Function at 0x100a7880
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a96d5
mov eax, dword fs:[0]
push eax
sub esp, 0xaf0
mov eax, dword [0x1022c684]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 3
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.100e14d0
add esp, 8
mov byte [ebp - 4], 4
push 0x101c7340
push 0
lea ecx, [ebp - 0xa40]
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0xa8c], eax
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa90], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xa90]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10090bb0
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa40]
call fcn.10005e00
lea ecx, [ebp - 0x228]
call fcn.10005d40
mov byte [ebp - 4], 8
mov dx, word [0x101c734c]
mov word [ebp - 0x224], dx
push 0x206
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.1016f6c0
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x228]
call fcn.10005e20
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.100043a0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jb 0x100a799d
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x228]
call fcn.10005e20
lea ecx, [ebp + 0x10]
call fcn.10004390
push eax
lea ecx, [ebp - 0x22c]
call fcn.100abe60
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x22c]
call fcn.100abe90
lea ecx, [ebp - 0x22c]
call fcn.100abe80
push eax
lea ecx, [ebp - 0x10]
call fcn.10005d60
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp + 0x18]
call fcn.1012b3b0
push str..msi
lea ecx, [ebp - 0xa48]
call fcn.10005d80
mov dword [ebp - 0xa94], eax
mov edx, dword [ebp - 0xa94]
mov dword [ebp - 0xa98], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xa98]
push eax
push 4
lea ecx, [ebp - 0xa4c]
push ecx
lea ecx, [ebp + 8]
call fcn.100aba80
mov dword [ebp - 0xa9c], eax
mov edx, dword [ebp - 0xa9c]
push edx
call fcn.10004350
add esp, 8
mov byte [ebp - 0xa41], al
lea ecx, [ebp - 0xa4c]
call fcn.10005e00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa48]
call fcn.10005e00
movzx eax, byte [ebp - 0xa41]
test eax, eax
je 0x100a7b75
lea ecx, [ebp - 0x230]
call fcn.10005d40
mov byte [ebp - 4], 0xc
push str.___passive
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push str.__i__
lea eax, [ebp - 0xa50]
push eax
call fcn.1001a4e0
add esp, 0xc
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa4], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xaa4]
push edx
lea eax, [ebp - 0xa54]
push eax
call fcn.100042a0
add esp, 0xc
mov dword [ebp - 0xaa8], eax
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xaac], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xaac]
push edx
lea eax, [ebp - 0xa58]
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0xab0]
mov dword [ebp - 0xab4], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0xab4]
push edx
lea ecx, [ebp - 0x230]
call fcn.10003ea0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa58]
call fcn.10005e00
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa54]
call fcn.10005e00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa50]
call fcn.10005e00
push 5
push 0
lea ecx, [ebp - 0x230]
call fcn.10004390
push eax
push 0x101c7380
push 0x101c7398
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x230]
call fcn.10005e00
jmp 0x100a7ed1
push 0
push 0x101c73a4
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0xa5c]
push ecx
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0xab8], eax
mov edx, dword [ebp - 0xab8]
mov dword [ebp - 0xabc], edx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xabc]
call fcn.10004390
push eax
push 0x101c73bc
push 1
lea eax, [ebp - 0xa60]
push eax
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xac0]
mov dword [ebp - 0xac4], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0xac4]
push edx
lea eax, [ebp - 0xa64]
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xac8]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0xa64]
call fcn.10005e00
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa60]
call fcn.10005e00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa5c]
call fcn.10005e00
push str.Please_choose_Run_or_Allow_in_system_dialogs_if_asked_to_update_your_Toolbar_properly
push str.chooseRunOrAllow
mov ecx, dword [ebp + 0x18]
add ecx, 0xc4
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 0xc4]
mov edx, dword [eax + 0xb4]
call edx
push eax
lea ecx, [ebp - 0xa38]
call fcn.10005d80
mov byte [ebp - 4], 0x12
push str.Please_close_all_IE_windows_manually_and_click_OK_to_continue_r_n_or_click_cancel_to_cancel_update
push str.closeIEManually
mov ecx, dword [ebp + 0x18]
add ecx, 0xc4
mov eax, dword [ebp + 0x18]
mov edx, dword [eax + 0xc4]
mov eax, dword [edx + 0xb4]
call eax
push eax
lea ecx, [ebp - 0xa3c]
call fcn.10005d80
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xa3c]
push edx
lea eax, [ebp + 0xc]
push eax
push 1
lea ecx, [ebp - 0xa68]
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0xacc], eax
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xad0], edx
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0xad0]
push eax
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.100042a0
add esp, 0xc
mov dword [ebp - 0xad4], eax
mov edx, dword [ebp - 0xad4]
mov dword [ebp - 0xad8], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0xad8]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xa70]
push ecx
call fcn.100042a0
add esp, 0xc
mov dword [ebp - 0xadc], eax
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
push eax
push str.__s____s____s____s_
push 0x400
lea ecx, [ebp - 0xa34]
push ecx
call fcn.1017057f
add esp, 0x1c
lea ecx, [ebp - 0xa70]
call fcn.10005e00
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xa6c]
call fcn.10005e00
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa68]
call fcn.10005e00
push 0x101c75bc
push ecx
mov ecx, esp
mov dword [ebp - 0xa78], esp
push 0x101c75c0
call fcn.10005d80
mov dword [ebp - 0xae0], eax
mov edx, dword [ebp - 0xae0]
mov dword [ebp - 0xae4], edx
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0xa7c], esp
push 0x101c75c4
call fcn.10005d80
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xaec], eax
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0xa80], esp
push 0x101c75c8
call fcn.10005d80
mov dword [ebp - 0xaf0], eax
lea ecx, [ebp - 0xa84]
push ecx
mov byte [ebp - 4], 0x13
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0xaf4], eax
mov edx, dword [ebp - 0xaf4]
mov dword [ebp - 0xaf8], edx
mov eax, dword [ebp - 0xaf8]
push eax
call fcn.1000c4e0
add esp, 8
mov byte [ebp - 0xa71], al
lea ecx, [ebp - 0xa84]
call fcn.10005e00
movzx ecx, byte [ebp - 0xa71]
test ecx, ecx
je 0x100a7e59
call fcn.1014fc90
movzx edx, al
test edx, edx
je 0x100a7e59
push 0x30
push 0x101c75f0
lea ecx, [ebp - 0xa38]
call fcn.10004390
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
lea ecx, [ebp - 0x228]
call fcn.10004390
push eax
lea eax, [ebp - 0xa34]
push eax
push 0x101c7600
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0xa88]
push edx
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xafc]
call fcn.10004390
push eax
push 0x101c7618
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xa88]
call fcn.10005e00
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa3c]
call fcn.10005e00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa38]
call fcn.10005e00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.10005e00
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.100aa670
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x228]
call fcn.10005e00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.10005e00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.10005e00
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.10005e00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.10005e00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.10005e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1016f6a2
mov esp, ebp
pop ebp
ret