Function at 0x111290b
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x127fbfd
call fcn.01160118
sub esp, 0x4a4
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [0x12ce0a0]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4a8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x104
lea ecx, [ebp - 0x4a8]
call fcn.01032987
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push ebx
push ebx
push 0x800e
push ebx
mov dword [ebp - 0x494], eax
call esi
test eax, eax
jge 0x1112973
push dword [ebp - 0x494]
push ebx
push ebx
push 0x8005
push ebx
call esi
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 1
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 2
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 3
mov eax, dword [edi + 0xda0]
xor esi, esi
cmp eax, 2
jne 0x11129b9
mov esi, 0xf4af
push 0x100cb58
jmp 0x11129d8
cmp eax, 1
jne 0x11129ca
mov esi, 0xf018
push 0x100cb50
jmp 0x11129d8
cmp eax, ebx
jne 0x11129e3
mov esi, 0xf019
push 0x100cb48
lea ecx, [ebp - 0x4a0]
call fcn.01044f8b
push ebx
lea eax, [ebp - 0x4ac]
push eax
push esi
call fcn.01105599
push 0x219
lea ecx, [ebp - 0x4a4]
call fcn.01032a7e
mov eax, dword [edi + 0xf20]
push ebx
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x490]
push 0x20806
push eax
push dword [ebp - 0x4a0]
push ebx
call fcn.010689fe
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x448], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x490]
call fcn.0108fca8
mov esi, eax
dec esi
neg esi
sbb esi, esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x4a8]
inc esi
call fcn.010329f4
cmp esi, ebx
je 0x1112bb9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x498]
call fcn.01045e8e
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x498]
cmp dword [eax - 8], 0x104
jl 0x1112b2c
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x494], eax
mov byte [ebp - 4], 6
push 0xf03d
lea ecx, [ebp - 0x494]
call fcn.01032a7e
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 7
push 0xf006
lea ecx, [ebp - 0x4b0]
call fcn.01032a7e
call fcn.0115c7bb
or eax, 0x30
push eax
push dword [ebp - 0x4b0]
lea ecx, [edi + 0x18]
push dword [ebp - 0x494]
call fcn.01061408
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4b0]
call fcn.0103290a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x494]
call fcn.0103290a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.0104508a
mov esi, 0x80004005
jmp 0x1112bbb
lea ecx, [ebp - 0x49c]
call fcn.01044f5e
mov byte [ebp - 4], 8
lea eax, [ebp - 0x49c]
push eax
push ebx
mov ecx, edi
call fcn.0110a80f
mov esi, eax
cmp esi, ebx
jge 0x1112b70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.0104508a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.0104508a
jmp 0x1112bbb
push ebx
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x1112b9b
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.0104508a
jmp 0x1112b13
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.0104508a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.0104508a
xor esi, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x490]
call fcn.0106735f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4a0]
call fcn.0103290a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a4]
call fcn.0103290a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4ac]
call fcn.0103290a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a8]
call fcn.0103290a
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret