Function at 0x1006c070
Capabilities:
Copy file
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099316
mov eax, dword fs:[0]
push eax
mov eax, 0x1970
call fcn.1008bd60
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x196c], edx
mov dword [ebp - 0x1970], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0
push 0
mov dword [ebp - 0x1968], 0
mov dword [ebp - 0x18d0], 0
mov dword [ebp - 0x18cc], 0
call fcn.1006f8b0
mov dword [ebp - 0x18d0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1660], 7
mov dword [ebp - 0x1664], 0
mov word [ebp - 0x1674], ax
push 0x100
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c124
sub ecx, edx
sar ecx, 1
je 0x1006c14e
cmp word [ebp + ecx*2 - 0x416], 0x5c
je 0x1006c14e
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x414], ax
inc ecx
add ecx, ecx
cmp ecx, 0x200
jae 0x1006c463
xor eax, eax
push 0x100
mov word [ebp + ecx - 0x414], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1978]
push eax
lea eax, [ebp - 0x1974]
push eax
lea eax, [ebp - 0x197c]
push eax
push 0x101
lea eax, [ebp - 0x614]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x1006c3f2
lea edx, [ebp - 0x214]
mov ecx, edi
sub edx, edi
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006c1b0
mov ebx, edi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1006c1c5
sub ebx, ecx
lea ecx, [ebp - 0xe14]
sar ebx, 1
sub ecx, esi
lea esp, [esp]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1006c1e0
lea ecx, [ebp - 0xe14]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006c200
mov esi, dword [ebp - 0x1970]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x194c], eax
sub ecx, edx
mov edx, dword [ebp - 0x196c]
lea eax, [ebp - 0x414]
push eax
push edi
sar ecx, 1
lea eax, [ebp - 0xe14]
push ecx
push eax
lea eax, [ebp - 0x18c4]
mov dword [ebp - 0x1948], ebx
push eax
push 0
push 0
lea eax, [ebp - 0x1968]
mov dword [ebp - 0x1944], 0xffffffff
push eax
lea eax, [ebp - 0x1964]
mov dword [ebp - 0x1940], 0
push eax
mov ecx, esi
call fcn.1006af10
add esp, 0x24
mov dword [ebp - 0x196c], eax
lea ecx, [ebp - 0x1964]
call fcn.1006a9b0
mov edi, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
test eax, eax
je 0x1006c366
lea edx, [ebp - 0x18e4]
lea ecx, [ebp - 0x165c]
call fcn.10069fc0
push dword [ebp - 0x194c]
lea ecx, [ebp - 0x1674]
call fcn.100632c0
lea eax, [ebx*2 - 2]
cmp eax, 0x200
jae 0x1006c463
xor ecx, ecx
mov word [ebp + eax - 0x214], cx
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.1007b71d
add esp, 8
test eax, eax
je 0x1006c300
mov ecx, str.sendlist.abc
lea edx, [eax + 2]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006c2f0
lea edi, [esi + 0x154c]
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [ebp - 0x1674]
push eax
lea ecx, [esi + 0x1444]
call fcn.1006f2c0
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x1614]
call fcn.10068f60
push 0
lea eax, [ebp - 0x1614]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea edx, [ebp - 0x214]
lea ecx, [esi + 0x1444]
call fcn.10069b60
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call edi
inc dword [ebp - 0x1968]
cmp dword [ebp - 0x196c], 0
jbe 0x1006c3f2
lea ebx, [ebx*2 - 2]
cmp ebx, 0x200
jae 0x1006c463
xor eax, eax
mov word [ebp + ebx - 0x214], ax
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.1007b71d
add esp, 8
test eax, eax
je 0x1006c3c0
mov ecx, str.filelist.abc
lea edx, [eax + 2]
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006c3b0
add esi, 0x151c
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea ecx, [ebp - 0x214]
call fcn.10068fb0
mov ecx, dword [ebp - 0x1970]
lea edx, [ebp - 0x214]
lea ecx, [ecx + 0x143c]
call fcn.10069490
push esi
call edi
cmp dword [ebp - 0x1660], 8
mov esi, dword [ebp - 0x1968]
jb 0x1006c40f
push dword [ebp - 0x1674]
call fcn.1007b9e6
add esp, 4
xor eax, eax
mov dword [ebp - 0x1660], 7
lea ecx, [ebp - 0x18d0]
mov dword [ebp - 0x1664], 0
mov word [ebp - 0x1674], ax
call fcn.1006f1e0
push dword [ebp - 0x18d0]
call fcn.1007b9e6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret
call fcn.1007bb23
int3