Function at 0x1000ec40
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047d40
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100632c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0x104
push edi
push dword [0x100647b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
call esi
push edi
call esi
call fcn.100030b0
mov ecx, eax
test ecx, ecx
je 0x1000eeac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test edi, edi
je 0x1000ece1
test edi, 0xffff0000
jne 0x1000ecc4
movzx eax, di
lea ecx, [ebp - 0x10]
push eax
call fcn.1000adb0
jmp 0x1000eced
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ecd0
sub ecx, edx
sar ecx, 1
jmp 0x1000ece3
xor ecx, ecx
push ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.10006bb0
mov eax, dword [ebp - 0x10]
mov ebx, str.Utils
sub ebx, eax
mov dword [ebp - 4], 1
push 6
push str.Utils
mov esi, dword [eax - 0xc]
sar ebx, 1
mov dword [ebp - 0x1c], esi
call fcn.10031653
mov ecx, 0x7fffffff
mov dword [ebp - 0x20], eax
sub ecx, eax
add esp, 8
cmp ecx, esi
jl 0x1000eeb6
add esi, eax
js 0x1000eec0
mov eax, dword [ebp - 0x10]
mov edx, 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x1000ed4f
push esi
lea ecx, [ebp - 0x10]
call fcn.10003490
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
cmp ebx, edx
lea ebx, [eax + ebx*2]
jbe 0x1000ed5e
mov ebx, str.Utils
mov ecx, dword [ebp - 0x20]
lea eax, [eax + edx*2]
add ecx, ecx
push ecx
push ebx
push ecx
push eax
call fcn.1000e4e0
mov eax, dword [ebp - 0x10]
add esp, 0x10
cmp esi, dword [eax - 8]
jg 0x1000eeb6
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
push str.Utils_rundll.exe
push edi
mov word [eax + esi*2], cx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.100030b0
mov ecx, eax
test ecx, ecx
je 0x1000eeca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push 1
push eax
mov dword [ebp - 0x18], 0
call fcn.10017c80
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x1004c354
push dword [eax]
call fcn.10005ee0
mov edx, dword [ebp - 0x20]
or ebx, 0xffffffff
add esp, 0x1c
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000ee06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x18], 0
jne 0x1000ee23
push 1
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1000ee23
mov eax, dword [ebp - 0x14]
xor esi, esi
jmp 0x1000ee5e
mov eax, dword [ebp - 0x14]
mov edx, 0x104
mov esi, eax
sub esi, edi
nop
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1000ee4e
movzx ecx, word [esi + edi]
test cx, cx
je 0x1000ee4e
mov word [edi], cx
add edi, 2
sub edx, 1
jne 0x1000ee30
test edx, edx
lea ecx, [edi - 2]
cmovne ecx, edi
xor edx, edx
mov word [ecx], dx
lea esi, [edx + 1]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 1
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000ee79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1000ee98
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003270
push 0x80070057
call fcn.10003270
push 0x80070057
call fcn.10003270
push 0x80004005
call fcn.10003270
int3