Function at 0x405520
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
push esp
pop ebp
mov ecx, 0x41
push 0
push 0
dec ecx
jne 0x405528
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
sub eax, eax
push ebp
push 0x40589c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00406ca0
lea edx, [ebp - 0x1f0]
mov eax, dword [ebp - 4]
call fcn.00404d78
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1c]
call fcn.0040687c
mov eax, dword [0x40ea00]
cmp dword [eax], 0
push 0x4058b4
push dword [ebp - 0x20]
push 0x4058b4
lea eax, [ebp - 0x1f4]
nop
push 3
nop
pop edx
call fcn.00403fc4
mov eax, dword [ebp - 0x1f4]
mov edx, dword [0x40ea04]
mov edx, dword [edx]
call fcn.00404240
test eax, eax
jg 0x405871
mov eax, dword [0x40ea04]
push dword [eax]
push 0x4058b4
push dword [ebp - 0x20]
push 0x4058b4
mov eax, dword [0x40ea04]
mov edx, 4
call fcn.00403fc4
lea edx, [ebp - 8]
sub eax, eax
call fcn.00402738
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403e18
mov eax, dword [ebp - 8]
call fcn.00406d58
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00406d58
mov esi, eax
or ebx, ebx
jle 0x405871
or esi, esi
jle 0x405871
mov eax, dword [0x40ea14]
inc dword [eax]
mov eax, dword [0x40ea14]
cmp dword [eax], 0x2d
jge 0x405871
mov eax, dword [ebp - 0x1c]
mov edx, 0x4058c0
call fcn.00404048
je 0x4056b1
mov eax, dword [ebp - 0x1c]
mov edx, 0x4058d0
call fcn.00404048
je 0x4056b1
mov eax, dword [ebp - 0x1c]
mov edx, 0x4058e0
call fcn.00404048
je 0x4056b1
mov eax, dword [ebp - 0x1c]
mov edx, 0x4058f0
call fcn.00404048
je 0x4056b1
mov eax, dword [ebp - 0x1c]
mov edx, 0x405900
call fcn.00404048
je 0x4056b1
mov eax, dword [ebp - 0x1c]
mov edx, 0x405910
call fcn.00404048
je 0x4056b1
lea eax, [ebp - 0x1f8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f04
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040415c
mov edx, dword [ebp - 0x1f8]
lea eax, [ebp - 0xc]
mov ecx, 0x4058c0
call fcn.00403f50
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00403e18
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00403e18
lea eax, [ebp - 0x18]
call fcn.00403d80
cmp ebx, esi
jge 0x405711
call fcn.00402798
jmp 0x4056ff
mov eax, pe_nt_image_headers32
call fcn.00402d14
mov edx, eax
lea eax, [ebp - 0x1fc]
call fcn.00403ea0
mov edx, dword [ebp - 0x1fc]
lea eax, [ebp - 0x18]
call fcn.00403f0c
mov eax, dword [ebp - 0x18]
call fcn.00403f04
mov edx, esi
sub edx, ebx
cmp eax, edx
jl 0x4056da
jmp 0x405755
call fcn.00402798
mov eax, 0xc800
call fcn.00402d14
push eax
pop ebx
jmp 0x405749
mov eax, pe_nt_image_headers32
call fcn.00402d14
mov edx, eax
lea eax, [ebp - 0x200]
call fcn.00403ea0
mov edx, dword [ebp - 0x200]
lea eax, [ebp - 0x18]
call fcn.00403f0c
mov eax, dword [ebp - 0x18]
call fcn.00403f04
cmp ebx, eax
jg 0x405724
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 0xc]
call fcn.00406ca0
mov eax, dword [ebp - 0x204]
push eax
lea eax, [ebp - 0x208]
call fcn.00406b80
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00403f50
push 0
mov eax, dword [ebp - 0xc]
call fcn.004040fc
push eax
pop ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.004040fc
push eax
call sub.kernel32.dll_CopyFileA
call fcn.00402798
push 0x64
pop eax
pushal
popal
call fcn.00402d14
cmp eax, 0x3c
jle 0x4057ce
push ebx
mov eax, dword [0x40ea00]
mov eax, dword [eax]
call fcn.004040fc
pop edx
call fcn.00404a54
test al, al
je 0x405871
cmp dword [ebp - 0x18], 0
je 0x405843
xor eax, eax
push ebp
push 0x405832
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1ec]
call fcn.00402aa8
lea eax, [ebp - 0x1ec]
call fcn.00402844
call fcn.004025d0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x1ec]
call fcn.004042ec
call fcn.00402b58
call fcn.004025d0
lea eax, [ebp - 0x1ec]
call fcn.00402c18
call fcn.004025d0
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405843
call fcn.00402798
pushal
popal
push 0x64
pop eax
call fcn.00402d14
cmp eax, 0x3c
jle 0x405871
mov eax, dword [ebp - 0xc]
call fcn.0040504c
test al, al
je 0x405871
mov eax, dword [ebp - 0xc]
call fcn.004040fc
push eax
call sub.kernel32.dll_DeleteFileA
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058a3
lea eax, [ebp - 0x208]
mov edx, 7
call fcn.00403da4
lea eax, [ebp - 0x20]
nop
push 8
nop
pop edx
call fcn.00403da4
ret