Function at 0x10044e5c
Capabilities:
Copy file
Get session user name

Disassembly:
push 0x67c
mov eax, 0x1007afa0
call fcn.1004e336
mov esi, edx
mov edi, ecx
and dword [ebp - 0x688], 0
cmp word [0x100a46d8], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x680], ebx
jne 0x10044f59
push 0x100
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.10050900
add esp, 0xc
mov dword [ebp - 0x684], 0x80
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10044f59
push str.system
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10044f42
push str.agentUser
push 0x100897d8
mov edx, 0x80000002
lea ecx, [ebp - 0x558]
call fcn.100327e4
cmp dword [ebp - 0x548], 0
pop ecx
pop ecx
push 0x80
jne 0x10044f11
lea eax, [ebp - 0x130]
jmp 0x10044f25
cmp dword [ebp - 0x544], 8
lea eax, [ebp - 0x558]
cmovae eax, dword [ebp - 0x558]
push eax
push 0x100a46d8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 1
lea ecx, [ebp - 0x558]
call fcn.100065b4
jmp 0x10044f59
push 0x80
lea eax, [ebp - 0x130]
push eax
push 0x100a46d8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov al, byte [0x100a47e0]
test al, al
jne 0x10044f9a
lea ecx, [ebp - 0x588]
call fcn.100352ec
cmp dword [eax + 0x14], 0x10
jb 0x10044f75
mov eax, dword [eax]
push 0x80
push eax
push 0x100a47e0
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
push 1
lea ecx, [ebp - 0x588]
call fcn.10001805
mov al, byte [0x100a47e0]
cmp word [0x100a46d8], 0
je 0x100454ae
test al, al
je 0x100454ae
test edi, edi
je 0x100454ae
cmp byte [esi + 8], 7
jne 0x100454ae
push str.i_action
lea ecx, [ebp - 0x588]
call fcn.100017d6
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push 0x10089368
call fcn.100017d6
lea eax, [ebp - 0x588]
mov edx, esi
push eax
lea ecx, [ebp - 0x5a0]
call fcn.10008169
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0x588]
mov byte [ebp - 4], 2
call fcn.10001805
mov edx, str.replace
lea ecx, [ebp - 0x5a0]
call fcn.10001c45
test al, al
jne 0x10045037
mov edx, str.delete
lea ecx, [ebp - 0x5a0]
call fcn.10001c45
test al, al
je 0x10045097
mov ebx, str.i_key_columns
mov ecx, esi
push ebx
call fcn.1003a121
cmp byte [eax + 8], 4
jne 0x1004506d
lea eax, [ebp - 0x570]
mov ecx, esi
push eax
push ebx
call fcn.1003a121
mov ecx, eax
call fcn.10039489
xor ecx, ecx
inc ecx
cmp dword [eax + 0x10], 0
je 0x10045073
xor bl, bl
jmp 0x10045075
mov ecx, dword [ebp - 0x688]
mov bl, 1
test cl, 1
je 0x10045089
push 0
push 1
lea ecx, [ebp - 0x570]
call fcn.10001805
test bl, bl
jne 0x10045499
mov ebx, dword [ebp - 0x680]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x680], esp
push edi
call fcn.10039092
push str.i_dt
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1003932a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x680], esp
push 0x100a47e0
call fcn.10039092
push str.client_unique
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1003932a
mov edi, str.user_name
mov ecx, esi
push edi
call fcn.1003a121
cmp byte [eax + 8], 0
jne 0x10045208
lea ecx, [ebp - 0x67c]
call fcn.10044cba
mov byte [ebp - 4], 5
call fcn.1003563c
test eax, eax
je 0x10045188
cmp dword [ebp - 0x66c], 0
je 0x10045188
sub esp, 0x18
lea eax, [ebp - 0x67c]
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.1003910e
push edi
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.1003932a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x680], esp
push 1
call fcn.1003903d
push str.i_user_data
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.1003932a
jmp 0x100451f9
push 0x100a46d8
lea ecx, [ebp - 0x558]
call fcn.1000587d
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.10003a11
sub esp, 0x10
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.1003910e
push edi
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.1003932a
push 0
push 1
lea ecx, [ebp - 0x570]
call fcn.10001805
push 0
push 1
lea ecx, [ebp - 0x558]
call fcn.100065b4
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 2
call fcn.100454b6
push str.data_time
mov ecx, esi
call fcn.1003a121
cmp byte [eax + 8], 0
jne 0x100452ac
push 7
xor eax, eax
mov byte [ebp - 0x30], 0
pop ecx
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x544]
push eax
movzx eax, word [ebp - 0x546]
push eax
movzx eax, word [ebp - 0x548]
push eax
movzx eax, word [ebp - 0x54a]
push eax
movzx eax, word [ebp - 0x54e]
push eax
movzx eax, word [ebp - 0x550]
push eax
push str._04d__02d__02d__02d:_02d:_02d
lea eax, [ebp - 0x30]
push 0x20
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0xc
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.10039092
push str.data_time
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1003932a
test ebx, ebx
je 0x10045494
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x558]
call fcn.1000587d
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.10003a11
sub esp, 0x10
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.1003910e
push str.attach_name
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.1003932a
push 0
push 1
lea ecx, [ebp - 0x570]
call fcn.10001805
push 0
push 1
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 2
call fcn.100065b4
cmp dword [ebp + 0xc], 0
je 0x100453a3
push ebx
lea ecx, [ebp - 0x558]
call fcn.1000587d
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.10003a11
sub esp, 0x10
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.1003910e
push str.attachment
mov ecx, esi
mov byte [ebp - 4], 0x11
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.1003932a
push 0
push 1
lea ecx, [ebp - 0x570]
call fcn.10001805
lea ecx, [ebp - 0x558]
jmp 0x1004548b
mov edi, 0x208
lea eax, [ebp - 0x338]
push edi
push 0
push eax
call fcn.10050900
add esp, 0xc
lea ecx, [ebp - 0x338]
call fcn.10044d61
test eax, eax
je 0x10045499
lea ecx, [ebp - 0x338]
call fcn.1002fedc
push edi
lea eax, [ebp - 0x540]
push 0
push eax
call fcn.10050900
add esp, 0xc
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.100307f0
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10045499
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x570]
call fcn.1000587d
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10003a11
sub esp, 0x10
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.1003910e
push str.attachment
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.1003a121
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.1003932a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001805
lea ecx, [ebp - 0x570]
push 0
push 1
call fcn.100065b4
xor esi, esi
inc esi
jmp 0x1004549b
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x5a0]
call fcn.10001805
mov eax, esi
jmp 0x100454b0
xor eax, eax
call fcn.1004e2e0
ret