Function at 0x58fbd0
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0
push 0
push 1
push 0
push 0
push 0
push 0x61a594
mov byte [esp + 0x2f], 0
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x58fc8c
mov ebx, dword [sym.imp.kernel32.dll_GetProcessHeap]
push 0x104
push 8
call ebx
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
push eax
call edi
push 0x104
push 8
mov esi, eax
call ebx
push eax
call edi
test esi, esi
mov edi, eax
je 0x58fc72
test edi, edi
je 0x58fc66
mov ebp, dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push 0x104
push esi
call ebp
push 0x104
push edi
call ebp
mov ebp, dword [sym.imp.kernel32.dll_lstrcat]
push 0x61a584
push esi
call ebp
push 0x61a56c
push edi
call ebp
push 0
push edi
push esi
call dword [sym.imp.kernel32.dll_CopyFileA]
push esi
push 0
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
test edi, edi
je 0x58fc82
push edi
push 0
call ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret
mov ebp, dword [sym.imp.kernel32.dll_GetProcessHeap]
push 0x21
push 8
call ebp
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
push eax
call edi
push 0x210
push 8
mov esi, eax
call ebp
push eax
call edi
test esi, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
je 0x58fe34
test ebx, ebx
je 0x58fe28
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], 0
mov al, byte [esp + 0x13]
test al, al
jne 0x58fe22
xor eax, eax
mov ecx, esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dl, byte [esp + 0x14]
mov byte [ecx + 0x20], al
push eax
mov ecx, 0x84
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov byte [esi + 4], al
mov byte [esi + 7], al
mov byte [esi + 8], al
lea eax, [esp + 0x24]
push eax
push 0x210
push ebx
push 0x20
push esi
push 0x7c088
push ecx
mov dword [esi], 0x200
mov byte [esi + 0xc], dl
mov byte [esi + 5], 1
mov byte [esi + 6], 1
mov byte [esi + 9], 0xa0
mov byte [esi + 0xa], 0xec
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x58fe10
lea edx, [ebx + 0x24]
mov cl, byte [edx + 1]
mov al, byte [edx]
mov byte [edx], cl
mov cl, byte [edx + 3]
mov byte [edx + 1], al
mov al, byte [edx + 2]
mov byte [edx + 2], cl
mov cl, byte [edx + 5]
mov byte [edx + 3], al
mov al, byte [edx + 4]
mov byte [edx + 4], cl
mov cl, byte [edx + 7]
mov byte [edx + 5], al
mov al, byte [edx + 6]
mov byte [edx + 6], cl
mov cl, byte [edx + 9]
mov byte [edx + 7], al
mov al, byte [edx + 8]
mov byte [edx + 8], cl
mov cl, byte [edx + 0xb]
mov byte [edx + 9], al
mov al, byte [edx + 0xa]
mov byte [edx + 0xa], cl
mov cl, byte [edx + 0xd]
mov byte [edx + 0xb], al
mov al, byte [edx + 0xc]
mov byte [edx + 0xc], cl
mov cl, byte [edx + 0xf]
mov byte [edx + 0xd], al
mov al, byte [edx + 0xe]
mov byte [edx + 0xe], cl
mov cl, byte [edx + 0x11]
mov byte [edx + 0xf], al
mov al, byte [edx + 0x10]
mov byte [edx + 0x10], cl
mov cl, byte [edx + 0x13]
mov byte [edx + 0x11], al
mov al, byte [edx + 0x12]
mov byte [edx + 0x12], cl
mov ecx, dword [esp + 0x2c]
mov ebx, ecx
mov byte [edx + 0x13], al
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x14
mov ecx, ebx
push edx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call dword [sym.imp.msvcr71.dll_memmove]
push ebp
call fcn.00590c50
xor edx, edx
mov dl, byte [ebp]
add esp, 0x10
push edx
call dword [sym.imp.user32.dll_IsCharAlphaNumericA]
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x58fe10
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x10
mov dword [esp + 0x14], eax
jl 0x58fcd1
mov ebp, dword [sym.imp.kernel32.dll_GetProcessHeap]
push esi
push 0
call ebp
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
test ebx, ebx
je 0x58fe44
push ebx
push 0
call ebp
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret