Function at 0x106466a
Capabilities:
Copy file

Disassembly:
push 0xc0
mov eax, 0x11ad148
call fcn.010b1478
mov ebx, dword [ebp + 8]
mov esi, ecx
lea edi, [esi + 0x9cc]
push ebx
push edi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x69], 1
call fcn.01035de1
pop ecx
pop ecx
test al, al
setne al
push ebx
mov ecx, edi
mov byte [esi + 0x9c0], al
call fcn.01038660
push 0xc
call fcn.010b0174
pop ecx
mov ecx, eax
mov dword [ebp - 0x70], ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x10646d0
push dword [esi + 0xc]
call fcn.0105ed70
jmp 0x10646d2
xor eax, eax
mov dword [ebp - 0x84], edi
cmp eax, edi
je 0x10646e2
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 1
cmp dword [0x11fc35c], edi
je 0x1064749
mov al, byte [0x11fc360]
cmp al, 4
jae 0x10646fe
test al, al
jne 0x1064749
mov eax, dword [0x11fc348]
mov ecx, dword [0x11fc34c]
mov ebx, 0x80000000
and eax, 1
and ecx, ebx
or eax, ecx
je 0x1064749
mov eax, dword [0x11fc350]
mov edi, dword [0x11fc354]
mov ecx, eax
mov edx, edi
and ecx, 1
and edx, ebx
cmp ecx, eax
jne 0x1064749
cmp edx, edi
jne 0x1064749
push 0x1001e50
push dword [0x11fc334]
push dword [0x11fc330]
call fcn.010492f6
xor eax, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
push dword [ebp - 0x8c]
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0106966a
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], edi
jne 0x106479d
mov ecx, dword [0x11fca98]
push 0x20
push 0xfffe
push 0x66
push edi
push 0xb9
mov byte [ebp - 0x69], 0
call dword [0x11fca9c]
jmp 0x1064cd8
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x958]
call fcn.010375c8
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x4c]
call fcn.01038630
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 5
call dword [eax + 8]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10647e4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ole32.dll_StgIsStorageFile]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 0x6a], bl
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x90], edi
mov byte [ebp - 4], 9
je 0x1064a99
push edi
push 0x1002f00
push 4
mov byte [ebp - 4], 0xa
call fcn.01164e5d
add esp, 0xc
cmp eax, edi
je 0x106482c
mov dword [eax], 0x10046b0
jmp 0x106482e
xor eax, eax
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.010eedab
lea eax, [ebp - 0x68]
push eax
call fcn.0115267a
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
call fcn.010375c8
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xa
call fcn.010362ea
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
jae 0x1064871
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x106487d
lea eax, [ebp - 0x2c]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x10648aa
call fcn.011565b2
push ebx
push eax
push 0x4ac
push 0x9be
push 0x100506c
push 0x10045d8
call fcn.010ae68e
push 0x1c
call fcn.010b0174
pop ecx
mov ecx, eax
mov dword [ebp - 0x70], ecx
mov byte [ebp - 4], 0xc
cmp ecx, edi
je 0x10648ca
lea eax, [ebp - 0x4c]
push eax
call fcn.01038630
jmp 0x10648cc
xor eax, eax
push eax
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0xa
call fcn.0105b3c7
push 0x1005048
lea ecx, [ebp - 0x68]
call fcn.01038fe3
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x70], esp
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.0106b632
lea eax, [ebp - 0x80]
push eax
call fcn.010b3964
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xe
call fcn.0107bc33
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0xd
call fcn.010e7ead
push edi
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xa
call fcn.010362ea
push ecx
mov eax, esp
mov dword [ebp - 0x70], esp
mov dword [eax], edi
push dword [esi + 0xc]
lea eax, [ebp - 0x70]
push eax
call fcn.0105dddc
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xf
call fcn.010eed1e
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x10
call fcn.0107bc33
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0xf
call fcn.010e7ead
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 0xa
call fcn.010e7ead
mov ecx, dword [ebp - 0x7c]
push ebx
call fcn.01048f38
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
call fcn.010b7185
mov ecx, dword [ebp - 0x7c]
push eax
mov byte [ebp - 4], 0x11
call fcn.01051c7c
test eax, eax
setne bl
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x70]
push eax
call fcn.010e7ead
test bl, bl
je 0x10649c0
mov byte [ebp - 0x69], 0
jmp 0x10649e9
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.010b6d68
push eax
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x12
call fcn.010683ac
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0xa
call fcn.01076e36
mov dword [ebp - 4], 9
jmp 0x1064a8c
cmp byte [ebp - 0x69], 0
je 0x1064c0c
mov bl, byte [ebp - 0x6a]
push ecx
push ecx
lea eax, [ebp - 0xa0]
mov ecx, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.0116000e
push ecx
push ecx
lea eax, [ebp - 0x98]
mov ecx, esp
mov dword [ebp - 0x80], esp
push eax
mov byte [ebp - 4], 0x14
call fcn.0116000e
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.0105bcc2
mov byte [ebp - 0x69], al
test al, al
je 0x1064c0c
test bl, bl
je 0x1064b38
lea eax, [ebp - 0x78]
lea edi, [esi + 0x9f8]
push eax
mov ecx, edi
call fcn.0107bc33
mov ecx, dword [edi]
lea eax, [ebp - 0x70]
push eax
call fcn.010b6e87
push eax
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 0x15
call fcn.010b7b30
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 9
call fcn.010e7ead
lea eax, [ebp - 0x7c]
push eax
lea ecx, [esi + 0x914]
call fcn.0107bc33
lea eax, [ebp - 0x90]
push eax
lea ecx, [esi + 0x974]
call fcn.010619e8
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x70], eax
xor edi, edi
lea eax, [ebp - 0x70]
inc edi
xor ebx, ebx
push eax
mov dword [esi + 0x9bc], edi
mov dword [ebp - 0x84], ebx
call fcn.010603dd
mov ecx, esi
call fcn.0106c728
push dword [ebp - 0x8c]
lea eax, [ebp - 0xc4]
push eax
mov ecx, esi
call fcn.0106966a
push eax
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.01062e21
push ebx
push edi
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 9
call fcn.010362ea
mov eax, dword [esi]
xor ecx, ecx
cmp byte [esi + 0x24], cl
push ebx
setne cl
push ecx
mov ecx, esi
call dword [eax + 0x88]
mov eax, dword [esi + 0x38]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
push 0xffffffffffffffff
push ecx
lea ecx, [esi + 0x978]
call fcn.01147bb0
mov ecx, dword [0x11fcee8]
push 0xa
call dword [0x11fceec]
lea eax, [esi + 0x958]
cmp dword [eax + 0x18], 8
jb 0x1064be2
mov eax, dword [eax + 4]
jmp 0x1064be5
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x68]
call fcn.01038fe3
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 0x17
call fcn.010ae27b
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.010362ea
lea eax, [ebp - 0x90]
push eax
call fcn.0105acf7
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 7
call fcn.010e7ead
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 4], 6
call fcn.010e7ead
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 5
call fcn.01076e36
mov dword [ebp - 4], 4
jmp 0x1064cc2
push 0
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.010362ea
cmp byte [ebp - 0x69], 0
jne 0x1064ce4
add esi, 0x914
push esi
call fcn.01184825
cmp dword [0x11fc35c], 0
je 0x1064d45
mov al, byte [0x11fc360]
cmp al, 4
jae 0x1064cfa
test al, al
jne 0x1064d45
mov eax, dword [0x11fc348]
mov ecx, dword [0x11fc34c]
mov edi, 0x80000000
and eax, 1
and ecx, edi
or eax, ecx
je 0x1064d45
mov eax, dword [0x11fc350]
mov esi, dword [0x11fc354]
mov ecx, eax
mov edx, esi
and ecx, 1
and edx, edi
cmp ecx, eax
jne 0x1064d45
cmp edx, esi
jne 0x1064d45
push 0x1002020
push dword [0x11fc334]
push dword [0x11fc330]
call fcn.010492f6
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.010362ea
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 1
call fcn.01076e36
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x84]
push eax
call fcn.010603dd
mov al, byte [ebp - 0x69]
call fcn.010b14e3
ret 4