Function at 0x10006620
Capabilities:
Copy file
Get session user name
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1002e581
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x13c]
xor ebp, ebp
push 0x104
push eax
push ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x240]
push ecx
push edx
mov dword [esp + 0x20], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x13c]
push 0x5c
push eax
call fcn.1000befc
inc eax
lea ecx, [esp + 0x248]
push eax
push ecx
lea edx, [esp + 0x354]
push str.C:Users_sAppDataLocal_s
push edx
call fcn.1000beaa
add esp, 0x18
lea eax, [esp + 0x344]
lea ecx, [esp + 0x13c]
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x12c]
push edx
call fcn.10003850
lea eax, [esp + 0x38]
mov dword [esp + 0x454], ebp
push eax
call fcn.100034b0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x458], 1
push ecx
call fcn.10003940
push eax
lea edx, [esp + 0x44]
lea eax, [esp + 0x10c]
push edx
push eax
mov byte [esp + 0x468], 2
call fcn.1000aaa0
add esp, 0x18
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x454], 4
call fcn.10008620
lea ecx, [esp + 0x1c]
push ecx
call fcn.10003f60
push eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x114]
push edx
push eax
mov byte [esp + 0x460], 5
call fcn.1000aaa0
add esp, 0x10
mov byte [esp + 0x450], 7
push 1
lea ecx, [esp + 0x20]
call fcn.10008620
lea ecx, [esp + 0x54]
push ecx
call fcn.100042d0
push eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x124]
push edx
push eax
mov byte [esp + 0x460], 8
call fcn.1000aaa0
add esp, 0x10
push 1
lea ecx, [esp + 0x58]
mov byte [esp + 0x454], 0xa
call fcn.10008620
mov eax, dword [esp + 0x100]
mov esi, 0x10030450
cmp eax, ebp
je 0x100067a2
mov esi, eax
lea ecx, [esp + 0xc8]
mov dword [esp + 0x6c], 0x10030458
call fcn.10008670
mov dword [esp + 0x10], 1
push ebp
lea ecx, [esp + 0x78]
push ebp
push ecx
lea ecx, [esp + 0x78]
mov byte [esp + 0x45c], 0xb
call fcn.100086c0
push ebp
lea ecx, [esp + 0x78]
mov dword [esp + 0x454], 0xc
call fcn.100095d0
mov edx, dword [esp + 0x6c]
push 0x25
push esi
lea ecx, [esp + 0x7c]
mov eax, dword [edx + 4]
mov byte [esp + 0x458], 0xd
mov dword [esp + eax + 0x74], 0x10030454
call fcn.100097d0
test eax, eax
jne 0x10006825
mov ecx, dword [esp + 0x6c]
push ebp
push 2
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x74]
call fcn.10006fd0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0x450], 0xe
mov ecx, dword [eax + 4]
mov ecx, dword [esp + ecx + 0x70]
test cl, 6
jne 0x10006858
mov edx, dword [eax + 4]
push 1
push 1
lea eax, [esp + 0x24]
mov ecx, dword [esp + edx + 0x9c]
push ebp
push eax
call fcn.10008d80
jmp 0x10006863
push 0xffffffffffffffff
lea ecx, [esp + 0x58]
call fcn.10008680
mov ecx, 6
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea esi, [edx + ecx]
push esi
call fcn.10028375
mov ebx, eax
mov eax, dword [esp + 0x70]
add esp, 4
mov ecx, dword [eax + 4]
test byte [esp + ecx + 0x70], 6
jne 0x100068ab
mov edx, ecx
push 1
push ebp
lea eax, [esp + 0x24]
mov ecx, dword [esp + edx + 0x9c]
push ebp
push eax
call fcn.10008d80
push esi
push ebx
lea ecx, [esp + 0x74]
call fcn.10007010
lea ecx, [esp + 0x74]
call fcn.100098a0
test eax, eax
jne 0x100068d6
mov ecx, dword [esp + 0x6c]
push ebp
push 2
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x74]
call fcn.10006fd0
add esi, 0xfff2cffa
push esi
call fcn.10028375
mov edi, eax
push esi
push ebp
push edi
push 0xd3006
push ebx
call fcn.100060b0
push 6
call fcn.10028375
mov ebp, eax
push 6
push 0
push ebp
push 0xd3000
push ebx
call fcn.100060b0
push 6
lea eax, [esp + 0x78]
push ebp
push eax
call fcn.100060e0
push 0x1003d960
push 0x1003d950
push esi
push 0
push edi
mov byte [esp + 0x4a0], 0xf
call fcn.10006370
mov eax, dword [esp + 0x160]
add esp, 0x50
test eax, eax
mov dword [esp + 0x14], 0
jne 0x1000694e
mov eax, 0x10030450
push eax
call fcn.10005dd0
add esp, 4
test al, al
je 0x100069c7
mov eax, dword [0x1003d978]
push 0x1003d980
push eax
mov ecx, 0x1003d970
call fcn.10008dc0
mov eax, dword [0x1003d954]
mov ecx, dword [eax]
push ecx
push 0
mov ecx, 0x1003d960
call fcn.10007130
mov edx, dword [eax]
lea eax, [esp + 0x48]
push edx
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.10006cd0
call fcn.10006230
mov ecx, dword [0x1003d974]
mov dword [ecx], eax
mov edx, dword [0x1003d974]
mov eax, dword [0x1003d964]
lea ecx, [esp + 0x2c]
mov dword [edx + 4], eax
mov edx, dword [0x1003d974]
push ecx
push 0
jmp 0x10006a57
mov eax, dword [esp + 0x120]
test eax, eax
jne 0x100069d7
mov eax, 0x10030450
push eax
call fcn.10005dd0
add esp, 4
test al, al
je 0x10006a78
mov eax, dword [0x1003d978]
push 0x1003d980
push eax
mov ecx, 0x1003d970
call fcn.10008dc0
mov eax, dword [0x1003d954]
mov ecx, 0x1003d960
mov eax, dword [eax + 4]
push eax
push 1
call fcn.10007130
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.10006cd0
call fcn.10006230
mov ecx, dword [0x1003d974]
mov dword [ecx + 8], eax
mov edx, dword [0x1003d964]
mov eax, dword [0x1003d974]
add edx, 4
lea ecx, [esp + 0x2c]
mov dword [eax + 0xc], edx
mov edx, dword [0x1003d974]
push ecx
push 0
add edx, 8
push edx
push 0x100061f0
push 0
push 0
call fcn.10005ed0
add esp, 0x30
push 0x2710
call fcn.10005fd0
add esp, 4
jmp 0x10006a69
xor esi, esi
mov ecx, dword [0x1003d954]
mov eax, dword [0x1003d958]
test ecx, ecx
je 0x10006aff
mov edx, eax
sub edx, ecx
sar edx, 2
cmp esi, edx
jae 0x10006aff
mov eax, dword [0x1003d978]
push 0x1003d980
push 1
push eax
mov ecx, 0x1003d970
call fcn.10009cd0
mov eax, dword [0x1003d954]
mov ecx, 0x1003d960
mov eax, dword [eax + esi*4]
push eax
push esi
call fcn.10007130
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.10006cd0
call fcn.10006230
mov ecx, dword [0x1003d974]
add esp, 0x18
mov dword [ecx + esi*8], eax
mov edx, dword [0x1003d964]
mov ecx, dword [0x1003d974]
lea eax, [edx + esi*4]
mov dword [ecx + esi*8 + 4], eax
inc esi
jmp 0x10006a7a
xor esi, esi
test ecx, ecx
je 0x10006a69
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x10006a69
mov eax, dword [0x1003d974]
lea edx, [esp + 0x14]
push edx
push 0
lea ecx, [eax + esi*8]
push ecx
push 0x100061f0
push 0
push 0
call fcn.10005ed0
mov eax, dword [0x1003d958]
mov ecx, dword [0x1003d954]
add esp, 0x18
inc esi
jmp 0x10006b01