Function at 0x1000cf70
Capabilities:
Get common file path
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
xor edi, edi
push 4
or ecx, 0xffffffff
push edi
push eax
mov dword [ebp - 0x12c], eax
xor ebx, ebx
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x11c], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000d2af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000d293
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1000d020
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_GetWindowsDirectory_failed__code__d_n
call sym.vmtools.dll_Log
add esp, 0xc
jmp 0x1000d2b5
push str.WININIT.INI
push 0x1005d980
lea ecx, [ebp - 0x108]
push ecx
push str._s_s_s
push 0
call sym.vmtools.dll_Str_SafeAsprintf
push esi
mov dword [ebp - 0x114], eax
call fcn.1000ba90
add esp, 0x18
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x1000d06d
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_File_Fullpath_failed_n
call sym.vmtools.dll_Log
add esp, 8
jmp 0x1000d2b5
push eax
push str.NUL_s_r_n
push 0
call sym.vmtools.dll_Str_SafeAsprintf
mov esi, dword [ebp - 0x114]
add esp, 0xc
push 0
push 0x8000080
push 4
push 0
push 0
push 0xc0000000
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp eax, 0xffffffff
jne 0x1000d0c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_CreateFile_on__s_failed__code__d_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1000d2b5
lea edx, [ebp - 0x10c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x110], esi
cmp esi, 0xffffffff
jne 0x1000d126
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x1000d120
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x10c], edi
call esi
push eax
mov eax, dword [ebp - 0x114]
push eax
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_GetFileSize_on__s_failed__code__d_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1000d2b5
mov esi, dword [ebp - 0x110]
mov edx, ebx
lea ecx, [edx + 1]
jmp 0x1000d130
mov al, byte [edx]
inc edx
test al, al
jne 0x1000d130
sub edx, ecx
xor ecx, ecx
add edx, esi
adc ecx, dword [ebp - 0x10c]
push 0
add edx, 0xa
mov esi, edx
push esi
adc ecx, edi
push ecx
mov ecx, dword [ebp - 0x118]
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x128], eax
cmp eax, 0xffffffff
jne 0x1000d188
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_CreateFileMapping_failed__code__d_n
call sym.vmtools.dll_Log
add esp, 0xc
jmp 0x1000d2b5
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x1000d1bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_MapViewOfFile_failed__code__d_n
call sym.vmtools.dll_Log
add esp, 0xc
jmp 0x1000d2b5
push str._Rename__r_n
push edi
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
jne 0x1000d211
mov edx, dword [ebp - 0x110]
push str._Rename__r_n
push 0x1005de4c
add edx, edi
push esi
push edx
call sym.vmtools.dll_Str_Sprintf
mov ecx, dword [ebp - 0x110]
mov esi, dword [ebp - 0x10c]
cdq
add esp, 0x10
add ecx, eax
adc esi, edx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], esi
mov eax, ecx
mov dword [ebp - 0x11c], esi
jmp 0x1000d251
push 0xa
push eax
call dword [sym.imp.MSVCR90.dll_strchr]
mov esi, eax
mov eax, ebx
add esp, 8
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d225
mov ecx, dword [ebp - 0x110]
sub ecx, esi
add ecx, edi
push ecx
sub eax, edx
add eax, esi
push esi
push eax
call dword [sym.imp.MSVCR90.dll_memmove]
mov eax, esi
add esp, 0xc
sub eax, edi
cdq
mov dword [ebp - 0x11c], edx
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1000d256
sub ecx, esi
push ecx
add eax, edi
push ebx
push eax
call sub.MSVCR90.dll_memcpy
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000d271
sub eax, edx
add dword [ebp - 0x110], eax
mov eax, 0
mov dword [ebp - 0x11c], eax
adc dword [ebp - 0x10c], eax
jmp 0x1000d2b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.FileUnlinkDelayedSingle
push str.FILE:__s:_MoveFileExW_failed_on__s__code__d_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1000d2b5
mov dword [ebp - 0x11c], ebx
mov edx, dword [ebp - 0x12c]
mov esi, dword [sym.imp.MSVCR90.dll_free]
push edx
call esi
mov eax, dword [ebp - 0x114]
push eax
call esi
push ebx
call esi
mov ecx, dword [ebp - 0x124]
push ecx
call esi
add esp, 0x10
test edi, edi
je 0x1000d2e7
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x128]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x1000d2fb
push eax
call edi
mov esi, dword [ebp - 0x118]
cmp esi, 0xffffffff
je 0x1000d335
mov eax, dword [ebp - 0x110]
cmp eax, 0xffffffff
jne 0x1000d31a
cmp dword [ebp - 0x10c], 0
je 0x1000d32b
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret