Function at 0x1009377c
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x698
mov eax, dword [0x100df3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68c], ecx
mov dword [ebp - 0x438], 1
and dword [ebp - 0x650], 0
and dword [ebp - 0x654], 0
and word [ebp - 0x434], 0
push 0x208
push 0
lea eax, [ebp - 0x432]
push eax
call fcn.10070d10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 8]
push str._temp_RandomSubPathTag_
call fcn.100a6dbd
add esp, 0x10
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10070d10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
push dword [0x100fb264]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [ebp - 0x434]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
and word [ebp - 0x64c], 0
push 0x208
push 0
lea eax, [ebp - 0x64a]
push eax
call fcn.10070d10
add esp, 0xc
lea eax, [ebp - 0x64c]
push eax
push 0
push 0x100c277c
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp dword [ebp - 0x438], 0
je 0x100938a6
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100938a6
mov dword [ebp - 0x690], 1
jmp 0x100938ad
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x100938e8
push 0
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100938e8
mov dword [ebp - 0x694], 1
jmp 0x100938ef
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x100939dc
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x438], 0
je 0x10093939
cmp dword [ebp - 0x658], 0
je 0x10093939
mov dword [ebp - 0x698], 1
jmp 0x10093940
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x10093981
push 0x100c2780
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
je 0x10093981
mov dword [ebp - 0x69c], 1
jmp 0x10093988
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x100939c9
push 0x100c278c
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0
je 0x100939c9
mov dword [ebp - 0x6a0], 1
jmp 0x100939d0
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x10093c1a
mov eax, dword [ebp - 0x68c]
add eax, 0x14
push eax
lea ecx, [ebp - 0x664]
call fcn.10003c6c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x668]
call fcn.10003c52
mov byte [ebp - 4], 1
push 0
push 0x100c27a4
mov eax, dword [ebp - 0x68c]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x68c]
mov ecx, dword [ecx + 0x10]
mov eax, dword [eax]
push ecx
call dword [eax + 0x18]
mov dword [ebp - 0x660], eax
push dword [ebp - 0x660]
push 0x100c27b0
lea eax, [ebp - 0x668]
push eax
call fcn.10015e03
add esp, 0xc
lea ecx, [ebp - 0x65c]
call fcn.10003c52
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
push 0x100c27c8
lea eax, [ebp - 0x65c]
push eax
call fcn.10015e03
add esp, 0xc
lea ecx, [ebp - 0x65c]
call fcn.10012148
push eax
lea ecx, [ebp - 0x668]
call fcn.10012148
push eax
lea ecx, [ebp - 0x664]
call fcn.10023ebf
push dword [ebp - 0x660]
push 0x100c27e0
lea eax, [ebp - 0x668]
push eax
call fcn.10015e03
add esp, 0xc
push dword [ebp + 0xc]
push 0x100c27ec
lea eax, [ebp - 0x65c]
push eax
call fcn.10015e03
add esp, 0xc
lea ecx, [ebp - 0x65c]
call fcn.10012148
push eax
lea ecx, [ebp - 0x668]
call fcn.10012148
push eax
lea ecx, [ebp - 0x664]
call fcn.10023ebf
push 1
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x664]
call fcn.1003d645
mov dword [ebp - 0x6a4], eax
push 0x100c27f8
push dword [ebp - 0x6a4]
call fcn.1003722b
pop ecx
pop ecx
mov byte [ebp - 0x681], al
lea ecx, [ebp - 0x688]
call fcn.10010628
movzx eax, byte [ebp - 0x681]
test eax, eax
je 0x10093b45
push 0x100c27fc
lea ecx, [ebp - 0x664]
call fcn.10009f75
push dword [ebp - 0x660]
push 0x100c2800
push 0x100c281c
lea eax, [ebp - 0x668]
push eax
call fcn.10015e03
add esp, 0x10
push 0
lea ecx, [ebp - 0x668]
call fcn.10012148
push eax
lea ecx, [ebp - 0x664]
call fcn.10010711
test eax, eax
jge 0x10093b93
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp - 0x664]
call fcn.1003d62c
and dword [ebp - 0x680], 0
xor eax, eax
lea edi, [ebp - 0x67c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x680], 0x14
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x678], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x680]
push eax
call dword [ebp - 0x654]
lea ecx, [ebp - 0x664]
call fcn.10012148
push eax
call dword [ebp - 0x650]
mov dword [ebp - 0x66c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x65c]
call fcn.10010628
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x668]
call fcn.10010628
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x664]
call fcn.10010628
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e071
leave
ret 8