Function at 0x1001a880
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0xc3c
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0xc34], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x16]
push ebx
push eax
mov edi, ecx
mov word [esp + 0x1c], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0x21e]
push ebx
push ecx
mov word [esp + 0x224], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x426]
push ebx
push edx
mov word [esp + 0x42c], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea eax, [esp + 0x62e]
push ebx
push eax
mov word [esp + 0x634], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0xa3e]
push ebx
push ecx
mov word [esp + 0xa44], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x836]
push ebx
push edx
mov word [esp + 0x83c], bx
call fcn.1003d360
add esp, 0xc
cmp dword [edi], ebx
jne 0x1001a953
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001a962
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0x628]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
jmp 0x1001a980
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a9a0
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a9a0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a980
jmp 0x1001a9a4
cmp edx, ebx
jne 0x1001a9a7
sub eax, 2
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [esp + 0x628]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x628]
cmp word [eax], bx
je 0x1001a9d5
add eax, 2
sub ecx, 1
jne 0x1001a9c6
jmp 0x1001a9f8
cmp ecx, ebx
je 0x1001a9f8
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x628]
mov eax, str.WindowsSystem32dllcache
call fcn.100067e0
cmp dword [edi], ebx
jne 0x1001aa01
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001aa10
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0x830]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001aa50
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001aa50
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001aa30
jmp 0x1001aa54
cmp edx, ebx
jne 0x1001aa57
sub eax, 2
lea edx, [esp + 0x830]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x830]
cmp word [eax], bx
je 0x1001aa7f
add eax, 2
sub ecx, 1
jne 0x1001aa70
jmp 0x1001aaa2
cmp ecx, ebx
je 0x1001aaa2
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x830]
mov eax, str.Windowswinsxs
call fcn.100067e0
cmp dword [edi], ebx
jne 0x1001aaab
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001aaba
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0xa38]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001aaf3
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001aaf3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001aad3
jmp 0x1001aaf7
cmp edx, ebx
jne 0x1001aafa
sub eax, 2
lea edx, [esp + 0xa38]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0xa38]
cmp word [eax], bx
je 0x1001ab22
add eax, 2
sub ecx, 1
jne 0x1001ab13
jmp 0x1001ab45
cmp ecx, ebx
je 0x1001ab45
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0xa38]
mov eax, str.WindowsSystem32DriverStoreFileRepository
call fcn.100067e0
cmp dword [edi], ebx
jne 0x1001ab4e
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001ab5d
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0x10]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001ab93
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001ab93
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ab73
jmp 0x1001ab97
cmp edx, ebx
jne 0x1001ab9a
sub eax, 2
lea edx, [esp + 0x10]
push edx
mov word [eax], bx
call ebp
cmp dword [edi], ebx
jne 0x1001abad
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001abbc
call fcn.1003c54f
mov eax, dword [edi + 4]
mov edx, 0x104
lea ecx, [esp + 0x10]
cmp word [ecx], bx
je 0x1001abd7
add ecx, 2
sub edx, 1
jne 0x1001abc8
jmp 0x1001abf2
cmp edx, ebx
je 0x1001abf2
mov ecx, 0x104
sub ecx, edx
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0x10]
call fcn.100067e0
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.1003ca7d
add esp, 8
cmp eax, ebx
mov edx, 0x104
lea ecx, [esp + 0x420]
je 0x1001ac52
mov esi, ecx
sub eax, esi
lea esi, [eax + 2]
jmp 0x1001ac20
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001ac46
movzx eax, word [esi + ecx]
cmp ax, bx
je 0x1001ac46
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001ac20
sub ecx, 2
mov word [ecx], bx
jmp 0x1001ac8a
cmp edx, ebx
jne 0x1001ac4d
sub ecx, 2
mov word [ecx], bx
jmp 0x1001ac8a
lea esi, [esp + 0x10]
lea eax, [esp + 0x420]
sub esi, ecx
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001ac80
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001ac80
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ac60
jmp 0x1001ac84
cmp edx, ebx
jne 0x1001ac87
sub eax, 2
mov word [eax], bx
push 0x104
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x428]
push eax
lea ecx, [esp + 0x83c]
push ecx
call fcn.10011120
add esp, 0x10
test eax, eax
je 0x1001ad3d
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
push 0x80
lea eax, [esp + 0x14]
push eax
call edi
test byte [0x10065ac4], 1
jne 0x1001acfb
or dword [0x10065ac4], 1
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x21c]
push edx
push str.Copy_of__s_to__s
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 0xc
push ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea edx, [esp + 0x14]
push edx
call edi
xor eax, eax
jmp 0x1001aeed
lea eax, [esp + 0x218]
lea esi, [esp + 0x628]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001ad74
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001ad74
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ad54
jmp 0x1001ad78
cmp edx, ebx
jne 0x1001ad7b
sub eax, 2
lea edx, [esp + 0x218]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x218]
cmp word [eax], bx
je 0x1001ada3
add eax, 2
sub ecx, 1
jne 0x1001ad94
jmp 0x1001adc8
cmp ecx, ebx
je 0x1001adc8
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x218]
lea eax, [esp + 0x420]
call fcn.100067e0
lea eax, [esp + 0x218]
push eax
call fcn.1000b750
add esp, 4
test eax, eax
je 0x1001ae66
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
lea edx, [esp + 0x14]
push edx
mov esi, eax
call edi
test byte [0x10065ac4], 1
jne 0x1001ae24
or dword [0x10065ac4], 1
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
push str.Copy_of__s_to__s
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 0xc
push ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [esp + 0x14]
push ecx
call edi
xor eax, eax
jmp 0x1001aeed
push 0x104
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x428]
push eax
lea ecx, [esp + 0xa44]
push ecx
call fcn.10011120
add esp, 0x10
test eax, eax
je 0x1001aed1
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
push 0x80
lea eax, [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x21c]
push edx
push str.Copy_of__s_to__s
push ecx
call fcn.100020c0
add esp, 4
jmp 0x1001ad12
lea eax, [esp + 0x10]
push eax
push str.No_file_backup_found_for__s.
call fcn.100020c0
call fcn.1001e660
add esp, 8
mov eax, 2
mov ecx, dword [esp + 0xc44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0xc3c
ret