Function at 0x1004e2d7
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x100d0e24
call fcn.10030644
sub esp, 0x830
push ebx
xor ebx, ebx
cmp dword [0x1010f69c], ebx
push esi
push edi
mov edi, ecx
je 0x1004e2fb
call fcn.1004e273
push 0x800
lea eax, [ebp - 0x83c]
push ebx
push eax
call fcn.10031000
add esp, 0xc
lea eax, [ebp - 0x83c]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
call fcn.10031fe6
push eax
call fcn.10031fb7
mov al, byte [ebp - 0xd]
mov esi, dword [str.8dfhost]
pop ecx
mov byte [ebp - 0x20], al
pop ecx
push ebx
lea ecx, [ebp - 0x20]
call fcn.10002424
push esi
call fcn.10030730
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.100036bc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push str.PPw2Nde7_2PB5p0UVZlYDA
call fcn.10003536
and byte [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.1006603f
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x1004e393
mov eax, 0x100d6d1c
push eax
lea ecx, [ebp - 0x2c]
call fcn.10002736
mov eax, dword [eax]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x1004e3aa
mov eax, dword [eax]
jmp 0x1004e3ac
xor eax, eax
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x28]
push str._s_s.dll
push eax
call fcn.100598b6
add esp, 0x10
mov esi, eax
mov eax, dword [esi]
mov byte [ebp - 4], 4
test eax, eax
lea ebx, [edi + 0x3628]
je 0x1004e3e1
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, ebx
call fcn.1000278a
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
mov dword [ebx], eax
mov byte [ebp - 4], 3
call fcn.1000278a
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x1004e40c
call fcn.10002801
and dword [ebp - 0x2c], 0
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10002424
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.10002424
call fcn.10031fc4
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x28]
push str._s_d.tmp
push eax
call fcn.100598b6
add esp, 0x10
mov esi, eax
mov eax, dword [esi]
mov dword [ebp - 4], 5
test eax, eax
lea ebx, [edi + 0x362c]
je 0x1004e465
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, ebx
call fcn.1000278a
mov ecx, dword [ebp - 0x28]
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
test ecx, ecx
je 0x1004e480
call fcn.10002801
mov eax, dword [ebx]
test eax, eax
je 0x1004e48a
mov ecx, dword [eax]
jmp 0x1004e48c
xor ecx, ecx
mov eax, dword [edi + 0x3628]
test eax, eax
je 0x1004e49a
mov eax, dword [eax]
jmp 0x1004e49c
xor eax, eax
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1004e68b
mov ebx, dword [ebx]
test ebx, ebx
je 0x1004e4b8
mov ebx, dword [ebx]
jmp 0x1004e4ba
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [edi + 0x3630], eax
je 0x1004e68b
mov al, byte [ebp - 0xd]
mov esi, dword [str.8dfhost]
push 0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call fcn.10002424
push esi
call fcn.10030730
pop ecx
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.100036bc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push str.TDXJN_cBFW8h1HEYMcqMC_wVtO7ye5HZ
call fcn.10003536
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 6
push eax
call fcn.1006603f
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [ebp - 4], 8
test eax, eax
jne 0x1004e537
mov eax, 0x100d6d1c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [edi + 0x3630]
call esi
mov dword [0x1010f690], eax
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
call fcn.10002424
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.10002424
mov al, byte [ebp - 0xd]
mov ebx, dword [str.8dfhost]
push 0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call fcn.10002424
push ebx
call fcn.10030730
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.100036bc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 9
push eax
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push str.jjXLHLwR7Joh1HEYMcqMC_wVtO7ye5HZ
call fcn.10003536
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 9
push eax
call fcn.1006603f
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xb
test eax, eax
jne 0x1004e5cf
mov eax, 0x100d6d1c
push eax
push dword [edi + 0x3630]
call esi
mov dword [0x1010f694], eax
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.10002424
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.10002424
mov al, byte [ebp - 0xd]
mov ebx, dword [str.8dfhost]
push 0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x20], al
call fcn.10002424
push ebx
call fcn.10030730
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.100036bc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push str.AYMCkyCI_tHB5p0UVZlYDA
call fcn.10003536
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
push eax
call fcn.1006603f
add esp, 0x18
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x1004e661
mov eax, 0x100d6d1c
push eax
push dword [edi + 0x3630]
call esi
mov dword [0x1010f69c], eax
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
call fcn.10002424
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.10002424
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [0x1010f69c], eax
pop edi
pop esi
mov dword fs:[0], ecx
setne al
pop ebx
leave
ret