Function at 0x419c00
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4366da
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
add ecx, 0x70
call fcn.00401600
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0
push str.imeconfig.exe
push 0x43c8b0
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x214], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
push eax
push 0x439bc4
push 0x43c8b0
mov ecx, dword [ebp + 8]
add ecx, 0x70
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x224]
push ecx
lea edx, [ebp - 0xd4]
push edx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0040cce0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd4]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.00401080
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00401080
push 0
push str.configwizard.exe
push 0x43c8b0
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
lea eax, [ebp - 0xf0]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x234]
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x23c]
push edx
push 0x439ba8
push 0x43c8b0
mov eax, dword [ebp + 8]
add eax, 0x70
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x244], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x144]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x248], eax
mov edx, dword [ebp - 0x248]
mov dword [ebp - 0x24c], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x24c]
push eax
call fcn.0040cce0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x144]
call fcn.00401080
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x128]
call fcn.00401080
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10c]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00401080
push 0
push str.uninst.exe
push 0x43c8b0
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x254], eax
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x254]
push ecx
lea edx, [ebp - 0x17c]
push edx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x439b90
push 0x43c8b0
mov edx, dword [ebp + 8]
add edx, 0x70
push edx
lea eax, [ebp - 0x198]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x264], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x264]
push edx
lea eax, [ebp - 0x1b4]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x26c], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x26c]
push edx
call fcn.0040cce0
add esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1b4]
call fcn.00401080
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x198]
call fcn.00401080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x17c]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00401080
push 0x439b7c
push 0x43c8b0
mov eax, dword [ebp + 8]
add eax, 0x70
push eax
lea ecx, [ebp - 0x1d0]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x270], eax
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x274], edx
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x274]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00404120
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1d0]
call fcn.00401080
push 0
lea ecx, [ebp - 0x64]
call fcn.00401600
push eax
call fcn.004240e6
add esp, 8
test eax, eax
jne 0x41a014
lea ecx, [ebp - 0x64]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00401080
push str.baidushurufa.url
push 0x43c8b0
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
lea eax, [ebp - 0x1ec]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 4], 0xf
mov edx, dword [ebp - 0x27c]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00404120
add esp, 0xc
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1ec]
call fcn.00401080
push 0x439b40
push 0x43c8b0
mov ecx, dword [ebp + 8]
add ecx, 0x70
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x284]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00404120
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x208]
call fcn.00401080
push 0
lea ecx, [ebp - 0x2c]
call fcn.00401600
push eax
lea ecx, [ebp - 0x48]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x20c], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2c]
call fcn.00401080
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00401080
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret