 4
je 0x40283e
cmp esi, 3
jne 0x402855
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationAcrobat
push edi
call fcn.00405008
push dword [ebp - 0x68c]
mov ecx, dword [ebp - 0x630]
lea eax, [ebp - 0x654]
push eax
call fcn.00403a71
lea ecx, [ebp - 0x7b8]
call fcn.0040435c
xor eax, eax
push 0x20c
push eax
lea eax, [ebp - 0x424]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov esi, 0x104
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x402a27
push str.temp_awbm_copy.txt
lea eax, [ebp - 0x424]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x409d8c
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0x18
cmp dword [ebp - 0x7bc], 0
je 0x402a27
xorps xmm0, xmm0
xor eax, eax
add esi, 0xfffffffc
mov dword [ebp - 0x634], eax
push 1
movups xmmword [ebp - 0x644], xmm0
mov dword [ebp - 0x630], esi
call fcn.00407bae
push dword [ebp - 0x630]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x630]
add ecx, eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 5
lea edi, [ebp - 0x6d0]
push 7
mov dword [ebp - 0x638], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x644]
push ecx
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6d0], eax
call fcn.004047f1
lea eax, [ebp - 0x6d0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x700]
call fcn.004050b9
push ecx
lea ecx, [ebp - 0x644]
call fcn.00404f3f
xor ecx, ecx
mov byte [eax], cl
lea ecx, [ebp - 0x6b4]
push dword [ebp - 0x63c]
dec dword [ebp - 0x638]
call fcn.00404622
push dword [ebp - 0x7bc]
cmp dword [ebp - 0x6a0], 0xf
lea eax, [ebp - 0x6b4]
push 1
push dword [ebp - 0x6a4]
cmova eax, dword [ebp - 0x6b4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x7bc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
xor eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, str.S7.txt
mov ecx, ebx
call fcn.00402407
lea ecx, [ebp - 0x6b4]
call fcn.004045ff
lea ecx, [ebp - 0x6cc]
call fcn.00403a1f
lea ecx, [ebp - 0x644]
call fcn.004044ce
lea ecx, [ebp - 0x68c]
call fcn.00403a1f
jmp 0x402a4e
mov edx, str.S6.txt
jmp 0x402a47
mov edx, str.S5.txt
jmp 0x402a47
mov edx, str.S4.txt
mov ecx, ebx
call fcn.00402407
lea ecx, [ebp - 0x6f0]
call fcn.00403a1f
lea ecx, [ebp - 0x66c]
call fcn.004045ff
jmp 0x402a72
mov edx, str.S3.txt
mov ecx, ebx
call fcn.00402407
lea ecx, [ebp - 0x748]
call fcn.0040437d
lea ecx, [ebp - 0x748]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x402aa6
mov edx, 0x409458
mov ecx, str.AddEntryToChromeBookmark::_FAILED_to_get_local_appdata_folder_path
call fcn.004016a9
mov edx, str.S2.txt
mov ecx, ebx
call fcn.00402407
call fcn.004088be
ret