Function at 0x10004b00
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x314
mov eax, dword [esp + 0x318]
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], 0
xor edi, edi
xor esi, esi
call fcn.100031d0
add esp, 8
test eax, eax
jne 0x10004e36
cmp word [esp + 0xc], 0x409
je 0x10004e36
lea edx, [esp + 0x10]
push 1
push edx
call fcn.10002cc0
add esp, 8
test eax, eax
je 0x10004c91
mov ecx, dword [esp + 0x10]
cmp ecx, 0x55
je 0x10004e36
cmp ecx, 0x56
je 0x10004e36
mov eax, dword [esp + 0xc]
and eax, 0xffff
cmp eax, 0x40c
jg 0x10004b97
cmp eax, 0x40a
jge case.0x10004d4a.2064
cmp eax, 0x404
je 0x10004c55
jmp 0x10004cc4
cmp eax, 0x804
jg 0x10004bd5
je 0x10004bbd
add eax, 0xfffffbf2
cmp eax, 0x11
ja case.0x10004d4a.2065
xor edx, edx
mov dl, byte [eax + 0x10004e64]
jmp dword [edx*4 + 0x10004e40]
cmp ecx, 0x53
jne 0x10004d0f
mov edi, 5
mov esi, 0x1000d668
jmp case.0x10004d4a.2065
cmp eax, 0x80c
jle 0x10004d25
cmp eax, 0x81d
jg 0x10004c1a
je case.0x10004d4a.2064
add eax, 0xfffff7f0
cmp eax, 6
ja case.0x10004d4a.2065
jmp dword [eax*4 + 0x10004e78]
cmp ecx, 0x53
jne case.0x10004d4a.2066
mov edi, 5
mov esi, 0x1000d690
jmp case.0x10004d4a.2065
cmp eax, 0xc07
jg 0x10004c33
je case.0x10004d4a.2064
cmp eax, 0xc04
je 0x10004c55
jmp case.0x10004d4a.2065
cmp eax, 0x1004
jg 0x10004c6d
je 0x10004c55
sub eax, 0xc0a
je case.0x10004d4a.2064
sub eax, 2
je case.0x10004d4a.2064
jmp case.0x10004d4a.2065
cmp ecx, 0x53
jne 0x10004d86
mov edi, 5
mov esi, 0x1000d6b8
jmp case.0x10004d4a.2065
cmp eax, 0x100c
jle 0x10004d99
sub eax, 0x1407
je case.0x10004d4a.2064
sub eax, 5
jne case.0x10004d4a.2065
jmp case.0x10004d4a.2064
call fcn.10002f90
test eax, eax
je case.0x10004d4a.2065
mov eax, dword [esp + 0xc]
and eax, 0xffff
cmp eax, 0x40c
jg 0x10004cda
cmp eax, 0x40a
jge case.0x10004d4a.2064
cmp eax, 0x404
je 0x10004d86
jle case.0x10004d4a.2065
cmp eax, 0x408
jle case.0x10004d4a.2064
jmp case.0x10004d4a.2065
cmp eax, 0x804
jg 0x10004d1e
je 0x10004d0f
add eax, 0xfffffbf2
cmp eax, 0x11
ja case.0x10004d4a.2065
xor ecx, ecx
mov cl, byte [eax + 0x10004eb8]
jmp dword [ecx*4 + 0x10004e94]
mov edi, 5
mov esi, 0x1000d640
jmp case.0x10004d4a.2065
mov edi, 3
mov esi, 0x1000d658
jmp case.0x10004d4a.2065
cmp eax, 0x80c
jg 0x10004d37
je case.0x10004d4a.2064
cmp eax, 0x807
je case.0x10004d4a.2064
jmp case.0x10004d4a.2065
cmp eax, 0x81d
jg 0x10004d5d
je case.0x10004d4a.2064
add eax, 0xfffff7f0
cmp eax, 6
ja case.0x10004d4a.2065
jmp dword [eax*4 + 0x10004ecc]
mov edi, 3
mov esi, 0x1000d680
jmp case.0x10004d4a.2065
cmp eax, 0xc07
jg 0x10004d6f
je case.0x10004d4a.2064
cmp eax, 0xc04
je 0x10004d86
jmp case.0x10004d4a.2065
cmp eax, 0x1004
jg 0x10004d92
je 0x10004d86
sub eax, 0xc0a
je case.0x10004d4a.2064
sub eax, 2
je case.0x10004d4a.2064
jmp case.0x10004d4a.2065
mov edi, 3
mov esi, 0x1000d6a8
jmp case.0x10004d4a.2065
cmp eax, 0x100c
jg 0x10004da4
je case.0x10004d4a.2064
cmp eax, 0x1007
je case.0x10004d4a.2064
jmp case.0x10004d4a.2065
sub eax, 0x1407
je case.0x10004d4a.2064
sub eax, 5
jne case.0x10004d4a.2065
mov edi, 4
mov esi, 0x1000d628
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10004e36
test edi, edi
jle 0x10004e36
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
push str.system
push ecx
lea edx, [esp + 0x228]
push 0x1000dc9c
push edx
call fcn.10005dd0
mov eax, dword [esi]
add esp, 0x14
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push eax
push str.system32
push ecx
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp + 0x118]
lea ecx, [esp + 0x21c]
push 0
push eax
push ecx
call ebx
add esi, 4
dec edi
jne 0x10004dd8
pop edi
pop esi
pop ebx
add esp, 0x314
ret