Function at 0x100020b0
Capabilities:
Copy file
Delete file
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xfffffffffffffffe
push 0x10016c30
push 0x100097a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1001803c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x4c], eax
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x100022e8
push 0x10
push 0x10
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100022e8
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [ebp - 0x40], edi
test edi, edi
je 0x100022e8
mov ecx, dword [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x38], eax
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x100022e8
mov edx, eax
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x34], eax
push 0xf00021
push 0x10
push 0x10
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_PatBlt]
mov edx, esi
call fcn.10005cb0
mov dword [ebp - 0x44], eax
push eax
mov ebx, 0x10015fbc
call fcn.10006050
add esp, 4
test eax, eax
jne 0x10002246
mov eax, dword [ebp - 0x44]
push eax
mov ebx, 0x10015fc0
call fcn.10006050
add esp, 4
test eax, eax
jne 0x10002246
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xa00000
jbe 0x100021fa
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x1001803c
call fcn.1000d738
add esp, 0xc
xor eax, eax
jmp 0x100022f7
mov edx, esi
call fcn.10005e20
push eax
push 0x1001a0e8
push 0x10015fc4
mov ecx, 0x104
lea ebx, [ebp]
call fcn.10001120
add esp, 0xc
push 0
mov eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
mov edx, ebx
push edx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10002257
push 1
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
push esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 3
push 0
push 0
push 0x10
push 0x10
mov edx, dword [ebp - 0x24]
push edx
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
or esi, 0xffffffff
mov dword [ebp - 0x1c], esi
mov ecx, 1
mov dword [ebp - 0x30], ecx
cmp ecx, 0x10
jg 0x100022d6
mov eax, 1
mov dword [ebp - 0x3c], eax
cmp eax, 0x10
jg 0x100022d3
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
mov edx, 1
mov dword [ebp - 0x48], edx
cmp edx, 3
jg 0x100022ca
movzx ecx, al
sub eax, ecx
shr eax, 8
mov ebx, esi
and ebx, 0xff
xor ebx, ecx
shr esi, 8
mov ecx, dword [0x1001a484]
xor esi, dword [ecx + ebx*4]
mov dword [ebp - 0x1c], esi
inc edx
jmp 0x1000229e
mov eax, dword [ebp - 0x3c]
inc eax
mov ecx, dword [ebp - 0x30]
jmp 0x10002288
inc ecx
jmp 0x1000227b
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
not esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xfffffffe
call fcn.10002322
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.100065f6
add ebp, 0x20c
mov esp, ebp
pop ebp
ret