Function at 0x1001a250
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0xc84
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0xc7c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x46e]
push ebx
push eax
mov edi, ecx
mov word [esp + 0x474], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0x266]
push ebx
push ecx
mov word [esp + 0x26c], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea edx, [esp + 0x87e]
push ebx
push edx
mov word [esp + 0x884], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea eax, [esp + 0x676]
push ebx
push eax
mov word [esp + 0x67c], bx
call fcn.1003d360
add esp, 0xc
push 0x206
lea ecx, [esp + 0xa86]
push ebx
push ecx
mov word [esp + 0xa8c], bx
call fcn.1003d360
add esp, 0xc
cmp dword [edi], ebx
jne 0x1001a30b
call fcn.1003c54f
mov edx, dword [edi]
mov eax, dword [edi + 4]
cmp eax, dword [edx + 8]
jb 0x1001a31a
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0x670]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a353
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a353
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a333
jmp 0x1001a357
cmp edx, ebx
jne 0x1001a35a
sub eax, 2
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [esp + 0x670]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x670]
lea esp, [esp]
cmp word [eax], bx
je 0x1001a38f
add eax, 2
sub ecx, 1
jne 0x1001a380
jmp 0x1001a3b2
cmp ecx, ebx
je 0x1001a3b2
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x670]
mov eax, str.WindowsSystem32ConfigRegBack
call fcn.100067e0
cmp dword [edi], ebx
jne 0x1001a3bb
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001a3ca
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0xa80]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a403
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a403
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a3e3
jmp 0x1001a407
cmp edx, ebx
jne 0x1001a40a
sub eax, 2
lea edx, [esp + 0xa80]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0xa80]
cmp word [eax], bx
je 0x1001a432
add eax, 2
sub ecx, 1
jne 0x1001a423
jmp 0x1001a455
cmp ecx, ebx
je 0x1001a455
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0xa80]
mov eax, str.WindowsRepair
call fcn.100067e0
cmp dword [edi], ebx
jne 0x1001a45e
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001a46d
call fcn.1003c54f
mov esi, dword [edi + 4]
lea eax, [esp + 0x468]
mov ecx, eax
sub esi, ecx
mov edx, 0x104
add esi, 0x20c
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a4a6
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a4a6
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a486
jmp 0x1001a4aa
cmp edx, ebx
jne 0x1001a4ad
sub eax, 2
lea edx, [esp + 0x468]
push edx
mov word [eax], bx
call ebp
cmp dword [edi], ebx
jne 0x1001a4c3
call fcn.1003c54f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cmp ecx, dword [eax + 8]
jb 0x1001a4d2
call fcn.1003c54f
mov eax, dword [edi + 4]
mov edx, 0x104
lea ecx, [esp + 0x468]
cmp word [ecx], bx
je 0x1001a4f0
add ecx, 2
sub edx, 1
jne 0x1001a4e1
jmp 0x1001a50e
cmp edx, ebx
je 0x1001a50e
mov ecx, 0x104
sub ecx, edx
mov edx, 0x104
sub edx, ecx
lea ecx, [esp + ecx*2 + 0x468]
call fcn.100067e0
lea edx, [esp + 0x468]
push 0x5c
push edx
call fcn.1003ca7d
add esp, 8
cmp eax, ebx
mov edx, 0x104
lea ecx, [esp + 0x878]
je 0x1001a572
mov esi, ecx
sub eax, esi
lea esi, [eax + 2]
jmp 0x1001a540
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001a566
movzx eax, word [esi + ecx]
cmp ax, bx
je 0x1001a566
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001a540
sub ecx, 2
mov word [ecx], bx
jmp 0x1001a5ac
cmp edx, ebx
jne 0x1001a56d
sub ecx, 2
mov word [ecx], bx
jmp 0x1001a5ac
lea esi, [esp + 0x468]
lea eax, [esp + 0x878]
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a5a2
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a5a2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a582
jmp 0x1001a5a6
cmp edx, ebx
jne 0x1001a5a9
sub eax, 2
mov word [eax], bx
lea eax, [esp + 0x260]
lea esi, [esp + 0x670]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a5e3
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a5e3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a5c3
jmp 0x1001a5e7
cmp edx, ebx
jne 0x1001a5ea
sub eax, 2
lea edx, [esp + 0x260]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x260]
cmp word [eax], bx
je 0x1001a612
add eax, 2
sub ecx, 1
jne 0x1001a603
jmp 0x1001a637
cmp ecx, ebx
je 0x1001a637
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x260]
lea eax, [esp + 0x878]
call fcn.100067e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1001a6ec
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
push 0x80
lea eax, [esp + 0x46c]
push eax
call edi
test byte [0x10065ac4], 1
jne 0x1001a6a1
or dword [0x10065ac4], 1
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea ecx, [esp + 0x468]
push ecx
lea edx, [esp + 0x264]
push edx
push str.Copy_of__s_to__s
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 0xc
push ebx
lea eax, [esp + 0x46c]
push eax
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea edx, [esp + 0x46c]
push edx
call edi
xor eax, eax
jmp 0x1001a85f
lea eax, [esp + 0x260]
lea esi, [esp + 0xa80]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1001a723
movzx ecx, word [esi + eax]
cmp cx, bx
je 0x1001a723
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a703
jmp 0x1001a727
cmp edx, ebx
jne 0x1001a72a
sub eax, 2
lea edx, [esp + 0x260]
push edx
mov word [eax], bx
call ebp
mov ecx, 0x104
lea eax, [esp + 0x260]
cmp word [eax], bx
je 0x1001a752
add eax, 2
sub ecx, 1
jne 0x1001a743
jmp 0x1001a777
cmp ecx, ebx
je 0x1001a777
mov eax, 0x104
sub eax, ecx
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax*2 + 0x260]
lea eax, [esp + 0x878]
call fcn.100067e0
lea eax, [esp + 0x260]
push eax
call fcn.1000b750
add esp, 4
test eax, eax
je 0x1001a81e
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
lea edx, [esp + 0x46c]
push edx
mov esi, eax
call edi
test byte [0x10065ac4], 1
jne 0x1001a7d6
or dword [0x10065ac4], 1
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea eax, [esp + 0x468]
push eax
lea ecx, [esp + 0x264]
push ecx
push str.Copy_of__s_to__s
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 0xc
push ebx
lea edx, [esp + 0x46c]
push edx
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea ecx, [esp + 0x46c]
push ecx
call edi
xor eax, eax
jmp 0x1001a85f
test byte [0x10065ac4], 1
jne 0x1001a840
or dword [0x10065ac4], 1
call fcn.1001db00
push 0x10051230
call fcn.1003c413
add esp, 4
lea edx, [esp + 0x468]
push edx
push str.No_Registry_backup_found_for__s.
mov eax, 0x10065ac8
call fcn.1001e660
add esp, 8
mov eax, 2
mov ecx, dword [esp + 0xc8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003c13d
add esp, 0xc84
ret