Function at 0x4360a0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e27a6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2e2c
call fcn.004ad6f0
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2dc0], ecx
mov dword [ebp - 0x14], 0
mov ax, word [0x4f62f0]
mov word [ebp - 0xfb8], ax
push 0x206
push 0
lea ecx, [ebp - 0xfb6]
push ecx
call fcn.004ad2c0
add esp, 0xc
mov dx, word [0x4f62f4]
mov word [ebp - 0x790], dx
push 0x206
push 0
lea eax, [ebp - 0x78e]
push eax
call fcn.004ad2c0
add esp, 0xc
mov cx, word [0x4f62f8]
mov word [ebp - 0xdb0], cx
push 0x206
push 0
lea edx, [ebp - 0xdae]
push edx
call fcn.004ad2c0
add esp, 0xc
mov ax, word [0x4f62fc]
mov word [ebp - 0x588], ax
push 0x206
push 0
lea ecx, [ebp - 0x586]
push ecx
call fcn.004ad2c0
add esp, 0xc
mov dx, word [0x4f6300]
mov word [ebp - 0xba8], dx
push 0x206
push 0
lea eax, [ebp - 0xba6]
push eax
call fcn.004ad2c0
add esp, 0xc
mov cx, word [0x4f6304]
mov word [ebp - 0x9a0], cx
push 0x206
push 0
lea edx, [ebp - 0x99e]
push edx
call fcn.004ad2c0
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x794], 0
push 0x368
push 0
lea ecx, [ebp - 0x380]
push ecx
call fcn.004ad2c0
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x4361f1
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10cc], 0
lea ecx, [ebp - 0x10cc]
push ecx
mov dl, byte [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x2dc0]
call fcn.00436ad0
mov dword [ebp - 0x2dc4], eax
mov eax, dword [ebp - 0x2dc4]
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0xfc4], 0
je 0x436250
mov ecx, dword [ebp - 0xfc4]
mov dword [ebp - 0x10e4], ecx
push 0x510634
lea edx, [ebp - 0x10e4]
push edx
call fcn.004ad33a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.004546e0
mov dword [ebp - 0x2dc8], eax
cmp dword [ebp - 0x2dc8], 0
jne 0x436288
mov dword [ebp - 0x10e8], 0x33
push 0x510634
lea eax, [ebp - 0x10e8]
push eax
call fcn.004ad33a
mov ecx, dword [ebp - 0x2dc0]
call fcn.00435950
mov byte [ebp - 0x2dc9], al
movzx ecx, byte [ebp - 0x2dc9]
test ecx, ecx
jne 0x4362bf
mov dword [ebp - 0x10ec], 0x31
push 0x510634
lea edx, [ebp - 0x10ec]
push edx
call fcn.004ad33a
mov ax, word [0x4f6308]
mov word [ebp - 0x10c8], ax
push 0xfe
push 0
lea ecx, [ebp - 0x10c6]
push ecx
call fcn.004ad2c0
add esp, 0xc
lea ecx, [ebp - 0xfc0]
call fcn.00437730
lea edx, [ebp - 0x10f4]
push edx
mov ecx, dword [ebp - 0x2dc0]
add ecx, 0x10
call fcn.00437420
mov dword [ebp - 0x2dd0], eax
mov eax, dword [ebp - 0x2dd0]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0xfc0], ecx
mov dword [ebp - 0xfbc], edx
jmp 0x43632c
lea ecx, [ebp - 0xfc0]
call fcn.00437770
lea eax, [ebp - 0x10fc]
push eax
mov ecx, dword [ebp - 0x2dc0]
add ecx, 0x10
call fcn.00437450
mov dword [ebp - 0x2dd4], eax
mov ecx, dword [ebp - 0x2dd4]
push ecx
lea ecx, [ebp - 0xfc0]
call fcn.004377d0
mov byte [ebp - 0x2dd5], al
movzx edx, byte [ebp - 0x2dd5]
test edx, edx
je 0x4369b2
push 0x100
push 0
lea eax, [ebp - 0x10c8]
push eax
call fcn.004ad2c0
add esp, 0xc
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2ddc], eax
push 0x100
lea ecx, [ebp - 0x10c8]
push ecx
mov edx, dword [ebp - 0x2ddc]
add edx, 0x1c
push edx
call fcn.004351a0
add esp, 0xc
mov dword [ebp - 0x2de0], eax
cmp dword [ebp - 0x2de0], 0
je 0x436407
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2de4], eax
lea eax, [ebp - 0x10c8]
push eax
call fcn.004ade29
add esp, 4
push eax
lea ecx, [ebp - 0x10c8]
push ecx
mov edx, dword [ebp - 0x2de4]
add edx, 0x634
push edx
call fcn.004b4001
add esp, 0xc
test eax, eax
je 0x4369ad
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2de8], eax
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2dec], eax
mov eax, dword [ebp - 0x2de8]
add eax, 0x224
push eax
mov ecx, dword [ebp - 0x2dec]
add ecx, 0x1c
push ecx
mov ecx, dword [ebp - 0x2dc0]
call fcn.00436f60
mov byte [ebp - 0x2ded], al
mov dl, byte [ebp - 0x2ded]
mov byte [ebp - 0x10d1], dl
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x436476
movzx ecx, byte [ebp - 0x10d1]
test ecx, ecx
jne 0x436474
jmp 0x436321
jmp 0x436487
movzx edx, byte [ebp - 0x10d1]
cmp edx, 1
jne 0x436487
jmp 0x436321
push 0x208
push 0
lea eax, [ebp - 0xfb8]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x790]
push ecx
call fcn.004ad2c0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xdb0]
push edx
call fcn.004ad2c0
add esp, 0xc
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2df4], eax
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0xdb0]
push eax
push 0x104
lea ecx, [ebp - 0x790]
push ecx
mov edx, dword [ebp - 0x2df4]
add edx, 0x224
push edx
call fcn.004b1a89
add esp, 0x24
lea eax, [ebp - 0xdb0]
push eax
lea ecx, [ebp - 0x790]
push ecx
push 0x4f630c
push 0x104
lea edx, [ebp - 0xfb8]
push edx
call fcn.00401cd0
add esp, 0x14
push 0x208
push 0
lea eax, [ebp - 0x588]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xba8]
push ecx
call fcn.004ad2c0
add esp, 0xc
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2df8], eax
push 0x104
lea edx, [ebp - 0xba8]
push edx
push 0x104
lea eax, [ebp - 0x588]
push eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2df8]
add ecx, 0x1c
push ecx
call fcn.004b1a89
add esp, 0x24
lea edx, [ebp - 0xba8]
push edx
lea eax, [ebp - 0x588]
push eax
push 0x4f6318
push 0x104
lea ecx, [ebp - 0x588]
push ecx
call fcn.00401cd0
add esp, 0x14
push 0x208
push 0
lea edx, [ebp - 0x9a0]
push edx
call fcn.004ad2c0
add esp, 0xc
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0xfb8]
push ecx
push 0x4f6324
push 0x104
lea edx, [ebp - 0x9a0]
push edx
call fcn.00401cd0
add esp, 0x14
mov dword [ebp - 0x10d8], 0
mov dword [ebp - 0x10d0], 0
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2dfc], eax
push 0x4f6330
call fcn.004ade29
add esp, 4
push eax
push 0x4f6334
mov eax, dword [ebp - 0x2dfc]
add eax, 0x83c
push eax
call fcn.004b4001
add esp, 0xc
test eax, eax
jne 0x43668e
call fcn.00454c50
mov dword [ebp - 0x2e00], eax
cmp dword [ebp - 0x2e00], 0
je 0x43668e
lea ecx, [ebp - 0x10d0]
push ecx
call fcn.00454da0
add esp, 4
mov dword [ebp - 0x2e04], eax
mov edx, dword [ebp - 0x2e04]
mov dword [ebp - 0x10d8], edx
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e08], eax
push 1
push 0x4f6338
lea eax, [ebp - 0xfb8]
push eax
mov ecx, dword [ebp - 0x2e08]
add ecx, 0x224
push ecx
call fcn.00454700
mov byte [ebp - 0x2e09], al
movzx edx, byte [ebp - 0x2e09]
test edx, edx
jne 0x436703
cmp dword [ebp - 0x10d8], 0
je 0x4366e8
lea eax, [ebp - 0x10d0]
push eax
call fcn.00454e10
add esp, 4
mov dword [ebp - 0x1100], 0x14
push 0x510634
lea ecx, [ebp - 0x1100]
push ecx
call fcn.004ad33a
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e10], eax
push 0
mov edx, dword [ebp - 0x2e10]
add edx, 0x1c
push edx
lea eax, [ebp - 0x9a0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43678d
cmp dword [ebp - 0x10d8], 0
je 0x436749
lea ecx, [ebp - 0x10d0]
push ecx
call fcn.00454e10
add esp, 4
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e14], eax
mov edx, dword [ebp - 0x2e14]
add edx, 0x1c
push edx
push 0x104
mov eax, dword [ebp + 0x14]
push eax
call fcn.00405230
mov dword [ebp - 0x1104], 0x34
push 0x510634
lea ecx, [ebp - 0x1104]
push ecx
call fcn.004ad33a
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e18], eax
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e1c], eax
mov edx, dword [ebp - 0x2e18]
add edx, 0x1c
push edx
mov eax, dword [ebp - 0x2e1c]
push eax
lea ecx, [ebp - 0x2dac]
call fcn.00437800
mov dword [ebp - 0x2e20], eax
mov ecx, dword [ebp - 0x2e20]
mov dword [ebp - 0x2e24], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2e24]
push edx
lea ecx, [ebp - 0x1f58]
call fcn.00439730
mov dword [ebp - 0x2e28], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1f58]
push eax
lea ecx, [ebp - 0x2db8]
push ecx
mov ecx, dword [ebp - 0x2dc0]
add ecx, 4
call fcn.00437480
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1f58]
call fcn.004372e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2dac]
call fcn.004372c0
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e2c], eax
push str.0011
call fcn.004ade29
add esp, 4
push eax
push 0x4f634c
mov edx, dword [ebp - 0x2e2c]
add edx, 0x42c
push edx
call fcn.004b4001
add esp, 0xc
test eax, eax
je 0x43689e
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e30], eax
mov eax, dword [ebp - 0x2e30]
add eax, 0x42c
push eax
call fcn.004b2149
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x9a0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4368e2
cmp dword [ebp - 0x10d8], 0
je 0x4368c7
lea eax, [ebp - 0x10d0]
push eax
call fcn.00454e10
add esp, 4
mov dword [ebp - 0x2dbc], 0x35
push 0x510634
lea ecx, [ebp - 0x2dbc]
push ecx
call fcn.004ad33a
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e34], eax
push 0x4f6350
call fcn.004ade29
add esp, 4
push eax
push 0x4f6354
mov edx, dword [ebp - 0x2e34]
add edx, 0x83c
push edx
call fcn.004b4001
add esp, 0xc
test eax, eax
jne 0x436942
call fcn.00454c50
mov dword [ebp - 0x2e38], eax
cmp dword [ebp - 0x2e38], 0
je 0x436942
lea eax, [ebp - 0x10d0]
push eax
call fcn.00454e10
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x4369ad
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4369ad
mov edx, dword [ebp - 0x794]
add edx, 1
mov dword [ebp - 0x794], edx
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x10cc]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xfc0]
call fcn.00437750
mov dword [ebp - 0x2e3c], eax
mov edx, dword [ebp - 0x2e3c]
add edx, 0x1c
push edx
push 0x104
lea eax, [ebp - 0x240]
push eax
call fcn.00405230
lea ecx, [ebp - 0x380]
push ecx
push 0xd
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
call eax
jmp 0x436321
jmp 0x4369eb
mov dword [ebp - 4], 0xffffffff
call fcn.004546f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret 0x10