Function at 0x1002e3a6
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
sub esp, 0x64
lea ebp, [esp - 4]
mov eax, dword [0x1006c144]
xor eax, ebp
mov dword [ebp + 0x64], eax
push 0x38
mov eax, 0x1004ff4b
call fcn.1003a593
mov esi, dword [ebp + 0x70]
mov eax, dword [ebp + 0x74]
push esi
mov dword [ebp + 0x18], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002e3de
inc eax
jmp 0x1002e6cf
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.AppData
push esi
call ebx
test eax, eax
jne 0x1002e6cc
push str.Application_Data
push esi
call ebx
test eax, eax
jne 0x1002e6cc
push 0x10056fa4
push esi
call ebx
test eax, eax
jne 0x1002e6cc
push 0x10056fa0
push esi
call ebx
test eax, eax
jne 0x1002e6cc
push esi
call fcn.10001b77
mov dword [ebp + 0x1c], eax
mov edi, edx
call fcn.1002db9a
mov dword [ebp + 0x28], edx
cdq
cmp edi, edx
jb 0x1002e44a
ja 0x1002e443
cmp dword [ebp + 0x1c], eax
jbe 0x1002e44a
push 2
jmp 0x1002e6ce
xor ebx, ebx
cmp byte [ebp + 0x78], bl
je 0x1002e463
push esi
call fcn.1002e2c8
pop ecx
test al, al
jne 0x1002e463
push 3
jmp 0x1002e6ce
push ebx
lea ecx, [ebp + 0x2c]
mov dword [ebp + 0x44], 0xf
call fcn.10006679
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x48]
push esi
push eax
mov dword [ebp - 4], ebx
call fcn.1002b0b2
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [ebp + 0x5c], ebx
jne 0x1002e4b0
push 5
pop esi
push ebx
push 1
lea ecx, [ebp + 0x48]
call fcn.10005a9d
push ebx
push 1
lea ecx, [ebp + 0x2c]
call fcn.1000588b
mov eax, esi
jmp 0x1002e6cf
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x1002e4bc
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002e4cb
push 7
jmp 0x1002e492
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x1002e4d7
lea eax, [ebp + 0x4c]
push ebx
push ebx
push eax
call fcn.10001a23
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x1002e4eb
lea eax, [ebp + 0x4c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1002e50f
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x1002e504
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
jmp 0x1002e492
push esi
call fcn.1002e0f7
mov eax, dword [ebp + 0x28]
cdq
pop ecx
cmp edi, edx
ja 0x1002e538
jb 0x1002e525
cmp dword [ebp + 0x1c], eax
jae 0x1002e538
cmp dword [ebp + 0x60], 8
mov edx, dword [ebp + 0x4c]
jae 0x1002e531
lea edx, [ebp + 0x4c]
mov ecx, esi
call fcn.1002d352
push str.RecordBackupLog
call fcn.1001df7d
pop ecx
test eax, eax
je 0x1002e6b1
push ebx
lea ecx, [ebp]
call fcn.1000f4f5
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10004b35
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 3
call fcn.1000ab65
sub esp, 0x10
mov ecx, esp
mov dword [ebp + 0x28], esp
push eax
mov byte [ebp - 4], 4
call fcn.1000f6a5
push str.file_path
lea ecx, [ebp]
mov byte [ebp - 4], 5
call fcn.1001093c
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1000f908
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x44]
call fcn.1000588b
push ebx
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10005a9d
push edi
push dword [ebp + 0x1c]
lea eax, [ebp - 0x44]
push eax
call fcn.10002a8b
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 0x28], esp
push eax
mov byte [ebp - 4], 6
call fcn.1000f6a5
push str.file_size
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.1001093c
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.1000f908
push ebx
push esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.1000588b
sub esp, 0x18
lea eax, [ebp + 0x2c]
mov ecx, esp
mov dword [ebp + 0x28], esp
push eax
call fcn.1000f6a5
push str.data_time
lea ecx, [ebp]
mov byte [ebp - 4], 8
call fcn.1001093c
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1000f908
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
call fcn.10004b35
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 9
call fcn.1000ab65
sub esp, 0x10
mov ecx, esp
mov dword [ebp + 0x28], esp
push eax
mov byte [ebp - 4], 0xa
call fcn.1000f6a5
push str.reason
lea ecx, [ebp]
mov byte [ebp - 4], 0xb
call fcn.1001093c
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.1000f908
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.1000588b
push ebx
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10005a9d
push esi
push ebx
lea eax, [ebp]
push eax
push str.t_backup_log
call fcn.100197b7
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.1000f883
jmp 0x1002e6b4
xor esi, esi
inc esi
push ebx
push esi
lea ecx, [ebp + 0x48]
call fcn.10005a9d
push ebx
push esi
lea ecx, [ebp + 0x2c]
call fcn.1000588b
xor eax, eax
jmp 0x1002e6cf
push 6
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
call fcn.1003a584
add ebp, 0x68
leave
ret