Function at 0x1002ce1
Capabilities:
Copy file
Create directory
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x1005004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
xor eax, eax
lea edi, [ebp - 0x638]
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x628], 1
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], ecx
jne 0x1002d5e
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x638], eax
xor ecx, ecx
cmp ebx, ecx
je 0x100332c
cmp esi, ecx
je 0x100332c
push 0x200
push ecx
lea eax, [ebp - 0x204]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
call fcn.010018b3
xor edi, edi
cmp eax, edi
jne 0x1002da5
push 0x3e9
call fcn.01001b8b
pop ecx
mov dword [ebp - 0x628], edi
jmp 0x1003346
push eax
push 0x104
lea eax, [ebp - 0x614]
push eax
call fcn.01001960
test eax, eax
jl 0x1002d9a
cmp dword [ebp + 0xc], edi
jne 0x1002dd0
push dword [ebp + 0x14]
push esi
push ebx
call fcn.0100256e
test eax, eax
jne 0x1002df0
jmp 0x1002d9a
cmp dword [ebp + 0xc], 2
jne 0x1002de2
push esi
call fcn.010018b3
test eax, eax
jne 0x1002df0
jmp 0x1002d8f
push ebx
push dword [ebp + 0x14]
push esi
call fcn.01001960
test eax, eax
jl 0x1002d9a
lea eax, [ebp - 0x624]
push eax
push ebx
call fcn.01001dd2
test eax, eax
je 0x1002fc1
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x624]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.apphelp.dll_SdbIsStandardDatabase
test eax, eax
je 0x1002e33
push 0x3ed
call fcn.01001b8b
and dword [ebp - 0x628], 0
jmp 0x10032dd
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
jge 0x1002e52
push 0x407
jmp 0x1002e22
mov eax, dword [ebp - 0x64c]
and eax, 0xfffe
mov ecx, 0x206
cmp ax, cx
jbe 0x1002e6e
push 0x409
jmp 0x1002e22
movzx esi, word [ebp - 0x64c]
push esi
push dword [ebp - 0x648]
lea eax, [ebp - 0x40c]
push eax
call sub.msvcrt.dll_memcpy
xor eax, eax
shr esi, 1
mov word [ebp + esi*2 - 0x40c], ax
add esp, 0xc
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp + 0xc], 0
jne 0x1002f51
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x630]
push ecx
push eax
mov ebx, 0x101
push ebx
push eax
push eax
push eax
push 0x10014a8
mov edi, 0x80000002
push edi
call esi
test eax, eax
je 0x1002f07
cmp eax, 5
jne 0x1002eea
push 0x3f0
call fcn.01001b8b
jmp 0x1002efa
push 0x10014a8
push 0x3f1
call fcn.01001b8b
pop ecx
and dword [ebp - 0x628], 0
pop ecx
jmp 0x1003346
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
lea ecx, [ebp - 0x630]
push ecx
push eax
push ebx
push eax
push eax
push eax
mov ebx, 0x10012f0
push ebx
push edi
mov dword [ebp - 0x630], eax
call esi
test eax, eax
je 0x1002f38
push ebx
jmp 0x1002eef
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x630], 0
mov ebx, dword [ebp - 0x644]
xor edi, edi
push edi
push ebx
call sub.apphelp.dll_SdbOpenDatabase
mov esi, eax
mov dword [ebp - 0x62c], esi
cmp esi, edi
jne 0x1002f7c
push ebx
push 0x3ea
call fcn.01001b8b
mov dword [ebp - 0x628], edi
jmp 0x10032dc
push 0x7001
push edi
push esi
call sub.apphelp.dll_SdbFindFirstTag
mov dword [ebp - 0x634], eax
cmp eax, edi
jne 0x1002f9a
push ebx
push 0x3eb
jmp 0x1002f6c
push eax
push esi
call fcn.010018df
cmp eax, edi
jne 0x1002fab
lea eax, [ebp - 0x614]
push eax
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.01001960
test eax, eax
jge 0x1002fcc
mov dword [ebp - 0x628], edi
jmp 0x10032de
push 0x7007
push dword [ebp - 0x634]
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindFirstTag
mov esi, eax
mov ebx, 0x6001
jmp 0x100309c
push ebx
push esi
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, edi
jne 0x1003018
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x628], edi
je 0x1003082
cmp dword [ebp + 0xc], 1
je 0x1003082
push 0x3f2
jmp 0x100303f
push eax
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbGetStringTagPtr
cmp eax, edi
jne 0x100304a
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x628], edi
je 0x1003082
cmp dword [ebp + 0xc], 1
je 0x1003082
push 0x3f3
call fcn.01001b8b
pop ecx
jmp 0x1003332
push edi
lea ecx, [ebp - 0x40c]
cmp dword [ebp + 0xc], edi
jne 0x1003073
push dword [ebp - 0x638]
push dword [ebp - 0x63c]
push ecx
push eax
call fcn.010025bc
test eax, eax
je 0x10031a1
jmp 0x1003082
push ecx
push eax
call fcn.010026f3
test eax, eax
je 0x1003332
push esi
push dword [ebp - 0x634]
mov edi, esi
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindNextTag
mov esi, eax
cmp esi, edi
je 0x10030a8
xor edi, edi
cmp esi, edi
jne 0x1002fee
jmp 0x10030aa
xor edi, edi
push 0x700b
push dword [ebp - 0x634]
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindFirstTag
mov esi, eax
jmp 0x1003169
push ebx
push esi
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, edi
jne 0x10030f0
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x628], edi
je 0x100314d
cmp dword [ebp + 0xc], 1
jne 0x1003011
jmp 0x100314d
push eax
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbGetStringTagPtr
cmp eax, edi
jne 0x1003118
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0x628], edi
je 0x100314d
cmp dword [ebp + 0xc], 1
jne 0x100303a
jmp 0x100314d
push 1
lea ecx, [ebp - 0x40c]
cmp dword [ebp + 0xc], edi
jne 0x100313e
push dword [ebp - 0x638]
push dword [ebp - 0x63c]
push ecx
push eax
call fcn.010025bc
test eax, eax
je 0x10031a1
jmp 0x100314d
push ecx
push eax
call fcn.010026f3
test eax, eax
je 0x1003332
push esi
push dword [ebp - 0x634]
mov edi, esi
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbFindNextTag
mov esi, eax
cmp esi, edi
je 0x1003173
xor edi, edi
cmp esi, edi
jne 0x10030c7
jmp 0x1003175
xor edi, edi
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp - 0x638]
lea eax, [ebp - 0x40c]
push dword [ebp - 0x63c]
push eax
push dword [ebp - 0x634]
push dword [ebp - 0x62c]
call fcn.010029a6
test eax, eax
jne 0x10031ac
mov dword [ebp - 0x628], edi
jmp 0x1003332
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbCloseDatabase
mov dword [ebp - 0x62c], edi
cmp ebx, edi
jne 0x100321d
push edi
mov esi, 0x1005020
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10031f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10031f3
push eax
push esi
push 0x410
call fcn.01001b8b
add esp, 0xc
jmp 0x1002d9a
mov esi, dword [ebp - 0x640]
push 1
push esi
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1003264
push esi
push 0x3f9
call fcn.01001b8b
pop ecx
jmp 0x1002d99
mov esi, dword [ebp - 0x640]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1003246
push esi
push 0x41b
call fcn.01001b8b
pop ecx
pop ecx
mov dword [ebp - 0x628], edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003264
push esi
push 0x3fa
call fcn.01001b8b
pop ecx
pop ecx
mov dword [ebp - 0x628], edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
push ebx
call fcn.01002b24
cmp ebx, edi
jne 0x10032a8
lea eax, [ebp - 0x63c]
push eax
push 0x10000
push esi
call sub.apphelp.dll_SdbRegisterDatabaseEx
test eax, eax
lea eax, [ebp - 0x204]
push eax
jne 0x100331e
push 0x40a
jmp 0x1003212
lea eax, [ebp - 0x624]
push eax
call sub.apphelp.dll_SdbUnregisterDatabase
test eax, eax
jne 0x10032cb
lea eax, [ebp - 0x204]
push eax
push 0x40b
call fcn.01001b8b
pop ecx
pop ecx
lea eax, [ebp - 0x204]
push eax
push 0x3fc
call fcn.01001b8b
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x1003332
cmp dword [ebp - 0x62c], 0
je 0x10032ff
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbCloseDatabase
and dword [ebp - 0x62c], 0
push 0x80
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003332
push 0x3fb
call fcn.01001b8b
pop ecx
pop ecx
jmp 0x1003346
mov dword [ebp - 0x628], ecx
cmp dword [ebp - 0x62c], 0
je 0x1003346
push dword [ebp - 0x62c]
call sub.apphelp.dll_SdbCloseDatabase
cmp dword [ebp - 0x630], 0
je 0x100335b
push dword [ebp - 0x630]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x628]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003f01
leave
ret 0x10