Function at 0x1001004a
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x101f57c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov dword [ebp - 0x104], ebx
call fcn.10002f15
mov esi, eax
call sym.mono.dll_mono_domain_get
mov edi, eax
push edi
call fcn.1000f657
push esi
push edi
call fcn.1000fea4
add esp, 0x10
test eax, eax
jne 0x10010099
push esi
call sym.mono.dll_g_free
mov eax, ebx
jmp 0x10010368
push edi
lea eax, [ebp - 0xf8]
call fcn.1000fb00
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
call fcn.100089eb
pop ecx
pop ecx
test eax, eax
jne 0x100100de
lea eax, [ebp - 0xf8]
push eax
call fcn.100089a1
push esi
call sym.mono.dll_g_free
push str.Failed_to_create_shadow_copy__invalid_characters_in_shadow_directory_name_.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
add esp, 0x10
push edi
push esi
call fcn.101138e0
pop ecx
pop ecx
push edi
test eax, eax
je 0x100100fe
call sym.mono.dll_g_free
push esi
call sym.mono.dll_g_free
mov eax, ebx
jmp 0x10010367
call sym.mono.dll_g_free
push esi
call sym.mono.dll_g_free
lea eax, [ebp - 0xf8]
push eax
mov ecx, ebx
call fcn.1000fbce
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
mov dword [ebp - 0xfc], edi
call fcn.100089eb
add esp, 0x10
test eax, eax
jne 0x10010152
lea eax, [ebp - 0xf8]
push eax
call fcn.100089a1
mov dword [esp], str.Failed_to_create_shadow_copy__invalid_characters_in_file_name_.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
pop ecx
pop ecx
push edi
call fcn.1000fca6
pop ecx
test eax, eax
jne 0x10010177
push edi
call sym.mono.dll_g_free
mov dword [esp], str.Failed_to_create_shadow_copy__ensure_directory_exists_.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
pop ecx
pop ecx
push ebx
lea esi, [ebp - 0x44]
call fcn.1000fd6a
pop ecx
test eax, eax
jne 0x1001018c
mov eax, edi
jmp 0x10010369
mov eax, ebx
lea esi, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10010193
push ebx
push ebx
sub eax, esi
push ebx
push eax
push dword [ebp - 0x104]
call fcn.10001352
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xfc]
add esp, 0x14
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100101bd
push ebx
push ebx
sub eax, esi
push ebx
push eax
push dword [ebp - 0xfc]
call fcn.10001352
add esp, 0x14
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
push dword [ebp - 0x100]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp edi, ebx
je 0x10010203
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
push esi
call sym.mono.dll_g_free
push dword [ebp - 0x100]
call sym.mono.dll_g_free
pop ecx
pop ecx
cmp edi, ebx
jne 0x10010239
push dword [ebp - 0xfc]
call sym.mono.dll_g_free
mov dword [esp], str.Failed_to_create_shadow_copy__CopyFile_.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
pop ecx
pop ecx
push ebx
mov esi, str..config
push esi
push dword [ebp - 0x104]
call fcn.100024da
add esp, 0xc
mov dword [ebp - 0x100], eax
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10010257
push ebx
push esi
push dword [ebp - 0xfc]
sub eax, edi
mov dword [ebp - 0x10c], eax
call fcn.100024da
add esp, 0xc
mov edi, eax
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1001027b
sub eax, ecx
mov ecx, dword [ebp - 0x10c]
push 7
push eax
push edi
push dword [ebp - 0x100]
mov dword [ebp - 0x110], eax
mov eax, str..mdb
call fcn.1000fa07
add esp, 0x10
mov dword [ebp - 0x108], eax
cmp eax, 1
jne 0x100102d7
mov ecx, dword [ebp - 0x10c]
push 7
push dword [ebp - 0x110]
mov eax, esi
push edi
push dword [ebp - 0x100]
call fcn.1000fa07
add esp, 0x10
mov dword [ebp - 0x108], eax
push dword [ebp - 0x100]
call sym.mono.dll_g_free
push edi
call sym.mono.dll_g_free
pop ecx
pop ecx
cmp dword [ebp - 0x108], ebx
jne 0x10010311
push dword [ebp - 0xfc]
call sym.mono.dll_g_free
mov dword [esp], str.Failed_to_create_shadow_copy_of_sibling_data__CopyFile_.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
pop ecx
pop ecx
push dword [ebp - 0x104]
mov esi, dword [ebp - 0xfc]
push esi
call fcn.1000fdc7
pop ecx
pop ecx
test eax, eax
jne 0x10010343
push esi
call sym.mono.dll_g_free
mov dword [esp], str.Failed_to_create_shadow_copy_.ini_file.
call sym.mono.dll_mono_get_exception_execution_engine
push eax
call sym.mono.dll_mono_raise_exception
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.10115d25
mov eax, esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011389e
leave
ret