Function at 0x409500
Capabilities:
Check os version
Copy file
Create directory
Delete file
Get common file path
Link many functions at runtime
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x300c
call fcn.0042d2a0
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x228e]
push ecx
mov word [ebp - 0x2290], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x165e]
push eax
mov word [ebp - 0x1660], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x2cb6]
push edx
mov word [ebp - 0x2cb8], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x2aae]
push ecx
mov word [ebp - 0x2ab0], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x2ebe]
push eax
mov word [ebp - 0x2ec0], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x28a6]
push edx
mov word [ebp - 0x28a8], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x1046]
push ecx
mov word [ebp - 0x1048], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x2086]
push eax
mov word [ebp - 0x2088], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0xe3e]
push edx
mov word [ebp - 0xe40], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x1c76]
mov word [ebp - 0x1c78], ax
push ecx
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x2496]
push eax
mov word [ebp - 0x2498], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x1a6e]
push edx
mov word [ebp - 0x1a70], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x269e]
push ecx
mov word [ebp - 0x26a0], ax
call fcn.00428450
add esp, 0xc
push 0x208
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.00428450
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00428450
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x210]
push str._swmcSystem764.exe
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x418]
push str._swmcSystem7.exe
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x2290]
push str._swmcService764.exe
push eax
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x1660]
push str._swmcService7.exe
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x28a8]
push str._swmcWatermark764.exe
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x2ec0]
push str._swmcWatermark7.exe
push eax
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x2cb8]
push str._swmcWatermark_DLL.dll
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x2ab0]
push str._swmcWatermark_DLL64.dll
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x26a0]
push str._swmcFTMaster764.exe
push eax
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x1a70]
push str._swmcFTMaster7.exe
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x2498]
push str._swmcFTSlave764.exe
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x1c78]
push str._swmcFTSlave7.exe
push eax
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x1048]
push str._scbfsfilter20.dll
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0xe40]
push str._scbfsfilter2064.dll
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x2088]
push str._scbfsfilter2032.dll
push eax
call esi
add esp, 0xc
push 0
push str.C:UsersPublicWM7RemoteService
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call fcn.00408d90
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.C:Program_FilesWW2017CFBrowserRecordClient.exe
call edi
cmp dword [0x489424], 0
jne 0x4098c3
push 0x43eb4c
call fcn.00406870
add esp, 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61e]
push edx
mov word [ebp - 0x620], cx
call fcn.00428450
add esp, 0xc
push 0x48ef90
lea eax, [ebp - 0x620]
push str._sPolicySystemOffline
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x620]
push 0
push ecx
call fcn.004084d0
add esp, 0xc
push 0x48ef90
lea edx, [ebp - 0x620]
push str._sPolicyADUser
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.004084d0
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4098e7
lea ecx, [ebp - 0x300c]
push ecx
call eax
movzx eax, word [ebp - 0x300c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x409a1a
cmp eax, 9
jne 0x409a1a
push 0x80
lea edx, [ebp - 0x418]
push edx
call ebx
push 0x80
lea eax, [ebp - 0x1660]
push eax
call ebx
push 0x80
lea ecx, [ebp - 0x1a70]
push ecx
call ebx
push 0x80
lea edx, [ebp - 0x1c78]
push edx
call ebx
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x418]
push edx
call ebx
push 0
lea eax, [ebp - 0x1660]
push eax
lea ecx, [ebp - 0x2290]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x1660]
push edx
call ebx
push 0
lea eax, [ebp - 0x1a70]
push eax
lea ecx, [ebp - 0x26a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x1a70]
push edx
call ebx
push 0
lea eax, [ebp - 0x1c78]
push eax
lea ecx, [ebp - 0x2498]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x1c78]
push edx
call ebx
push 0
lea eax, [ebp - 0x2088]
push eax
lea ecx, [ebp - 0x1048]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x2088]
push edx
call ebx
push 0
lea eax, [ebp - 0x1048]
push eax
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x1048]
push edx
call ebx
jmp 0x409acf
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.00428450
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x620]
push str._swmcProc7.exe
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
call edi
lea ecx, [ebp - 0x2ab0]
push ecx
call edi
lea edx, [ebp - 0x28a8]
push edx
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x620]
push str._swmcHook64.dll
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0x620]
push ecx
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x620]
push str._swmcMemmgr64.dll
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x620]
push str._swmcHook764.dll
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x620]
push edx
call edi
lea eax, [ebp - 0xe40]
push eax
call edi
lea ecx, [ebp - 0x210]
push ecx
call edi
lea edx, [ebp - 0x2290]
push edx
call edi
lea eax, [ebp - 0x26a0]
push eax
call edi
lea ecx, [ebp - 0x2498]
push ecx
call edi
lea edx, [ebp - 0xe40]
push edx
call edi
push 0x11c
lea eax, [ebp - 0x538]
push 0
push eax
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0x538]
push ecx
mov dword [ebp - 0x538], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x534], 6
jae 0x409ced
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x61e]
push eax
mov word [ebp - 0x620], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0xc36]
push edx
mov word [ebp - 0xc38], cx
call fcn.00428450
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x620]
push str._sCBFSRegistry.cab
push eax
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0xc38]
push str._sCBFSProcess.cab
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x620]
push edx
call edi
lea eax, [ebp - 0xc38]
push eax
call edi
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409bd4
lea ecx, [ebp - 0x300c]
push ecx
call eax
movzx eax, word [ebp - 0x300c]
test eax, eax
je 0x409c67
cmp eax, 9
jne 0x409c67
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x210]
push str._swmcSystem764.exe.XP
push edx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x418]
push str._swmcSystem7.exe
push eax
call esi
add esp, 0xc
push 0x80
lea ecx, [ebp - 0x418]
push ecx
call ebx
push 0
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea ecx, [ebp - 0x418]
push ecx
call ebx
lea edx, [ebp - 0x210]
push edx
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea eax, [ebp - 0x210]
push str._swmcSystem7.exe.XP
push eax
call esi
add esp, 0xc
jmp 0x409ce4
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x210]
push str._swmcSystem764.exe.XP
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x210]
push str._swmcSystem7.exe.XP
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x418]
push str._swmcSystem7.exe
push edx
call esi
add esp, 0xc
push 0x80
lea eax, [ebp - 0x418]
push eax
call ebx
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea eax, [ebp - 0x418]
push eax
call ebx
lea ecx, [ebp - 0x210]
push ecx
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x210]
push str._swmcSystem764.exe.XP
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x210]
push str._swmcSystem7.exe.XP
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call edi
push 0x11c
lea eax, [ebp - 0x2fe0]
push 0
push eax
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0x2fe0]
push ecx
mov dword [ebp - 0x2fe0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x2fdc], 5
jbe 0x409e15
call fcn.00403bb0
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x210]
cmp eax, 1
jne 0x409df5
push str._sPolicyViewer20.exe
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
push str._sPolicyViewer40.exe
lea ecx, [ebp - 0x210]
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x418]
push str._sPolicyViewer.exe
push edx
call esi
add esp, 0xc
push 0x80
lea eax, [ebp - 0x418]
push eax
call ebx
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea eax, [ebp - 0x418]
push eax
call ebx
lea ecx, [ebp - 0x210]
push ecx
jmp 0x409e51
push str._sPolicyViewer40.exe
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
push str._sPolicyViewer20.exe
jmp 0x409d98
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x210]
push str._sPolicyViewer20.exe
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call edi
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x210]
push str._sPolicyViewer40.exe
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call edi
push 0
push 0
push 0
push 0
push 0x48ef90
push str.C:UsersPublicSMR7WM7installTemp
call fcn.00408760
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x1e7e]
push ecx
mov word [ebp - 0x1e80], ax
call fcn.00428450
add esp, 0x24
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x826]
push eax
mov word [ebp - 0x828], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x1866]
push edx
mov word [ebp - 0x1868], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x1456]
push ecx
mov word [ebp - 0x1458], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x124e]
push eax
mov word [ebp - 0x1250], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0xa2e]
push edx
mov word [ebp - 0xa30], cx
call fcn.00428450
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00428450
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x1e80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x1868]
push str._sHuRMS.exe
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x1e80]
push eax
lea ecx, [ebp - 0x418]
push str._sHuRMS.exe
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
push str._spcinfo7.exe
lea edx, [ebp - 0x1458]
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x1e80]
push eax
lea ecx, [ebp - 0x828]
push str._spcinfo7.exe
push ecx
call esi
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [ebp - 0x1250]
push str._sWinNetDaily.dll
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x1e80]
push eax
lea ecx, [ebp - 0xa30]
push str._sWinNetDaily.dll
push ecx
call esi
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409ff4
lea edx, [ebp - 0x300c]
push edx
call eax
movzx eax, word [ebp - 0x300c]
test eax, eax
je 0x40a146
cmp eax, 9
jne 0x40a146
push str.Kernel32.dll
mov dword [ebp - 0x2fe8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2fe4], eax
test eax, eax
je 0x40a104
push str.Wow64DisableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2fe8]
push ecx
call eax
test eax, eax
je 0x40a0f7
mov eax, dword [ebp - 0x2fe4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x1868]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea eax, [ebp - 0x418]
push eax
call ebx
push 0
lea ecx, [ebp - 0x828]
push ecx
lea edx, [ebp - 0x1458]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea eax, [ebp - 0x828]
push eax
call ebx
push 0
lea ecx, [ebp - 0xa30]
push ecx
lea edx, [ebp - 0x1250]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea eax, [ebp - 0xa30]
push eax
call ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2fe4], eax
test eax, eax
je 0x40a104
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
call eax
test eax, eax
jne 0x40a0f7
mov ecx, dword [ebp - 0x2fe4]
push ecx
jmp 0x40a0fe
mov edx, dword [ebp - 0x2fe4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x1458]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x828]
push edx
call ebx
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x1868]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x418]
jmp 0x40a186
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x1868]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0x418]
push edx
call ebx
push 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x1458]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x828]
push 0x80
push edx
call ebx
push 0
lea eax, [ebp - 0xa30]
push eax
lea ecx, [ebp - 0x1250]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
lea edx, [ebp - 0xa30]
push edx
call ebx
push 0x48ef90
lea eax, [ebp - 0xe40]
push str._scbregistry.cab
push eax
call esi
add esp, 0xc
lea ecx, [ebp - 0xe40]
push 0
push ecx
call fcn.00422520
add esp, 8
test eax, eax
jne 0x40a21a
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0xc36]
push eax
mov word [ebp - 0xc38], dx
call fcn.00428450
add esp, 0xc
push 0x48ef90
lea ecx, [ebp - 0xc38]
push str._sCBFSRegistry.cab
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0xc38]
push edx
call edi
push 0
push str.C:UsersPublicWM7RemoteServiceRemoteServiceList.ini
push str.C:Program_FilesWW2017CFInfoRemoteService.opt
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.0041c060
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x486950], eax
pop edi
setle al
pop esi
xor ecx, ebp
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret