Function at 0x41fa82
Capabilities:
Copy file
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x284
and dword [ebp + 0x7c], 0x30000
push esi
mov esi, ecx
push 0x19c8
lea ecx, [ebp + 0x4c]
call fcn.0043d3c3
and dword [ebp + 0x58], 0
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x4c]
push 0x527
push dword [ebp + 0x78]
call fcn.0043dae5
mov eax, dword [ebp + 0x58]
add esp, 0x10
test eax, eax
jne 0x41fad8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x41fad1
inc eax
mov esi, eax
jmp 0x41ff15
mov ecx, dword [ebp + 0x4c]
push ebx
sub eax, ecx
push edi
sar eax, 1
mov ebx, eax
push ebx
lea edi, [ecx + 0xa50]
push ecx
push edi
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x64], edi
call fcn.00405049
lea eax, [edi + ebx*2]
and word [eax], 0
add edi, 0xa50
lea ebx, [edi + 0xa50]
mov dword [ebp + 0x3c], eax
lea eax, [ebx + 0xa50]
mov dword [ebp + 0x6c], eax
mov eax, dword [esi + 0x40]
add esp, 0xc
test eax, eax
mov dword [ebp + 0x5c], ebx
je 0x41fbb8
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
call ebx
mov ecx, eax
mov eax, dword [esi + 0x40]
mov dword [ebp + 0x68], ecx
mov cx, word [eax + ecx*2 - 2]
cmp cx, 0x5c
je 0x41fb49
cmp cx, 0x2f
jne 0x41fb4c
dec dword [ebp + 0x68]
push dword [ebp + 0x68]
push eax
push edi
call fcn.00405049
mov eax, dword [ebp + 0x68]
add eax, eax
push 0xc
mov dword [ebp + 0x60], eax
add eax, edi
push 0x4a7d04
push eax
call fcn.0041255f
push dword [ebp + 0x68]
push dword [esi + 0x40]
push dword [ebp + 0x5c]
call fcn.00405049
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebp + 0x60]
push 0x26
add eax, ecx
push str.SYSTEM32DRIVERS_
push eax
call fcn.0041255f
push dword [ebp + 0x68]
push dword [esi + 0x40]
push dword [ebp + 0x6c]
call fcn.00405049
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp + 0x60]
push 0x16
add eax, ecx
push str.SYSTEM32_
push eax
call fcn.0041255f
add esp, 0x48
jmp 0x41fbf1
push 0x104
push edi
push str._SystemRoot_INF_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push str._SystemRoot_SYSTEM32DRIVERS_
call ebx
push 0x104
push dword [ebp + 0x6c]
push str._SystemRoot_SYSTEM32_
call ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push edi
call ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x48], eax
call ebx
push dword [ebp + 0x6c]
mov dword [ebp + 0x40], eax
call ebx
push dword [ebp + 0x58]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x48]
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x2800
lea ecx, [ebp + 0x6c]
call fcn.0043d3c3
push dword [ebp + 0x78]
mov ebx, 0x27ff
push str.ToSys:Copy___s_
push ebx
push dword [ebp + 0x6c]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
push 0
push 0x11
push 0
push dword [ebp + 0x6c]
call fcn.0041ab5d
lea ecx, [ebp + 0x6c]
call fcn.00437884
push 0
push edi
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp + 0x7c], 0
je 0x41fcb1
push 0x2800
lea ecx, [ebp + 0x6c]
call fcn.0043d3c3
push edi
push str.ToSys:TreatINF___s_
push ebx
push dword [ebp + 0x6c]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
push 0
push 0x11
push 0
push dword [ebp + 0x6c]
call fcn.0041ab5d
lea ecx, [ebp + 0x6c]
call fcn.00437884
push dword [ebp + 0x7c]
push edi
call fcn.004145b3
pop ecx
pop ecx
push 0x2800
lea ecx, [ebp + 0x6c]
call fcn.0043d3c3
push dword [ebp + 0x78]
push str.ToSys:END___s_
push ebx
push dword [ebp + 0x6c]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
xor edi, edi
push edi
push 0x11
push edi
push dword [ebp + 0x6c]
call fcn.0041ab5d
lea ecx, [ebp + 0x6c]
call fcn.00437884
push 8
push 0x4a7be4
push dword [ebp + 0x58]
call fcn.0041255f
xor eax, eax
and dword [ebp + 0x54], eax
mov dword [ebp - 0x214], edi
mov ecx, 0x93
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x50]
lea eax, [ebp + 0x54]
push eax
call fcn.0048efb8
add esp, 0x18
cmp dword [ebp + 0x54], 0
je 0x41ff09
test byte [ebp - 0x214], 0x10
jne 0x41fef2
cmp word [ebp - 0x1e8], 0x2e
jne 0x41fd6f
cmp word [ebp - 0x1e6], 0
je 0x41fef2
cmp word [ebp - 0x1e6], 0x2e
jne 0x41fd6f
cmp word [ebp - 0x1e4], 0
je 0x41fef2
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [ebp - 0x1e8]
push eax
call edi
inc eax
add eax, eax
push eax
lea eax, [ebp - 0x1e8]
push eax
push dword [ebp + 0x3c]
call fcn.0041255f
add esp, 0xc
lea eax, [ebp - 0x1e8]
push eax
call edi
cmp eax, 4
jge 0x41fda5
push 4
pop eax
mov edi, dword [ebp + 0x44]
lea ecx, [ebp + eax*2 - 0x1f0]
mov eax, dword [ebp + 0x5c]
push 0x4a7bd8
add eax, 0xa50
push ecx
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x41fddb
mov eax, dword [ebp + 0x64]
mov edi, dword [ebp + 0x48]
add eax, 0xa50
mov dword [ebp + 0x78], eax
push str..SYS
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x41fdf6
mov eax, dword [ebp + 0x5c]
mov edi, dword [ebp + 0x40]
mov dword [ebp + 0x78], eax
lea eax, [ebp - 0x1e8]
push eax
mov eax, dword [ebp + 0x78]
lea eax, [eax + edi*2]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov edi, 0x2800
push edi
lea ecx, [ebp + 0x6c]
call fcn.0043d3c3
push dword [ebp + 0x64]
push str.ToSys:Copy___s_
push ebx
push dword [ebp + 0x6c]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
push 0
push 0x11
push 0
push dword [ebp + 0x6c]
call fcn.0041ab5d
lea ecx, [ebp + 0x6c]
call fcn.00437884
push 0
push dword [ebp + 0x78]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov eax, dword [ebp + 0x64]
add eax, 0xa50
cmp eax, dword [ebp + 0x78]
jne 0x41feb5
cmp dword [ebp + 0x7c], 0
je 0x41feb5
push edi
lea ecx, [ebp + 0x68]
call fcn.0043d3c3
mov eax, dword [ebp + 0x64]
add eax, 0xa50
push eax
push str.ToSys:TreatINF___s_
push ebx
push dword [ebp + 0x68]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
push 0
push 0x11
push 0
push dword [ebp + 0x68]
call fcn.0041ab5d
lea ecx, [ebp + 0x68]
call fcn.00437884
mov eax, dword [ebp + 0x64]
push dword [ebp + 0x7c]
add eax, 0xa50
push eax
call fcn.004145b3
pop ecx
pop ecx
push edi
lea ecx, [ebp + 0x60]
call fcn.0043d3c3
push dword [ebp + 0x64]
push str.ToSys:End___s_
push ebx
push dword [ebp + 0x60]
call fcn.0048ff08
mov ecx, dword [esi + 4]
add esp, 0x10
xor edi, edi
push edi
push 0x11
push edi
push dword [ebp + 0x60]
call fcn.0041ab5d
lea ecx, [ebp + 0x60]
call fcn.00437884
mov word [ebp - 0x1e4], di
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405140
test eax, eax
jne 0x41fd32
lea ecx, [ebp + 0x54]
call fcn.00402bbf
pop edi
xor esi, esi
pop ebx
lea ecx, [ebp + 0x4c]
call fcn.00437884
mov eax, esi
pop esi
add ebp, 0x70
leave
ret 8