Function at 0x10036770
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dbafb
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10114894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x428], ebx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10066cd0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
call fcn.100239e0
mov ecx, eax
call fcn.1001ce20
mov eax, dword [ebp - 0x424]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x1003682c
lea eax, [ebp - 0x428]
push eax
call fcn.10035d10
add esp, 4
push dword [eax]
lea eax, [ebp - 0x218]
push dword [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x428]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10036967
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10036967
push str.rand
push eax
call fcn.10084eb5
add esp, 8
test eax, eax
jne 0x100368c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10084c3e
add esp, 4
call fcn.10084c1d
cdq
mov esi, 0x1a
idiv esi
lea ebx, [edx + 0x61]
call fcn.10084c1d
cdq
idiv esi
lea edi, [edx + 0x61]
call fcn.10084c1d
cdq
idiv esi
lea esi, [edx + 0x61]
call fcn.10084c1d
cdq
mov ecx, 0x1a
idiv ecx
movzx eax, bx
push eax
movzx eax, di
add edx, 0x61
push eax
movzx eax, si
push eax
movzx eax, dx
push eax
call fcn.10084c1d
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
movzx eax, dx
push eax
lea eax, [ebp - 0x424]
push str._c_c_c_c_c
push eax
call fcn.1001abe0
mov ebx, dword [ebp - 0x428]
add esp, 0x1c
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push str.module
push dword [ebx + 4]
push eax
call esi
push 4
push str..exe
lea ecx, [ebp - 0x424]
call fcn.10035490
push dword [ebp - 0x424]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10066cd0
lea eax, [ebp - 0x42c]
push eax
call fcn.10035d10
add esp, 0x10
push dword [eax]
lea eax, [ebp - 0x420]
push dword [ebx + 4]
push eax
call esi
mov edx, dword [ebp - 0x42c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10036951
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0x424]
cmp dword [eax - 0xc], 0
je 0x10036984
push 4
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10036990
sub eax, edx
lea ecx, [ebx + 0x70]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100070c0
mov edx, dword [ebp - 0x424]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100369d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005e6b8
mov esp, ebp
pop ebp
ret