Function at 0x10067f5
Capabilities:
Copy file
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10a8
call fcn.01007460
mov eax, dword [0x1009428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
xor edi, edi
push 0x7fe
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push edi
push eax
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1038], edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push esi
push dword [ebp + 8]
call fcn.0100620c
push 0x40
lea eax, [ebp - 0x10a8]
push edi
push eax
mov dword [ebp - 0x1020], edi
mov dword [ebp - 0x1028], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x1040], ebx
mov dword [ebp - 0x103c], 0x18
mov dword [ebp - 0x102c], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1034], edi
cmp dword [0x10091c8], edi
jne 0x10068aa
mov dword [ebp - 0x1018], 0xe
jmp 0x100702e
cmp dword [0x10090c8], edi
je 0x10068fa
cmp dword [0x10093c8], edi
jne 0x10068fa
push dword [0x1009248]
mov dword [ebp - 0x1034], ebx
push 6
call fcn.0100517c
mov dword [ebp - 0x1018], eax
cmp eax, edi
jne 0x1006ff3
push 0x400
lea eax, [ebp - 0x1014]
push eax
call fcn.01004b99
mov dword [ebp - 0x1018], eax
cmp eax, edi
jne 0x1006ff3
lea eax, [ebp - 0x1024]
push eax
push dword [0x1009188]
call fcn.01002121
mov dword [ebp - 0x1018], eax
cmp eax, edi
jne 0x1006ff3
movzx eax, word [0x1009460]
mov esi, dword [0x10091c8]
push 0x2bc
push eax
call fcn.01003284
movzx eax, word [0x1009460]
push 0x2bf
push eax
call fcn.01003284
add esp, 0x10
jmp 0x10069ea
cmp word [esi], di
je 0x10069f2
lea eax, [ebp - 0x1038]
push eax
push esi
call sub.pdh.dll_PdhGetLogFileTypeW
inc dword [ebp - 0xc]
mov dword [ebp - 0x101c], eax
cmp eax, edi
je 0x1006975
mov dword [ebp - 0x1038], edi
mov eax, dword [ebp - 0x1038]
dec eax
push esi
je 0x10069be
dec eax
je 0x10069b7
dec eax
je 0x10069b0
sub eax, 3
je 0x10069a9
dec eax
dec eax
movzx eax, word [0x1009460]
je 0x100699c
push 0x2c8
jmp 0x10069ca
inc dword [ebp - 0x102c]
push 0x2c6
jmp 0x10069ca
push 0x2c7
jmp 0x10069c3
push 0x2c3
jmp 0x10069c3
push 0x2c5
jmp 0x10069c3
push 0x2c4
movzx eax, word [0x1009460]
push eax
call fcn.01003284
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10069d8
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jne 0x100694c
movzx eax, word [0x1009460]
push 0x1001330
push eax
call fcn.010029a4
mov eax, dword [ebp - 0xc]
cmp eax, 1
pop ecx
pop ecx
jle 0x1006a25
cmp eax, dword [ebp - 0x102c]
jle 0x1006a25
mov dword [ebp - 0x1018], 0xf0000001
jmp 0x1006ff3
push dword [0x10091c8]
lea eax, [ebp - 0x1020]
push eax
call sub.pdh.dll_PdhBindInputDataSourceW
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
lea eax, [ebp - 0x1028]
push eax
push edi
push dword [ebp - 0x1020]
call sub.pdh.dll_PdhOpenQueryH
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x1040]
push eax
push dword [ebp - 0x1020]
call sub.pdh.dll_PdhGetDataSourceTimeRangeH
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1068]
push eax
call ebx
movzx eax, word [0x1009460]
push 0x2c0
push eax
call fcn.01003284
pop ecx
pop ecx
lea eax, [ebp - 0x1050]
push eax
call fcn.01004b14
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1060]
push eax
call ebx
movzx eax, word [0x1009460]
push 0x2c1
push eax
call fcn.01003284
pop ecx
pop ecx
lea eax, [ebp - 0x1050]
push eax
call fcn.01004b14
push dword [ebp - 0x1058]
movzx eax, word [0x1009460]
push 0x2c2
push eax
call fcn.01003284
add esp, 0xc
cmp dword [0x1009358], edi
jne 0x1006cfa
cmp dword [0x1009258], edi
je 0x1006ff3
cmp dword [0x1009118], edi
jne 0x1006b65
cmp dword [0x1009158], edi
jne 0x1006b8e
push edi
push dword [ebp - 0x1028]
push dword [ebp - 0x1020]
call fcn.01004c46
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
cmp dword [0x1009118], edi
je 0x1006b86
push dword [ebp - 0x1028]
push dword [ebp - 0x1020]
push 1
call fcn.01002442
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
cmp dword [0x1009158], edi
je 0x1006baf
push dword [ebp - 0x1028]
push dword [ebp - 0x1020]
push 1
call fcn.010024b8
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp dword [0x1009298], edi
je 0x1006c0b
lea eax, [ebp - 0x1030]
push eax
push 0x1009288
call esi
mov eax, dword [ebp - 0x102c]
cmp eax, dword [ebp - 0x105c]
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x1098], ecx
mov dword [ebp - 0x1094], eax
jl 0x1006bff
jg 0x1006bf5
cmp ecx, dword [ebp - 0x1060]
jb 0x1006bff
mov dword [ebp - 0x1018], 0xf0000003
cmp dword [ebp - 0x1018], edi
jne 0x1006ff3
cmp dword [0x10092d8], edi
je 0x1006c61
lea eax, [ebp - 0x1030]
push eax
push 0x10092c8
call esi
mov eax, dword [ebp - 0x102c]
cmp eax, dword [ebp - 0x1064]
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x1090], ecx
mov dword [ebp - 0x108c], eax
jg 0x1006c55
jl 0x1006c4b
cmp ecx, dword [ebp - 0x1068]
ja 0x1006c55
mov dword [ebp - 0x1018], 0xf0000003
cmp dword [ebp - 0x1018], edi
jne 0x1006ff3
cmp dword [0x1009258], edi
je 0x1006ff3
cmp dword [0x1009358], edi
jne 0x1006ff3
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x10a4], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x814]
push eax
push esi
lea eax, [ebp - 0x614]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push dword [0x1009248]
call sub.msvcrt.dll__wsplitpath_s
lea eax, [ebp - 0x20c]
add esp, 0x24
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1006cbf
sub eax, edx
sar eax, 1
jne 0x1006d9b
mov eax, dword [ebp - 0x10a4]
dec eax
je 0x1006d89
dec eax
je 0x1006d82
sub eax, 6
jne 0x1006d9b
push 0x1001780
jmp 0x1006d8e
xor esi, esi
cmp dword [0x1009258], edi
je 0x1006d55
xor eax, eax
cmp dword [0x1009388], edi
sete al
lea eax, [eax*4 + 1]
push eax
push dword [0x1009248]
call fcn.010060f2
mov dword [ebp - 0x1018], eax
cmp eax, edi
jne 0x1006ff3
push 0x100177c
push dword [0x1009248]
call dword [sym.imp.msvcrt.dll__wfopen]
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
jne 0x1006d55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1018], eax
push esi
push dword [ebp - 0x1028]
push dword [ebp - 0x1020]
call fcn.01004c46
mov dword [ebp - 0x101c], eax
cmp esi, edi
je 0x1006b5d
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
jmp 0x1006b5d
push 0x1001774
jmp 0x1006d8e
push 0x100176c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100262c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call sub.msvcrt.dll__wmakepath_s
add esp, 0x18
cmp dword [ebp - 0x1024], 7
je 0x1006e09
cmp dword [0x10090d8], edi
je 0x1006ddc
push edi
jmp 0x1006def
xor eax, eax
cmp dword [0x1009388], edi
sete al
lea eax, [eax*4 + 1]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010060f2
mov dword [ebp - 0x1018], eax
cmp eax, edi
jne 0x1006ff3
mov dword [ebp - 0x10a0], 0x20002
cmp dword [0x10090c8], edi
je 0x1006e7b
cmp dword [0x10093c8], edi
je 0x1006e7b
cmp dword [ebp - 0x1024], 7
je 0x1006e7b
cmp dword [ebp - 0x1024], 8
je 0x1006e44
mov dword [ebp - 0x1018], 0xf0000004
jmp 0x1006ff3
lea eax, [ebp - 0x1024]
push eax
push dword [0x1009248]
call sub.pdh.dll_PdhGetLogFileTypeW
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
cmp dword [ebp - 0x1024], 8
jne 0x100703e
or dword [ebp - 0x10a0], 0x8000000
lea eax, [ebp - 0x1014]
cmp dword [ebp - 0x1034], edi
jne 0x1006e8f
lea eax, [ebp - 0x414]
fldz
push ecx
push ecx
fstp qword [esp]
mov dword [ebp - 0x10a8], eax
mov eax, dword [0x1009208]
push edi
mov dword [ebp - 0x1078], fcn.01004b32
mov dword [ebp - 0x1088], eax
call fcn.01004b32
lea eax, [ebp - 0x10a8]
push eax
push dword [ebp - 0x1020]
call sub.pdh.dll_PdhRelogW
mov dword [ebp - 0x101c], eax
cmp eax, edi
jne 0x1006ff3
fld1
push ecx
push ecx
fstp qword [esp]
push edi
call fcn.01004b32
movzx eax, word [0x1009460]
push 0x1001764
push eax
call fcn.010029a4
pop ecx
pop ecx
cmp dword [ebp - 0x1034], edi
je 0x1006f4b
push edi
push dword [0x1009248]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, edi
jne 0x1006f33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], edi
jne 0x1006ff3
lea eax, [ebp - 0x414]
mov dword [ebp - 0x10a8], eax
movzx eax, word [0x1009460]
push 0x2bd
push eax
call fcn.01003284
push dword [ebp - 0x10a8]
movzx eax, word [0x1009460]
push 0x2be
push eax
call fcn.01003284
add esp, 0x14
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1098]
push eax
call ebx
movzx eax, word [0x1009460]
push 0x2c0
push eax
call fcn.01003284
pop ecx
pop ecx
lea eax, [ebp - 0x1050]
push eax
call fcn.01004b14
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1090]
push eax
call ebx
movzx eax, word [0x1009460]
push 0x2c1
push eax
call fcn.01003284
pop ecx
pop ecx
lea eax, [ebp - 0x1050]
push eax
call fcn.01004b14
push dword [ebp - 0x1088]
movzx eax, word [0x1009460]
push 0x2c2
push eax
call fcn.01003284
add esp, 0xc
cmp dword [ebp - 0x1020], edi
je 0x1007008
push 1
push dword [ebp - 0x1020]
call sub.pdh.dll_PdhCloseLog
mov eax, dword [ebp - 0x1018]
cmp eax, edi
je 0x100707c
cmp eax, 0xf0000001
je 0x1007075
cmp eax, 0xf0000002
je 0x1007058
cmp eax, 0xf0000003
je 0x100704a
cmp eax, 0xf0000004
je 0x1007058
push dword [ebp - 0x1018]
call fcn.010061f2
jmp 0x10070d1
mov dword [ebp - 0x101c], 0xc0000bca
jmp 0x1006ff3
push 0x2cb
movzx eax, word [0x1009454]
jmp 0x1007092
push dword [0x1009188]
movzx eax, word [0x1009454]
push 0x2ca
push eax
call fcn.01003284
add esp, 0xc
jmp 0x10070d1
push 0x2c9
jmp 0x100704f
mov esi, dword [ebp - 0x101c]
cmp esi, edi
jne 0x100709a
movzx eax, word [0x1009460]
push 0x23b
push eax
call fcn.01003284
jmp 0x10070cf
cmp esi, 0xc0000be0
jl 0x10070be
cmp esi, 0xc0000be7
jg 0x10070be
movzx eax, word [0x1009454]
push 0x2cc
push eax
call fcn.01003284
jmp 0x10070c9
push 0x1001754
push esi
call fcn.01004894
mov dword [ebp - 0x1018], esi
pop ecx
pop ecx
call fcn.01001dac
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1018]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100741c
leave
ret