Function at 0x10022f20
Capabilities:
Copy file
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10090560
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0xca0
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0xcac], esi
xor edi, edi
mov dword [ebp - 0xc90], edi
xor eax, eax
mov dword [ebp - 0xc94], eax
mov word [ebp - 0x634], ax
push 0x206
push eax
lea eax, [ebp - 0x632]
push eax
call fcn.10055aa0
xor eax, eax
mov word [ebp - 0x42c], ax
push 0x206
push eax
lea eax, [ebp - 0x42a]
push eax
call fcn.10055aa0
xor eax, eax
mov word [ebp - 0x83c], ax
push 0x206
push eax
lea eax, [ebp - 0x83a]
push eax
call fcn.10055aa0
xor eax, eax
mov word [ebp - 0xc4c], ax
push 0x40e
push eax
lea eax, [ebp - 0xc4a]
push eax
call fcn.10055aa0
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push eax
lea eax, [ebp - 0x222]
push eax
call fcn.10055aa0
add esp, 0x3c
mov dword [ebp - 0xc84], edi
xor eax, eax
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0xc7c], eax
mov dword [ebp - 0xc78], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 1
cmp dword [esi + 0x4c], eax
jne 0x1002303a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
jmp 0x10023882
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x100230f5
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1002307f
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x100230db
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x100230ba
mov byte [esi + 0xffff], 0
push esi
push str.SendQuarantineFilesToCosmos
push 1
mov edx, 0x122
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100230d2
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, edi
jmp 0x10023884
movzx eax, byte [ebp - 0xc75]
push eax
movzx eax, byte [ebp - 0xc76]
push eax
mov ecx, dword [ebp - 0xc78]
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0xc79]
push eax
movzx eax, byte [ebp - 0xc7a]
push eax
mov ecx, dword [ebp - 0xc7c]
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, word [ebp - 0xc7e]
push eax
movzx eax, word [ebp - 0xc80]
push eax
push dword [ebp - 0xc84]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x224]
push eax
call fcn.10004ed0
add esp, 0x34
xor eax, eax
mov dword [ebp - 0xc9c], eax
cmp eax, dword [esi + 0x62a4]
jge 0x100234a7
cmp dword [0x1009dcac], 0
je 0x10023022
imul ebx, eax, 0x650
mov eax, dword [esi + 0x62ac]
cmp dword [eax + ebx], 0
jne 0x1002349b
add eax, 4
add eax, ebx
push eax
push str.Quarantine
push 0x100e1fb0
push str._s_s_s.mbae
lea eax, [ebp - 0x634]
push eax
call fcn.10004ed0
push 0
lea eax, [ebp - 0x634]
push eax
call fcn.1005292e
add esp, 0x1c
test eax, eax
je 0x100231f2
mov ecx, 1
mov dword [ebp - 0xc94], ecx
mov dword [ebp - 0xca4], ecx
mov eax, dword [esi + 0x62ac]
mov dword [ebx + eax], 2
mov eax, dword [ebp - 0xc9c]
inc eax
jmp 0x1002315d
lea ecx, [ebp - 0x634]
call fcn.10001360
mov dword [ebp - 0xc74], str..doc
mov dword [ebp - 0xc70], str..docx
mov dword [ebp - 0xc6c], str..xls
mov dword [ebp - 0xc68], str..xlsx
mov dword [ebp - 0xc64], str..csv
mov dword [ebp - 0xc60], str..pdf
mov dword [ebp - 0xc5c], str..vbs
mov dword [ebp - 0xc58], 0x1008c1a8
mov dword [ebp - 0xc54], str..bat
mov dword [ebp - 0xc50], str..cmd
test eax, eax
jne 0x10023297
push ecx
lea edx, [ebp - 0xc74]
lea ecx, [ebp - 0x634]
call fcn.100014a0
add esp, 4
test eax, eax
jne 0x10023297
mov eax, dword [esi + 0x62ac]
mov dword [ebx + eax], 3
mov eax, dword [ebp - 0xc9c]
inc eax
jmp 0x1002315d
mov eax, dword [esi + 0x62ac]
add eax, 0x48
add eax, ebx
push 0x5c
push eax
call fcn.1005276f
add esp, 8
test eax, eax
jne 0x100232be
mov eax, dword [esi + 0x62ac]
add eax, 0x48
add eax, ebx
jmp 0x100232c1
add eax, 2
mov dword [ebp - 0xc8c], eax
push eax
lea eax, [edi + 3]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x100e2608
push 0x10086724
push str._sPL__s__s__04d__s
lea eax, [ebp - 0xc4c]
push eax
call fcn.10004ef0
add esp, 0x1c
xor eax, eax
mov word [ebp - 0xa46], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x1e
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xca8], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0xc88], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov edi, eax
cmp dword [ebp - 0xc88], 0
je 0x100233fc
test edi, edi
je 0x100233fc
mov ecx, dword [esi + 0x62ac]
add ecx, 4
add ecx, ebx
push ecx
lea eax, [ebp - 0xc4c]
push eax
push str._s___s_
push 0xffff
push edi
call fcn.1005211a
add esp, 0x14
test eax, eax
jle 0x100233e2
xor eax, eax
mov word [edi + 0x1fffe], ax
push 0xfffffffffffffffe
push edi
call fcn.10051b84
push 0xffffffffffffffff
push edi
inc eax
push eax
push dword [ebp - 0xc88]
lea eax, [ebp - 0xca8]
push eax
call fcn.10052d14
add esp, 0x1c
test eax, eax
je 0x100233bb
push dword [ebp - 0xc98]
push edi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0xc98]
push dword [ebp - 0xc88]
push str.SendQuarantineFilesToCosmos
push 4
mov edx, 0x158
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10023414
push dword [ebp - 0xc98]
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x1002340e
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0xc88]
test eax, eax
je 0x10023427
push eax
call fcn.10052152
add esp, 4
test edi, edi
je 0x10023434
push edi
call fcn.10052152
add esp, 4
push str.sample
lea eax, [ebp - 0xc4c]
push eax
mov edx, dword [ebp - 0xc8c]
lea ecx, [ebp - 0x634]
call fcn.1002b350
add esp, 8
test eax, eax
jne 0x10023495
mov eax, dword [esi + 0x62ac]
mov dword [ebx + eax], 1
mov edi, dword [ebp - 0xc90]
inc edi
mov dword [ebp - 0xc90], edi
mov dword [ebp - 0xcb0], edi
mov eax, 1
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0xc9c]
inc eax
jmp 0x1002315d
mov edi, dword [ebp - 0xc90]
mov eax, dword [ebp - 0xc9c]
inc eax
jmp 0x1002315d
test edi, edi
jle 0x100237b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax + 0x1e]
mov dword [ebp - 0xc8c], 0
push 0x1000a
call fcn.1005218a
mov dword [ebp - 0xc88], eax
push 0x2000a
call fcn.1005218a
add esp, 8
mov edi, eax
cmp dword [ebp - 0xc88], 0
je 0x10023596
test edi, edi
je 0x10023596
push dword [ebp - 0xc90]
lea eax, [ebp - 0x224]
push eax
push str._s___d_
push 0xffff
push edi
call fcn.1005211a
add esp, 0x14
test eax, eax
jle 0x10023581
xor eax, eax
mov word [edi + 0x1fffe], ax
push 0xfffffffffffffffe
push edi
call fcn.10051b84
push 0xffffffffffffffff
push edi
inc eax
push eax
push dword [ebp - 0xc88]
lea eax, [ebp - 0xc8c]
push eax
call fcn.10052d14
add esp, 0x1c
test eax, eax
je 0x1002355f
push ebx
push edi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
push dword [ebp - 0xc88]
push str.SendQuarantineFilesToCosmos
push 4
mov edx, 0x16b
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100235ae
push ebx
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x100235a8
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0xc88]
test eax, eax
je 0x100235c1
push eax
call fcn.10052152
add esp, 4
test edi, edi
je 0x100235ce
push edi
call fcn.10052152
add esp, 4
push str.mbae_protector.xpe
push 0x100e1fb0
push 0x10086350
lea eax, [ebp - 0x42c]
push eax
call fcn.10004ed0
push 1
lea eax, [ebp - 0x224]
push eax
push 0x100e2608
push 0x10086724
push str._sPL__s__s__04d.xpe
lea eax, [ebp - 0xc4c]
push eax
call fcn.10004ef0
push str.misc_file
lea eax, [ebp - 0xc4c]
push eax
mov edx, eax
lea ecx, [ebp - 0x42c]
call fcn.1002b350
push str.mbae_default.log
push 0x100e1fb0
push 0x10086350
lea eax, [ebp - 0x42c]
push eax
call fcn.10004ed0
add esp, 0x40
lea eax, [ebp - 0x42c]
push eax
push 0x1008c25c
lea eax, [ebp - 0x83c]
push eax
call fcn.10004ed0
add esp, 0xc
mov edi, 5
mov dword [ebp - 0xca0], edi
lea ebx, [ebx]
push 0
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x1002376b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jne 0x1002376b
mov eax, edi
dec edi
mov dword [ebp - 0xca0], edi
test eax, eax
jne 0x10023670
test ebx, ebx
jne 0x1002376b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
call esi
lea edi, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x100236f4
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10023750
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x1002372f
mov byte [esi + 0xffff], 0
push esi
push str.SendQuarantineFilesToCosmos
push 1
mov edx, 0x17f
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10023747
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
lea eax, [ebx + 0x1e]
jmp 0x10023884
push 2
lea eax, [ebp - 0x224]
push eax
push 0x100e2608
push 0x10086724
push str._sPL__s__s__04d.txt
lea eax, [ebp - 0xc4c]
push eax
call fcn.10004ef0
push str.misc_file
lea eax, [ebp - 0xc4c]
push eax
mov edx, eax
lea ecx, [ebp - 0x83c]
call fcn.1002b350
add esp, 0x20
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc94]
test eax, eax
je 0x10023849
mov dword [ebp - 4], 2
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
call fcn.1002d320
mov edi, eax
test edi, edi
je 0x1002383d
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
je 0x10023065
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push edi
test eax, eax
jle 0x100230ba
mov byte [esi + 0xffff], 0
push esi
push str.SendQuarantineFilesToCosmos
push 1
mov edx, 0x192
mov ecx, str...StandAloneSvcExploitFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100230d2
mov dword [ebp - 4], 1
call fcn.1002385d
mov dword [ebp - 4], 0
call fcn.1002386c
jmp 0x1002387b
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret