Function at 0x4106b6
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x604694
call fcn.00465b38
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x20], ecx
mov esi, 0x69dc58
push edi
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 1
call fcn.005ece05
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.005ece05
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005ece05
mov byte [ebp - 4], 2
call fcn.004d82e0
test eax, eax
je 0x4107a2
mov edi, 0x66b650
mov esi, 0x66b78c
push edi
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
push edi
call fcn.004e07d0
push eax
lea eax, [ebp - 0x10]
push str._sdrivers_s
push eax
call fcn.005e20b1
add esp, 0x10
lea eax, [ebp - 0x10]
push str..tmp
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005ed036
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.005eced8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.005ecd91
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.004109e3
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x41088a
and dword [ebp - 0x1c], eax
jmp 0x41088a
mov dword [ebp - 0x24], ebx
call fcn.004d8300
test eax, eax
je 0x4107d2
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Wow64DisableWow64FsRedirection
push eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4107d2
lea ecx, [ebp - 0x24]
push ecx
call eax
mov edi, 0x66b5dc
mov esi, 0x66b78c
push edi
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
push edi
call fcn.004e07d0
push eax
lea eax, [ebp - 0x10]
push str._sdrivers_s
push eax
call fcn.005e20b1
add esp, 0x10
lea eax, [ebp - 0x10]
push str..tmp
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005ed036
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.005eced8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.005ecd91
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.004109e3
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x410861
and dword [ebp - 0x1c], eax
call fcn.004d8300
test eax, eax
je 0x41088a
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410881
push dword [ebp - 0x24]
call eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.TSDFmt32o.dll
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
push 0x66b748
call fcn.004e07d0
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
lea eax, [ebp - 0x10]
push str..tmp
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005ed036
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.005eced8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.005ecd91
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.004109e3
push 5
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x410908
and dword [ebp - 0x1c], eax
push str.TSDMnt32o.dll
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
push str.TSDMnt32.dll
call fcn.004e07d0
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
lea eax, [ebp - 0x10]
push str..tmp
push eax
lea eax, [ebp + 8]
push eax
call fcn.005ed036
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.005eced8
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.005ecd91
xor esi, esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.004109e3
push 5
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x410987
mov dword [ebp - 0x1c], esi
cmp dword [0x6a3388], esi
pop edi
pop esi
pop ebx
je 0x4109ae
push dword [ebp - 0x1c]
push str.DelSysOEAModule_bOK__d_
push str.CopyModule
push 4
push 0x6a2af4
call fcn.004cdcb0
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005ecd91
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005ecd91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.005ecd91
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov dword fs:[0], ecx
leave
ret 4