Function at 0x4211d0
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44cfa8
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x16c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x17c]
lea ebp, [eax + 0x2c0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
test eax, 0xffffffc0
jne 0x42136d
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebx, [esp + 0x148]
mov dword [esp + 0x50], esp
cmp eax, 0x10
jb 0x421263
mov ecx, dword [edi]
jmp 0x421265
mov ecx, edi
cmp ecx, 0x45582c
ja 0x4212a0
cmp eax, 0x10
jb 0x421276
mov ecx, dword [edi]
jmp 0x421278
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45582c
jbe 0x4212a0
cmp eax, 0x10
jb 0x42128c
mov edi, dword [edi]
push 0x38
mov eax, 0x45582c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x4212e4
cmp eax, 0x38
jae 0x4212b2
mov ecx, dword [esi + 0x14]
push ecx
push 0x38
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4212be
mov eax, dword [edi]
jmp 0x4212c0
mov eax, edi
push 0x38
push 0x45582c
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x38
jb 0x4212e0
mov edi, dword [edi]
mov byte [edi + 0x38], 0
lea esi, [esp + 0x7c]
call fcn.004014c0
mov edx, ebx
mov ecx, eax
mov dword [esp + 0x174], ebp
call fcn.00401640
mov esi, pe_nt_image_headers32
mov byte [esp + 0x174], 1
cmp dword [eax + 0x18], esi
jb 0x421314
mov eax, dword [eax + 4]
jmp 0x421317
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0xc
cmp dword [esp + 0x144], esi
jb 0x421340
mov eax, dword [esp + 0x130]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x60]
mov dword [esp + 0x144], 0xf
mov dword [esp + 0x140], ebp
mov byte [esp + 0x130], 0
call fcn.00429620
mov eax, 0x8000000a
jmp 0x421e0a
mov dword [esp + 0x128], 0xf
mov dword [esp + 0x124], 0
mov byte [esp + 0x114], 0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x178], 2
call fcn.0040f9c0
mov byte [esp + 0x174], 3
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x2c]
xor edi, edi
sar edx, 6
mov dword [esp + 0x18], edi
test edx, edx
jbe 0x421425
nop
mov edx, dword [esp + 0x28]
test edx, edx
jne 0x4213cc
xor ecx, ecx
jmp 0x4213d5
mov ecx, dword [esp + 0x30]
sub ecx, edx
sar ecx, 2
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
jae 0x4213eb
mov dword [eax], edi
add eax, 4
mov dword [esp + 0x2c], eax
jmp 0x421413
mov esi, eax
cmp edx, eax
jbe 0x4213f6
call fcn.00437e82
mov eax, dword [esp + 0x1c]
push esi
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x64]
push ecx
lea eax, [esp + 0x2c]
call fcn.0042b3d0
mov eax, dword [esp + 0x2c]
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
inc edi
sar edx, 6
mov dword [esp + 0x18], edi
cmp edi, edx
jb 0x4213c0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
xor edi, edi
sar ecx, 6
test ecx, ecx
jbe 0x42147c
sub eax, dword [esp + 0x28]
sar eax, 2
mov esi, eax
call fcn.00437f69
xor edx, edx
div esi
lea eax, [esp + 0x1c]
mov ebx, edx
call fcn.0042a700
mov esi, eax
mov ebx, edi
lea eax, [esp + 0x1c]
call fcn.0042a700
cmp eax, esi
je 0x42146a
mov edx, dword [esi]
mov ecx, dword [eax]
mov dword [eax], edx
mov dword [esi], ecx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
inc edi
sar eax, 6
cmp edi, eax
mov eax, dword [esp + 0x2c]
jb 0x421434
mov edx, dword [esp + 0x28]
mov ecx, eax
sub ecx, edx
sar ecx, 2
mov dword [esp + 0x18], 0
test ecx, ecx
jbe 0x421a33
jmp 0x4214a0
cmp ecx, dword [esp + 0x18]
jbe 0x421a95
mov esi, edx
cmp edx, eax
jbe 0x4214b5
call fcn.00437e82
mov eax, dword [esp + 0x1c]
mov edi, eax
mov ebx, edi
mov dword [esp + 0x5c], esi
test eax, eax
jne 0x4214e0
call fcn.00437e82
xor eax, eax
mov ecx, dword [esp + 0x18]
lea esi, [esi + ecx*4]
cmp esi, dword [eax + 0x10]
ja 0x4214eb
test edi, edi
je 0x4214e4
mov edi, dword [edi]
jmp 0x4214e6
mov eax, dword [eax]
jmp 0x4214cc
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x4214f0
call fcn.00437e82
test ebx, ebx
jne 0x42156a
call fcn.00437e82
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x421505
call fcn.00437e82
mov ebx, dword [esi]
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
cmp dword [eax + 0x3c], 0
je 0x421a13
mov esi, dword [esp + 0x34]
cmp dword [esi + 0x80], 0
je 0x42156e
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
add eax, 0x1c
cmp dword [eax + 0x14], 0
je 0x421a13
cmp dword [esi + 0x80], 0
je 0x42156e
mov eax, ebx
mov ecx, ebp
mov edi, 1
call fcn.0042a010
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d10
jmp 0x4215d3
mov eax, dword [ebx]
jmp 0x4214fb
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
add eax, 0x1c
cmp dword [eax + 0x14], 0
je 0x4215b7
call fcn.00437f69
and eax, 0x80000001
jns 0x421591
dec eax
or eax, 0xfffffffe
inc eax
mov eax, ebx
mov ecx, ebp
jne 0x4215bb
call fcn.0042a010
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d10
mov edi, 1
jmp 0x4215d3
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00402d10
xor edi, edi
xor eax, eax
mov ecx, 0xf
mov dword [esp + 0x144], ecx
mov dword [esp + 0x140], eax
mov byte [esp + 0x130], al
mov dword [esp + 0x160], ecx
mov dword [esp + 0x15c], eax
mov byte [esp + 0x14c], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x174], 5
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, 0x7e07e07f
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
je 0x421a9a
call fcn.00437f69
xor edx, edx
div esi
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
mov dword [eax], edx
push edx
mov eax, esi
call fcn.0040fa20
push 0xffffffffffffffff
add eax, 0x1c
push 0
push eax
lea ecx, [esp + 0x154]
call fcn.00402d10
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
push edx
mov eax, esi
call fcn.0040fa20
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x138]
call fcn.00402d10
mov eax, dword [esp + 0x124]
test eax, eax
je 0x421753
lea esi, [eax - 1]
cmp eax, esi
ja 0x42169d
call fcn.00436f51
mov eax, dword [esp + 0x124]
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
jae 0x4216b5
lea ecx, [esp + 0x114]
cmp byte [ecx + esi], 0x5c
je 0x421753
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, 1
ja 0x4216d5
call fcn.00436f19
mov eax, dword [esp + 0x124]
lea esi, [eax + 1]
cmp esi, 0xfffffffe
jbe 0x4216e9
call fcn.00436f19
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x128]
cmp ecx, esi
jae 0x42179d
push eax
push esi
lea ecx, [esp + 0x118]
call fcn.00403480
mov eax, dword [esp + 0x124]
test esi, esi
jbe 0x421753
mov ecx, dword [esp + 0x114]
mov edx, pe_nt_image_headers32
cmp dword [esp + 0x128], edx
jae 0x42172d
lea ecx, [esp + 0x114]
mov byte [ecx + eax], 0x5c
mov eax, dword [esp + 0x114]
mov dword [esp + 0x124], esi
cmp dword [esp + 0x128], edx
jae 0x42174f
lea eax, [esp + 0x114]
mov byte [eax + esi], 0
push 0
lea edx, [esp + 0x130]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x118]
call fcn.00405bb0
cmp dword [esp + 0x128], 0x10
mov ecx, dword [esp + 0x114]
jae 0x421784
lea ecx, [esp + 0x114]
mov eax, dword [esp + 0x14]
mov esi, pe_nt_image_headers32
cmp dword [eax + 0x25c], esi
jb 0x4217c4
mov eax, dword [eax + 0x248]
jmp 0x4217c9
test esi, esi
jne 0x42170f
mov eax, dword [esp + 0x114]
mov dword [esp + 0x124], esi
cmp ecx, 0x10
jae 0x4217bf
lea eax, [esp + 0x114]
mov byte [eax], 0
jmp 0x421753
add eax, 0x248
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x421c78
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
inc dword [eax + 0x38]
add eax, 0x38
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
cmp dword [eax + 0x38], 3
jle 0x4219bb
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
cmp dword [eax + 0x18], esi
jb 0x421810
mov eax, dword [eax + 4]
jmp 0x421813
add eax, 4
push eax
lea eax, [esp + 0x40]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x7c], esp
cmp eax, 0x10
jb 0x421842
mov ecx, dword [edi]
jmp 0x421844
mov ecx, edi
cmp ecx, 0x4558a8
ja 0x42187f
cmp eax, 0x10
jb 0x421855
mov ecx, dword [edi]
jmp 0x421857
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4558a8
jbe 0x42187f
cmp eax, 0x10
jb 0x42186b
mov edi, dword [edi]
push 0x3f
mov eax, 0x4558a8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x4218c3
cmp eax, 0x3f
jae 0x421891
mov ecx, dword [esi + 0x14]
push ecx
push 0x3f
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42189d
mov eax, dword [edi]
jmp 0x42189f
mov eax, edi
push 0x3f
push 0x4558a8
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3f
jb 0x4218bf
mov edi, dword [edi]
mov byte [edi + 0x3f], 0
lea esi, [esp + 0x84]
call fcn.004014c0
mov byte [esp + 0x17c], 8
call fcn.00401580
mov edi, pe_nt_image_headers32
mov byte [esp + 0x178], 9
cmp dword [eax + 0x18], edi
jb 0x4218f3
mov eax, dword [eax + 4]
jmp 0x4218f6
add eax, 4
mov edx, dword [esp + 0x18]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
cmp dword [esp + 0x54], edi
jb 0x421919
mov eax, dword [esp + 0x40]
push eax
call fcn.00437f8b
add esp, 4
xor esi, esi
mov byte [esp + 0x174], 5
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], esi
mov byte [esp + 0x40], 0
cmp dword [esp + 0xb0], edi
jb 0x42194d
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], esi
mov byte [esp + 0x9c], 0
cmp dword [esp + 0x94], edi
jb 0x421980
mov edx, dword [esp + 0x80]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], esi
mov byte [esp + 0x80], 0
cmp dword [esp + 0x78], edi
jb 0x4219ad
mov eax, dword [esp + 0x64]
push eax
call fcn.00437f8b
add esp, 4
mov eax, ebx
mov ecx, ebp
call fcn.0042a010
mov dword [eax + 0x3c], esi
mov esi, edi
cmp dword [esp + 0x160], esi
jb 0x4219d4
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.00437f8b
add esp, 4
mov byte [esp + 0x174], 3
mov dword [esp + 0x160], 0xf
mov dword [esp + 0x15c], 0
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], esi
jb 0x421a13
mov edx, dword [esp + 0x130]
push edx
call fcn.00437f8b
add esp, 4
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov ecx, eax
sub ecx, edx
inc esi
sar ecx, 2
mov dword [esp + 0x18], esi
cmp esi, ecx
jb 0x4214a0
lea ecx, [esp + 0x3c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x78], esp
push 0x2a
mov ebx, 0xf
xor edi, edi
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], edi
push 0x4558e8
mov byte [ecx + 4], 0
call fcn.00403090
lea esi, [esp + 0xd8]
call fcn.004014c0
mov byte [esp + 0x178], 0xa
call fcn.00401580
mov ebp, pe_nt_image_headers32
mov byte [esp + 0x174], 0xb
cmp dword [eax + 0x18], ebp
jb 0x421d83
mov eax, dword [eax + 4]
jmp 0x421d86
call fcn.0042b250
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, pe_nt_image_headers32
lea ebx, [esp + 0x58]
mov dword [esp + 0x74], esp
cmp eax, ebp
jb 0x421acb
mov ecx, dword [edi]
jmp 0x421acd
mov ecx, edi
cmp ecx, 0x455868
ja 0x421b06
cmp eax, ebp
jb 0x421add
mov ecx, dword [edi]
jmp 0x421adf
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455868
jbe 0x421b06
cmp eax, ebp
jb 0x421af2
mov edi, dword [edi]
push 0x3a
mov eax, 0x455868
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x421b48
cmp eax, 0x3a
jae 0x421b18
mov ecx, dword [esi + 0x14]
push ecx
push 0x3a
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x421b23
mov eax, dword [edi]
jmp 0x421b25
mov eax, edi
push 0x3a
push 0x455868
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x3a
cmp dword [esi + 0x18], ebp
jb 0x421b44
mov edi, dword [edi]
mov byte [edi + 0x3a], 0
lea esi, [esp + 0x7c]
call fcn.004014c0
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x174], 6
call fcn.00401a50
mov byte [esp + 0x174], 7
cmp dword [eax + 0x18], ebp
jb 0x421b74
mov eax, dword [eax + 4]
jmp 0x421b77
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0xc
cmp dword [esp + 0x54], ebp
jb 0x421b9a
mov eax, dword [esp + 0x40]
push eax
call fcn.00437f8b
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
cmp dword [esp + 0xb0], ebp
jb 0x421bc7
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xb0], esi
mov dword [esp + 0xac], edi
mov byte [esp + 0x9c], 0
cmp dword [esp + 0x94], ebp
jb 0x421bf6
mov edx, dword [esp + 0x80]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x94], esi
mov dword [esp + 0x90], edi
mov byte [esp + 0x80], 0
cmp dword [esp + 0x78], ebp
jb 0x421c1f
mov eax, dword [esp + 0x64]
push eax
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x160], ebp
jb 0x421c38
mov ecx, dword [esp + 0x14c]
push ecx
call fcn.00437f8b
add esp, 4
mov byte [esp + 0x174], 3
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], edi
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], ebp
jb 0x421a33
mov edx, dword [esp + 0x130]
push edx
call fcn.00437f8b
add esp, 4
jmp 0x421a33
mov esi, dword [esp + 0x34]
mov dword [esi + 0x78], edi
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [esp + 0x134]
push eax
lea ecx, [esi + 0x3c]
call fcn.00402d10
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esi + 0x58]
call fcn.00402d10
cmp dword [esi + 0x80], edi
jne 0x421cc2
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x150]
push edx
lea ecx, [esi + 0x20]
call fcn.00402d10
mov eax, ebx
mov ecx, ebp
mov dword [esi + 0x74], ebx
call fcn.0042a010
mov esi, pe_nt_image_headers32
mov dword [eax + 0x38], edi
cmp dword [esp + 0x160], esi
jb 0x421cef
mov eax, dword [esp + 0x14c]
push eax
call fcn.00437f8b
add esp, 4
mov ebx, 0xf
mov dword [esp + 0x160], ebx
mov dword [esp + 0x15c], edi
mov byte [esp + 0x14c], 0
cmp dword [esp + 0x144], esi
jb 0x421d23
mov ecx, dword [esp + 0x130]
push ecx
call fcn.00437f8b
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x144], ebx
mov dword [esp + 0x140], edi
mov byte [esp + 0x130], 0
cmp eax, edi
je 0x421d4a
push eax
call fcn.00437f8b
add esp, 4
mov edx, dword [esp + 0x1c]
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x128], esi
jb 0x421d7c
mov eax, dword [esp + 0x114]
push eax
call fcn.00437f8b
add esp, 4
xor eax, eax
jmp 0x421e0a
add eax, 4
mov edx, dword [esp + 0x14]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0xc
cmp dword [esp + 0x54], ebp
jb 0x421da9
mov eax, dword [esp + 0x40]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0xb8]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
call fcn.00429620
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x421dd3
push eax
call fcn.00437f8b
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x128], ebp
jb 0x421e05
mov edx, dword [esp + 0x114]
push edx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x16c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.00437983
add esp, 0x164
ret 4