Function at 0x427c7c
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file

Disassembly:
push 0xfc
mov eax, 0x616e9f
call fcn.005b83bf
mov esi, ecx
mov dword [ebp - 0x104], esi
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x100]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0
push 0
push 0xc2d
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push 0x1299318
push dword [0x12992f8]
mov dword [ebp - 0x108], eax
call fcn.0041f881
mov eax, dword [ebp + 0x1c]
lea ecx, [esi + 4]
and dword [ebp - 4], 0
push ebx
movzx eax, al
push eax
push dword [ebp + 0x18]
mov eax, dword [ecx]
push dword [ebp + 0x14]
push edi
call dword [eax + 0x104]
push eax
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str._s_FileFormat_s_CurrentPage_d_TotalPages_d_ToMultiPageFile_d_FileName_s
push 0xc30
lea eax, [ebp - 0x100]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x28
mov esi, 0x80004001
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 7
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
mov byte [ebp - 4], 0x1d
mov word [eax], cx
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x1e
call fcn.0041b35f
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0047b84f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x20
call fcn.0041d4ea
push 0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x70]
push 1
call fcn.00416b1a
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x26
call fcn.00416b1a
mov byte [ebp - 4], 0x1e
cmp edi, 0x20
jg 0x427e36
je 0x427e4d
test edi, edi
jle 0x428214
cmp edi, 2
jle 0x427dc4
cmp edi, 4
je 0x427dc4
cmp edi, 8
je 0x427dc4
cmp edi, 0x10
je 0x427e4d
jmp 0x428214
mov ecx, dword [ebp - 0x104]
cmp byte [ecx + 0x2a1], 0
je 0x427df8
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0
cmovae eax, dword [ebp - 0x40]
push eax
push dword [ebp - 0x108]
mov byte [ebp - 4], 0x1e
call fcn.0042784f
mov esi, eax
jmp 0x427dfa
xor esi, esi
test esi, esi
jne 0x428214
call fcn.00429ba5
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x104]
push dword [ebp + 0x14]
push edi
mov ecx, dword [eax + 0x204]
push dword [ebp - 0x108]
push ebx
mov eax, dword [ecx]
call dword [eax + 0xc0]
push ecx
mov esi, eax
call fcn.00429bf5
jmp 0x428214
mov eax, edi
sub eax, 0x40
je 0x427e4d
sub eax, 0x40
je 0x427e4d
sub eax, 0x180
jne 0x428214
xor edx, edx
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x14], 7
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], edx
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov byte [ebp - 4], 0x4a
mov word [eax], cx
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x44], 7
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x48], edx
cmovae eax, dword [ebp - 0x58]
mov byte [ebp - 4], 0x68
mov word [eax], cx
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 0x69
push ebx
cmp byte [eax + 0x2a1], cl
je 0x427ff1
lea ecx, [ebp - 0x70]
call fcn.0041b35f
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0047b798
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x6b
call fcn.0041d4ea
xor esi, esi
mov byte [ebp - 4], 0x6c
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.00416b1a
push esi
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x71
call fcn.00416b1a
push dword [ebp - 0x108]
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x69
call fcn.0041b35f
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0047b84f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x77
call fcn.0041d4ea
push esi
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x78
call fcn.00416b1a
push esi
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x7d
call fcn.00416b1a
mov byte [ebp - 4], 0x82
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x104]
push 1
push eax
push ebx
mov byte [ebp - 4], 0x69
call fcn.0042784f
mov esi, eax
test esi, esi
je 0x427fb5
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x85
call fcn.00416b1a
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x8a
call fcn.00416b1a
jmp 0x428210
lea eax, [ebp - 0x58]
push 0
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
call fcn.0047b5ea
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x8f
call fcn.0041d4ea
push 0
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x90
call fcn.00416b1a
mov byte [ebp - 4], 0x69
jmp 0x428001
call fcn.004160c0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0041bf96
mov eax, edi
sub eax, 0x10
je 0x428022
sub eax, 0x10
je 0x428022
sub eax, 0x20
je 0x428022
sub eax, 0x40
je 0x428022
sub eax, 0x180
jne 0x428131
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428067
cmp byte [ebp + 0x1c], 0
jne 0x428067
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x428067
push ebx
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str.File_Delete_Failed__s
push 0xc67
lea eax, [ebp - 0x100]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x18
mov esi, 0x80004005
cmp esi, 0x80004005
je 0x428131
call fcn.00429ba5
cmp edi, 0x10
jne 0x4280e9
mov ecx, dword [0x1298dd0]
push 0x2df
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x4280e9
mov ecx, dword [0x1298dd0]
push 0x2d8
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x4280e9
mov ecx, dword [0x1298dd0]
push 0x2dc
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x4280e9
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x104]
lea eax, [ebp - 0x28]
push dword [ebp + 0x18]
mov byte [ebp - 4], 0x95
push dword [ebp + 0x14]
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x108]
cmovae eax, dword [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x69
call fcn.0042823d
jmp 0x428129
mov byte [ebp - 4], 0x98
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0x2df
cmovae esi, dword [ebp - 0x28]
mov byte [ebp - 4], 0x69
mov ecx, dword [0x1298dd0]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 0x104]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp - 0x108]
push esi
call fcn.00428394
push ecx
mov esi, eax
call fcn.00429bf5
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
je 0x428143
cmp byte [ebp + 0x1c], 0
jne 0x4281f0
mov ecx, dword [ebp - 0x104]
cmp byte [ecx + 0x2a1], 0
je 0x4281f0
test esi, esi
jne 0x4281f0
push 8
mov byte [ebp - 4], 0x9b
lea edx, [ebp - 0x40]
pop edi
cmp dword [ebp - 0x2c], edi
cmovae edx, dword [ebp - 0x40]
mov byte [ebp - 4], 0x9e
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
push esi
cmovae eax, dword [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 0x69
call fcn.0042784f
mov esi, eax
test esi, esi
jne 0x4281d7
mov byte [ebp - 4], 0xa1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
push esi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
mov byte [ebp - 4], 0x69
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4281d7
push ebx
push str.HPXS::CScanAppBusinessLogic::SaveToFile
push str.File_Copy_Failed__s
push 0xc83
lea eax, [ebp - 0x100]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x18
mov esi, 0x80004005
mov byte [ebp - 4], 0xa4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x69
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa7
call fcn.00416b1a
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xac
call fcn.00416b1a
mov byte [ebp - 4], 0x1e
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb1
call fcn.00416b1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.0041f95a
mov eax, esi
call fcn.005b8369
ret 0x18