Function at 0x1049fb4
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
push esi
push edi
lea ecx, [ebp - 0xa8]
call fcn.0107e139
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], esi
call fcn.010424ee
lea ecx, [ebp - 0x18]
call fcn.010424ee
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], esi
call fcn.01043668
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x4c], esi
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa8]
push eax
push 0x1c
call fcn.0107c87e
test eax, eax
jge 0x104a01c
mov dword [ebp - 4], 1
jmp 0x104a1f3
lea eax, [ebp - 0x18]
push eax
push esi
lea ecx, [ebp - 0xa8]
call fcn.0107f08b
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x104a1f3
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebx]
lea ecx, [ebp - 0x18]
call fcn.010425a8
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.01042976
test eax, eax
jne 0x104a1f2
lea eax, [ebp - 0x2c]
push eax
push 3
lea ecx, [ebp - 0x1c]
call fcn.010438c7
test eax, eax
mov dword [ebp - 4], eax
jl 0x104a1f2
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c]
call fcn.0104369e
test eax, eax
mov dword [ebp - 4], eax
jl 0x104a1f2
cmp dword [ebp - 8], 0
je 0x104a1f2
and dword [ebp - 8], 0
push 0x5c
pop edi
push edi
lea ecx, [ebp - 0x2c]
call fcn.01042886
mov esi, eax
test esi, esi
jle 0x104a1eb
push edi
lea ecx, [ebp - 0x2c]
call fcn.01042808
cmp esi, eax
je 0x104a1eb
mov eax, dword [ebp - 0x2c]
and word [eax + esi*2], 0
mov eax, dword [ebx]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x18]
call fcn.01042ec9
test eax, eax
mov dword [ebp - 4], eax
jl 0x104a123
push edi
lea ecx, [ebp - 0x18]
call fcn.01042886
mov esi, eax
test esi, esi
jle 0x104a14d
push edi
lea ecx, [ebp - 0x18]
call fcn.01042808
cmp esi, eax
je 0x104a14d
mov eax, dword [ebp - 0x18]
and word [eax + esi*2], 0
push edi
lea ecx, [ebp - 0x18]
call fcn.01042886
mov esi, eax
test esi, esi
jle 0x104a14d
push edi
lea ecx, [ebp - 0x18]
call fcn.01042808
cmp esi, eax
je 0x104a14d
mov eax, dword [ebp - 0x18]
and word [eax + esi*2], 0
lea ecx, [ebp - 0x2c]
call fcn.010425a8
mov esi, eax
lea edi, [esi + esi + 4]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
test edx, edx
pop ecx
mov dword [ebp - 0xc], edx
jne 0x104a159
mov dword [ebp - 4], 0x8007000e
jmp 0x104a1f2
mov dword [ebp - 4], 1
jmp 0x104a1f2
mov ecx, edi
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, dword [ebp - 0x2c]
mov edi, edx
rep movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x18]
call fcn.010425a8
mov esi, eax
lea edi, [esi + esi + 4]
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
test edx, edx
pop ecx
mov dword [ebp - 0x20], edx
je 0x104a141
mov ecx, edi
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0xc]
mov ecx, esi
mov esi, dword [ebp - 0x18]
mov edi, edx
rep movsw word es:[edi], word [esi]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x40], edx
mov word [ebp - 0x3c], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x104a1de
mov dword [ebp - 4], 0x80004005
xor eax, eax
cmp dword [ebp - 4], eax
setge al
mov dword [ebp - 8], eax
jmp 0x104a1f2
mov dword [ebp - 4], 0x8000ffff
pop ebx
mov ecx, dword [ebp + 0xc]
xor esi, esi
cmp ecx, esi
je 0x104a20a
cmp dword [ebp - 4], esi
jl 0x104a206
mov eax, dword [ebp - 8]
jmp 0x104a208
xor eax, eax
mov dword [ecx], eax
cmp dword [ebp - 0xc], esi
je 0x104a218
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x20], esi
pop edi
pop esi
je 0x104a228
push dword [ebp - 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.01043670
lea ecx, [ebp - 0x18]
call fcn.01042e75
lea ecx, [ebp - 0x2c]
call fcn.01042e75
lea ecx, [ebp - 0xa8]
call fcn.0104163c
mov eax, dword [ebp - 4]
leave
ret 8