Function at 0x402577
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push 0x7b8
mov eax, 0x409e62
call fcn.00409b65
mov dword [ebp - 0x7c4], ecx
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x62c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov esi, str.http:__acroipm2.adobe.com_assets_AWBM_
mov edx, str.S1.txt
mov ecx, esi
call fcn.004024ed
lea ecx, [ebp - 0x62c]
call fcn.00402f29
lea ecx, [ebp - 0x218]
call fcn.00401f14
test al, al
je 0x402b3e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4025ea
sub ecx, edx
sar ecx, 1
je 0x402b3e
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x218]
push str.GoogleChromeUser_Data_
mov edi, 0x104
push edi
push eax
call ebx
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call ebx
push str.Bookmarks
lea eax, [ebp - 0x218]
push edi
push eax
call ebx
push 0xb8
lea eax, [ebp - 0x7b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x2c
lea ecx, [ebp - 0x7b8]
call fcn.00405392
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x7b8]
call fcn.004052f0
cmp dword [ebp - 0x75c], 0
je 0x402b19
mov eax, dword [ebp - 0x7b8]
xor ecx, ecx
mov word [ebp - 0x630], 1
push dword [ebp - 0x630]
mov byte [ebp - 0x7bb], cl
mov eax, dword [eax + 4]
push ecx
mov eax, dword [ebp + eax - 0x780]
test eax, eax
sete byte [ebp - 0x7bc]
push dword [ebp - 0x7bc]
push eax
push ecx
lea ecx, [ebp - 0x66c]
call fcn.00405e96
push 0x30
xor edi, edi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x700]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x700]
call fcn.004049a8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x65c]
add eax, 2
push eax
call fcn.00409099
mov ecx, dword [ebp - 0x65c]
mov esi, eax
add ecx, 2
push ecx
push edi
push esi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x658], 0x10
lea ecx, [ebp - 0x66c]
push dword [ebp - 0x65c]
cmovae ecx, dword [ebp - 0x66c]
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x1c
mov dword [ebp - 0x638], esi
lea eax, [ebp - 0x638]
mov dword [ebp - 0x634], edi
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x630], esi
push eax
call fcn.004069f6
cmp dword [eax + 0x28], edi
jne 0x402af2
mov esi, str.roots
lea ecx, [ebp - 0x700]
push esi
call fcn.004056a9
test eax, eax
je 0x402af2
push esi
lea ecx, [ebp - 0x700]
call fcn.00404a3e
mov esi, eax
push str.bookmark_bar
mov ecx, esi
call fcn.004056a9
test eax, eax
je 0x402aeb
push str.bookmark_bar
mov ecx, esi
call fcn.00404a3e
mov esi, eax
push str.children
mov ecx, esi
call fcn.004056a9
test eax, eax
je 0x402ae4
push str.children
mov ecx, esi
call fcn.00404a3e
mov dword [ebp - 0x630], eax
cmp dword [eax + 0xc], 4
jne 0x402ae4
cmp dword [eax + 4], edi
jbe 0x402ae4
push 0x30
lea eax, [ebp - 0x69c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0x69c]
call fcn.004049a8
xor eax, eax
lea edi, [ebp - 0x69c]
push 3
pop ecx
mov dword [ebp - 0x690], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x648], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x654]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x654]
push dword [ebp - 0x68c]
push str.13346689990798272
push str.date_added
call fcn.00405ede
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x40bca0
push str.date_last_used
call fcn.00405ede
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.d4d3e7d2_cdf9_4163_bb68_73a465fc09dc
push str.guid
call fcn.00405ede
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push 0x40bcf0
push 0x40bcf4
call fcn.00405ede
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.Adobe_Acrobat
push str.name
call fcn.00405ede
push dword [ebp - 0x68c]
mov edi, 0x40bd10
lea ecx, [ebp - 0x654]
push edi
push str.type
call fcn.00405ede
mov esi, dword [ebp - 0x7c4]
cmp esi, 1
je 0x4028d4
cmp esi, 2
jne 0x4028eb
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationReader
push edi
call fcn.00405ede
cmp esi, 4
je 0x4028f5
cmp esi, 3
jne 0x40290c
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x654]
push str.https:__acrobat.adobe.com__x_api_client_idbookmarkx_api_client_locationAcrobat
push edi
call fcn.00405ede
push dword [ebp - 0x68c]
mov ecx, dword [ebp - 0x630]
lea eax, [ebp - 0x654]
push eax
call fcn.004049df
lea ecx, [ebp - 0x7b8]
call fcn.0040529f
push 0x20c
lea eax, [ebp - 0x424]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
and dword [ebp - 0x7bc], 0
lea eax, [ebp - 0x424]
add esp, 0xc
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x402ad7
push str.temp_awbm_copy.txt
lea eax, [ebp - 0x424]
push esi
push eax
call ebx
push 0x40bdfc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0x18
cmp dword [ebp - 0x7bc], 0
je 0x402ad7
xorps xmm0, xmm0
xor ebx, ebx
add esi, 0xfffffffc
mov dword [ebp - 0x634], ebx
push 1
movups xmmword [ebp - 0x644], xmm0
mov dword [ebp - 0x630], esi
call fcn.00408e0a
push dword [ebp - 0x630]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x630]
add ecx, eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 4], 5
lea edi, [ebp - 0x6d0]
push 7
mov dword [ebp - 0x638], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x644]
push ecx
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6d0], eax
call fcn.00405640
lea eax, [ebp - 0x6d0]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x700]
call fcn.00405f8f
push ecx
lea ecx, [ebp - 0x644]
call fcn.00405e4e
lea ecx, [ebp - 0x6b4]
mov byte [eax], bl
push dword [ebp - 0x63c]
dec dword [ebp - 0x638]
call fcn.004054aa
push dword [ebp - 0x7bc]
cmp dword [ebp - 0x6a0], 0x10
lea eax, [ebp - 0x6b4]
push 1
push dword [ebp - 0x6a4]
cmovae eax, dword [ebp - 0x6b4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x7bc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
lea eax, [ebp - 0x218]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, str.S7.txt
mov ecx, str.http:__acroipm2.adobe.com_assets_AWBM_
call fcn.004024ed
lea ecx, [ebp - 0x6b4]
call fcn.00405487
lea ecx, [ebp - 0x6cc]
call fcn.0040498d
lea ecx, [ebp - 0x644]
call fcn.00405415
lea ecx, [ebp - 0x68c]
call fcn.0040498d
jmp 0x402b01
mov edx, str.S6.txt
jmp 0x402af7
mov edx, str.S5.txt
jmp 0x402af7
mov edx, str.S4.txt
mov ecx, str.http:__acroipm2.adobe.com_assets_AWBM_
call fcn.004024ed
lea ecx, [ebp - 0x6f0]
call fcn.0040498d
lea ecx, [ebp - 0x66c]
call fcn.00405487
jmp 0x402b25
mov edx, str.S3.txt
mov ecx, esi
call fcn.004024ed
lea ecx, [ebp - 0x748]
call fcn.004052c0
lea ecx, [ebp - 0x748]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x402b59
mov edx, 0x40b524
mov ecx, str.AddEntryToChromeBookmark::_FAILED_to_get_local_appdata_folder_path
call fcn.00401729
mov edx, str.S2.txt
mov ecx, esi
call fcn.004024ed
call fcn.00409b20
ret