Function at 0x401ee2
Capabilities:
Copy file
Delete file
Get file size

Disassembly:
enter 0x388, 1
push ebx
push esi
push edi
push 0x40b2bf
push 0x4022ac
call fcn.00408e78
mov al, 0
mov dword [ebp - 0x38c], eax
mov byte [ebp - 0x53], 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
jne 0x401f1a
jmp 0x402276
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov ebx, eax
push esi
call sub.kernel32.dll__lclose
lea eax, [ebp - 0x4e]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x154]
push eax
push dword [ebp + 8]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
test ebx, ebx
jne 0x401f5c
jmp 0x402276
cmp ebx, 0x2710
jl 0x401fcd
lea eax, [ebp - 0x52]
push eax
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x4e]
call fcn.004088c4
lea eax, [ebp - 0x15c]
push eax
push 0x14
call fcn.004085dc
add eax, 0x41
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
push 0
mov eax, dword [ebp - 0x52]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
push dword [ebp - 0x4e]
push dword [ebp - 0x52]
call fcn.004071ff
test al, al
jne 0x401fc9
lea eax, [ebp - 0x4e]
push eax
push dword [ebp - 0x52]
call fcn.0040888c
jmp 0x401fcd
mov byte [ebp - 0x53], 1
push 0
mov eax, dword [ebp - 0x4e]
push eax
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
jne 0x401feb
push 0
push dword [ebp + 8]
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
jne 0x401ff5
jmp 0x402276
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x40]
call fcn.00407e6a
lea eax, [ebp - 0x4a]
push eax
push dword [ebp - 0x4e]
call fcn.0040888c
mov al, byte [ebp + 0x10]
dec al
jne 0x40204b
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x260]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x16c]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x4020bd
dec al
jne 0x402080
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x364]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x170]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x4020bd
push 0x40b297
push dword [ebp - 0x4a]
call fcn.00408ac0
test eax, eax
je 0x4020bd
push 0x40b2a1
push dword [ebp - 0x4a]
call fcn.00408ac0
test eax, eax
je 0x4020bd
lea eax, [ebp - 0x4a]
push eax
push 1
push 0x40b2ab
push dword [ebp - 0x4a]
call fcn.00408ac0
push eax
call fcn.00408a0c
jmp 0x402091
push 0x40cd50
mov eax, dword [ebp - 0x4a]
push eax
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x4020d9
jmp 0x402276
lea eax, [ebp - 0x4a]
push eax
push 0
call fcn.0040888c
push 0x2d
lea eax, [ebp - 0x32]
push eax
push esi
call sub.kernel32.dll__lread
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x402112
cmp byte [ebp - 0x53], 0
jne 0x402112
and edi, 0
jmp 0x40210e
mov al, byte [edi + ebp - 0x32]
xor al, 0x66
mov byte [edi + ebp - 0x32], al
inc edi
cmp ebx, edi
jge 0x402103
mov eax, dword [ebp - 0x3a]
add eax, ebx
mov dword [ebp - 0x3a], eax
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x370]
push eax
push dword [ebp - 0x4a]
call fcn.004088c4
lea eax, [ebp - 0x36c]
push eax
mov eax, ebx
add eax, 0x20
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
mov edi, 1
lea eax, [ebp - 0x36]
push eax
mov eax, edi
lea eax, [eax + eax*2]
lea eax, [eax + ebp - 0x35]
push eax
call fcn.00401e60
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x4a]
call fcn.004088c4
lea eax, [ebp - 0x374]
push eax
mov al, byte [ebp - 0x36]
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
lea eax, [ebp - 0x37c]
push eax
mov al, byte [ebp - 0x35]
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
lea eax, [ebp - 0x380]
push eax
mov al, byte [ebp - 0x34]
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
lea eax, [ebp - 0x384]
push eax
mov al, byte [ebp - 0x33]
push eax
call fcn.004087c0
pop eax
push dword [eax]
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
inc edi
cmp edi, 0xf
jle 0x402154
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x388]
push eax
push dword [ebp - 0x4a]
call fcn.004088c4
push 0x40b2b5
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
mov eax, dword [ebp - 0x4a]
test eax, eax
je 0x40221b
mov eax, dword [eax - 4]
cmp eax, 0x7d0
jge 0x402227
cmp ebx, 0x2d
je 0x40224b
push 0x40cd50
mov eax, dword [ebp - 0x4a]
push eax
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x402240
jmp 0x402276
lea eax, [ebp - 0x4a]
push eax
push 0
call fcn.0040888c
cmp ebx, 0x2d
je 0x4020e4
push 0x40cd50
push 0x40b2b8
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x40226e
jmp 0x402276
mov al, 1
mov dword [ebp - 0x38c], eax
push esi
call sub.kernel32.dll__lclose
cmp byte [ebp - 0x53], 0
je 0x402294
mov eax, dword [ebp - 0x4e]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 0x52]
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x4022b3
push 0x40b2bf
call fcn.00408ecc
ret