Function at 0x10027c92
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push 0x2b0
mov eax, 0x100426aa
call fcn.1002a6aa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x27c], eax
xor esi, esi
lea eax, [ebp - 0x270]
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x284], esi
call fcn.10027b9c
mov dword [ebp - 4], esi
cmp dword [ebp - 0x25c], esi
jne 0x10027ce5
xor edi, edi
inc edi
push esi
push 1
lea esi, [ebp - 0x270]
call fcn.10001e8c
mov eax, edi
call fcn.1002a72d
ret
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.1002bdc0
add esp, 0xc
mov dword [ebp - 0x280], esi
call fcn.100133c2
mov dword [ebp - 0x284], eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x21c]
push eax
call esi
lea edx, [ebp - 0x21c]
call fcn.10027c28
push ebx
lea eax, [ebp - 0x21c]
push eax
call esi
push 0
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10027d72
mov dword [ebp - 0x278], 8
jmp 0x10027feb
push 3
push dword [ebp - 0x27c]
lea eax, [ebp - 0x21c]
push eax
push 2
pop eax
call fcn.10014708
test eax, eax
jne 0x10027d9c
mov dword [ebp - 0x278], 0xa
jmp 0x10027fca
push dword [ebp - 0x27c]
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x280], 1
call fcn.10027be3
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x258], 8
mov esi, dword [ebp - 0x26c]
jae 0x10027dd3
lea esi, [ebp - 0x26c]
cmp dword [ebp - 0x220], 8
mov edi, dword [ebp - 0x234]
jae 0x10027de8
lea edi, [ebp - 0x234]
mov ebx, str.Group
call fcn.100143f7
test eax, eax
je 0x10027fad
cmp dword [ebp - 0x220], 8
mov edi, dword [ebp - 0x234]
jae 0x10027e0f
lea edi, [ebp - 0x234]
mov esi, str.poflt_minifilter_driver
mov ebx, str.Description
call fcn.100143f7
test eax, eax
je 0x10027fad
push dword [ebp - 0x27c]
lea esi, [ebp - 0x2a0]
call fcn.10001b24
push eax
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 2
call fcn.1001645d
pop ecx
pop ecx
push 0
push 1
mov byte [ebp - 4], 4
call fcn.10001e8c
push str.Instances_
lea eax, [ebp - 0x238]
push eax
call fcn.1001497e
cmp dword [ebp - 0x23c], 8
mov esi, dword [ebp - 0x250]
jae 0x10027e7d
lea esi, [ebp - 0x250]
cmp dword [ebp - 0x220], 8
mov edi, dword [ebp - 0x234]
jae 0x10027e92
lea edi, [ebp - 0x234]
mov ebx, str.DefaultInstance
call fcn.100143f7
test eax, eax
jne 0x10027ec3
xor ebx, ebx
push ebx
push 1
lea esi, [ebp - 0x254]
mov dword [ebp - 0x278], 0xb
call fcn.10001e8c
mov byte [ebp - 4], bl
push ebx
jmp 0x10027fbd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x254]
lea esi, [ebp - 0x238]
call fcn.10015372
push 0x40b3c
push 0x1004a5f0
lea ecx, [ebp - 0x2bc]
call fcn.1001418c
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x10027efa
mov eax, dword [eax + 4]
jmp 0x10027efd
add eax, 4
cmp dword [ebp - 0x220], 8
mov edi, dword [ebp - 0x234]
jae 0x10027f12
lea edi, [ebp - 0x234]
mov esi, eax
mov ebx, str.Altitude
call fcn.100143f7
test eax, eax
je 0x10027f51
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x10027f37
lea eax, [ebp - 0x234]
xor ebx, ebx
push ebx
push str.Flags
push eax
call fcn.100143c1
test eax, eax
je 0x10027f53
mov byte [ebp - 0x271], bl
jmp 0x10027f5a
xor ebx, ebx
mov byte [ebp - 0x271], 1
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x2bc]
call fcn.10001e8c
push ebx
lea esi, [ebp - 0x254]
push edi
cmp byte [ebp - 0x271], bl
je 0x10027f90
mov dword [ebp - 0x278], 0xb
call fcn.10001e8c
push ebx
mov byte [ebp - 4], bl
push edi
jmp 0x10027fbf
mov dword [ebp - 0x278], ebx
call fcn.10001e8c
push ebx
push edi
lea esi, [ebp - 0x238]
mov byte [ebp - 4], bl
call fcn.10001e8c
jmp 0x10027feb
mov dword [ebp - 0x278], 0xb
mov byte [ebp - 4], 0
push 0
push 1
lea esi, [ebp - 0x238]
call fcn.10001e8c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x280], 0
je 0x10027feb
push dword [ebp - 0x27c]
call fcn.10014896
push dword [ebp - 0x284]
call fcn.10013402
mov edi, dword [ebp - 0x278]
xor esi, esi
jmp 0x10027ccf