Function at 0x1000bdde
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x100d5cb6
call fcn.100ac440
sub esp, 0x1e8
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
lea ecx, [ebp - 0x88]
call fcn.100c787c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ebx, ebx
push ebx
push 0x4040
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], ebx
call fcn.100c7892
test eax, eax
jne 0x1000be27
xor esi, esi
inc esi
jmp 0x1000becd
lea ecx, [ebp - 0x88]
call fcn.100c7b33
cmp eax, ebx
jg 0x1000be43
lea ecx, [ebp - 0x88]
call fcn.100c7c15
jmp 0x1000be1f
lea esi, [eax + 1]
push esi
call fcn.100c6c30
push esi
mov edi, eax
push ebx
push edi
mov dword [ebp + 8], edi
call fcn.100ab720
add esp, 0x10
push esi
push edi
lea ecx, [ebp - 0x88]
call fcn.100c79a8
lea ecx, [ebp - 0x88]
call fcn.100c7c15
lea ecx, [ebp - 0x74]
call fcn.10008ed3
push ebx
push edi
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.1005209b
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x1000beb1
lea ecx, [eax + 0x10]
push str.codecs
call fcn.100083f3
test eax, eax
jne 0x1000beb1
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x4c]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [ebp - 0x38], ecx
jne 0x1000bef2
cmp dword [ebp + 8], ebx
je 0x1000bebf
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
xor esi, esi
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0
call fcn.10050485
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.100c7c51
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
cmp eax, dword [edx + 0x250]
jne 0x1000c7d2
mov eax, dword [ecx + 8]
cmp dword [eax + 4], 5
jne 0x1000c7b7
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 3
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x38]
mov esi, dword [eax + 8]
push 0x100e39a4
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 5
mov dword [ebp - 0x64], esi
call fcn.100083f3
test eax, eax
jne 0x1000c78d
push str.name
lea eax, [ebp - 0x168]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 6
jb 0x1000bfac
mov eax, dword [eax + 4]
jmp 0x1000bfaf
add eax, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.10001f92
push 0
push 1
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 5
call fcn.100017d0
lea ecx, [ebp - 0x18]
call fcn.100043b6
lea ecx, [ebp - 0x18]
call fcn.1000436c
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call fcn.10008590
test al, al
pop ecx
pop ecx
jne 0x1000c78d
push str.dest
lea eax, [ebp - 0xa4]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 7
jb 0x1000c013
mov eax, dword [eax + 4]
jmp 0x1000c016
add eax, 4
push eax
lea ecx, [ebp - 0x30]
call fcn.10001f92
push 0
push 1
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 5
call fcn.100017d0
mov eax, dword [ebp - 0x30]
cmp dword [eax - 0xc], 0
je 0x1000c049
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.1000a46f
jmp 0x1000c058
mov eax, dword [ebp - 0x10]
add eax, 0x64
push eax
lea ecx, [ebp - 0x30]
call fcn.10001eb6
push str.flag
lea eax, [ebp - 0xf8]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 8
jb 0x1000c07a
mov eax, dword [eax + 4]
jmp 0x1000c07d
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xa
call fcn.100017d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax]
cmp ecx, eax
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
je 0x1000c782
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
cmp eax, dword [ecx + 0x250]
jne 0x1000c7eb
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], 0
je 0x1000c132
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push ebx
push 0x100e3bf4
push eax
mov byte [ebp - 4], 0xb
call fcn.10001d75
mov esi, dword [ebp - 0x1c]
push 4
push esi
call fcn.100ad0b7
add esp, 0x18
test eax, eax
jne 0x1000c830
mov ecx, dword [ebp - 0x10]
push esi
call fcn.10008f06
cmp dword [ebp + 8], 0
je 0x1000c124
push dword [ebp + 8]
call fcn.100c6c35
and dword [ebp + 8], 0
pop ecx
add esi, 0xfffffff0
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.10001199
mov eax, dword [ebp - 0x3c]
mov edi, dword [eax + 8]
cmp dword [edi + 4], 5
mov dword [ebp - 0x54], edi
jne 0x1000c76b
lea esi, [edi + 0x10]
push str.file
mov ecx, esi
call fcn.100083f3
test eax, eax
jne 0x1000c39d
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx]
cmp eax, ecx
jmp 0x1000c38f
mov esi, dword [eax + 8]
cmp dword [esi + 4], 5
mov dword [ebp - 0x20], esi
jne 0x1000c38a
push str.name
lea eax, [ebp - 0x1d8]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0xc
jb 0x1000c19a
mov eax, dword [eax + 4]
jmp 0x1000c19d
add eax, 4
push eax
lea ecx, [ebp - 0x28]
call fcn.10001f92
push 0
push 1
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0xa
call fcn.100017d0
push str.dest
lea eax, [ebp - 0x130]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0xd
jb 0x1000c1db
mov eax, dword [eax + 4]
jmp 0x1000c1de
add eax, 4
push eax
lea ecx, [ebp - 0x14]
call fcn.10001f92
push 0
push 1
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xa
call fcn.100017d0
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0xe
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 0xf
jne 0x1000c23e
mov eax, dword [ebp - 0x10]
add eax, 0x64
push eax
lea ecx, [ebp - 0x14]
call fcn.10001eb6
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.1000a46f
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
push 0x100e3bf4
push eax
call fcn.10001d75
mov esi, dword [ebp - 0x1c]
push 4
push esi
call fcn.100ad0b7
add esp, 0x18
test eax, eax
jne 0x1000c880
mov ecx, dword [ebp - 0x10]
push esi
call fcn.10008f06
mov ecx, dword [ebp - 0x20]
push str.change
lea eax, [ebp - 0x1a0]
push eax
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
jb 0x1000c29c
mov eax, dword [eax + 4]
jmp 0x1000c29f
add eax, 4
push eax
call fcn.100ad185
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x20], eax
call fcn.100017d0
cmp dword [ebp - 0x20], 0
je 0x1000c36e
push str.cook
push dword [ebp - 0x28]
call fcn.100ace10
test eax, eax
pop ecx
pop ecx
jne 0x1000c36e
mov ecx, dword [ebp - 0x10]
call fcn.1000b6f5
cmp eax, 0x177e
jne 0x1000c36e
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x10
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x60], eax
mov edi, dword [ebp - 0x10]
push dword [edi + 0x78]
lea eax, [ebp - 0x20]
push str._scook.dll
push eax
mov byte [ebp - 4], 0x11
call fcn.10001d75
push dword [edi + 0x78]
lea eax, [ebp - 0x60]
push str._scook.dll.bak
push eax
call fcn.10001d75
mov ebx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x20]
add esp, 0x18
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebx - 0x10]
call fcn.10001199
lea ecx, [edi - 0x10]
call fcn.10001199
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x44]
add esi, 0xfffffff0
mov ecx, esi
call fcn.10001199
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0xa
call fcn.10001199
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [edi + 0x4c]
mov dword [ebp - 0x24], eax
jne 0x1000c168
jmp 0x1000c76b
push 0x100e3bbc
mov ecx, esi
call fcn.100083f3
test eax, eax
jne 0x1000c50c
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx]
cmp eax, ecx
jmp 0x1000c4fe
mov esi, dword [eax + 8]
cmp dword [esi + 4], 5
jne 0x1000c4f9
push str.name
lea eax, [ebp - 0xc0]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x12
jb 0x1000c3ec
mov eax, dword [eax + 4]
jmp 0x1000c3ef
add eax, 4
push eax
lea ecx, [ebp - 0x40]
call fcn.1000223a
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x14
call fcn.100017d0
push str.dest
lea eax, [ebp - 0xdc]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x15
jb 0x1000c42e
mov eax, dword [eax + 4]
jmp 0x1000c431
add eax, 4
push eax
lea ecx, [ebp - 0x34]
call fcn.1000223a
push edi
push 1
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x17
call fcn.100017d0
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], edi
jne 0x1000c463
mov eax, dword [ebp - 0x10]
add eax, 0x64
push eax
lea ecx, [ebp - 0x34]
call fcn.10001eb6
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push eax
call fcn.1000a46f
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 0x18
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x20]
push dword [ebp - 0x34]
mov byte [ebp - 4], 0x19
push 0x100e3bf4
push eax
call fcn.10001d75
mov edi, dword [ebp - 0x20]
push 4
push edi
call fcn.100ad0b7
add esp, 0x18
test eax, eax
jne 0x1000c89c
add edi, 0xfffffff0
mov ecx, edi
call fcn.10001199
add esi, 0xfffffff0
mov ecx, esi
call fcn.10001199
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.10001199
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [edi + 0x4c]
mov dword [ebp - 0x24], eax
jne 0x1000c3bd
jmp 0x1000c76b
push 0x100e3bb8
mov ecx, esi
call fcn.100083f3
test eax, eax
jne 0x1000c6d1
mov eax, dword [edi + 0x4c]
mov ecx, dword [eax]
cmp ecx, eax
jmp 0x1000c6c3
mov esi, dword [ecx + 8]
cmp dword [esi + 4], 5
jne 0x1000c6be
push str.name
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x1a
jb 0x1000c55b
mov eax, dword [eax + 4]
jmp 0x1000c55e
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x1c
call fcn.100017d0
push str.keyroot
lea eax, [ebp - 0x14c]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x1d
jb 0x1000c59c
mov eax, dword [eax + 4]
jmp 0x1000c59f
add eax, 4
push eax
lea ecx, [ebp - 0x58]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0x1f
call fcn.100017d0
push str.keypath
lea eax, [ebp - 0x184]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x20
jb 0x1000c5dd
mov eax, dword [eax + 4]
jmp 0x1000c5e0
add eax, 4
push eax
lea ecx, [ebp - 0x5c]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x22
call fcn.100017d0
push str.keyname
lea eax, [ebp - 0x1bc]
push eax
mov ecx, esi
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x23
jb 0x1000c61e
mov eax, dword [eax + 4]
jmp 0x1000c621
add eax, 4
push eax
lea ecx, [ebp - 0x50]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x25
call fcn.100017d0
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
push ebx
push 0x100e3bf4
push eax
mov byte [ebp - 4], 0x26
call fcn.10001d75
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000909d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x5c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.10001199
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
cmp ecx, dword [edi + 0x4c]
mov dword [ebp - 0x24], ecx
jne 0x1000c52c
jmp 0x1000c76b
push str.regfile
mov ecx, esi
call fcn.100083f3
test eax, eax
jne 0x1000c76b
mov eax, dword [edi + 0x4c]
mov esi, dword [eax]
cmp esi, eax
je 0x1000c76b
mov ecx, dword [esi + 8]
cmp dword [ecx + 4], 5
jne 0x1000c764
push str.name
lea eax, [ebp - 0x1f4]
push eax
call fcn.1005077e
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x27
jb 0x1000c717
mov eax, dword [eax + 4]
jmp 0x1000c71a
add eax, 4
push eax
lea ecx, [ebp - 0x4c]
call fcn.1000223a
push 0
push 1
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 0x29
call fcn.100017d0
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.10001da8
mov ecx, dword [ebp - 0x10]
add esp, 0xc
call fcn.10009b6f
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.10001199
mov esi, dword [esi]
cmp esi, dword [edi + 0x4c]
jne 0x1000c6ee
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
cmp eax, dword [ecx + 0x4c]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
jne 0x1000c0ac
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [ebx - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [edi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.10001199
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x74]
cmp eax, dword [ecx + 0x4c]
mov dword [ebp - 0x38], eax
jne 0x1000beef
xor ebx, ebx
jmp 0x1000beb1
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1000bec1
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
jmp 0x1000bec1
cmp dword [ebp + 8], 0
je 0x1000c7fa
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [ebx - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [edi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001199
jmp 0x1000bebf
cmp dword [ebp + 8], 0
je 0x1000c83f
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
lea ecx, [esi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [ebx - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [edi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001199
xor esi, esi
inc esi
jmp 0x1000bec1
cmp dword [ebp + 8], 0
je 0x1000c88f
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
lea ecx, [esi - 0x10]
call fcn.10001199
lea ecx, [edi - 0x10]
jmp 0x1000c8cc
cmp dword [ebp + 8], 0
je 0x1000c8ab
push dword [ebp + 8]
call fcn.100c6c35
pop ecx
lea ecx, [edi - 0x10]
call fcn.10001199
lea ecx, [esi - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.10001199
lea ecx, [ebx - 0x10]
call fcn.10001199
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
jmp 0x1000c868