Function at 0x1000cc10
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x1012931e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x10194180]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x128], eax
xor eax, eax
mov dword [esp + 0x20], 0
mov ecx, 0x41
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x14]
call fcn.10001520
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov esi, 0x101360cc
mov byte [edi], cl
mov dword [esp + 0x134], 1
push ecx
lea ecx, [esp + 0x18]
call fcn.10001520
mov ebp, dword [esp + 0x14]
xor ecx, ecx
mov edi, ebp
mov byte [ebp], cl
mov byte [esp + 0x134], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 1
jns 0x1000ccc9
push 0x1a
lea eax, [esp + 0x2c]
push eax
push 0
call ebx
test eax, eax
je 0x1000cd38
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.100078e0
push str.MicrosoftSysDiag_
jmp 0x1000cd2f
push 0x2b
lea edx, [esp + 0x2c]
push edx
push 0
call ebx
test eax, eax
jne 0x1000cd1c
push 1
push 0x26
lea eax, [esp + 0x2c]
push eax
push 0
call ebx
test eax, eax
je 0x1000cd38
lea edi, [esp + 0x24]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000ccf0
mov ecx, dword [str.Common_Files]
mov edx, dword [0x10136a10]
mov eax, dword [0x10136a14]
mov dword [edi], ecx
mov cx, word [0x10136a18]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x14]
call fcn.100078e0
push str.Microsoft_SharedSysDiag_
lea ecx, [esp + 0x14]
call fcn.10008230
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jne 0x1000cd8f
lea ecx, [esp + 0x18]
push ecx
call fcn.1006c7c0
add esp, 4
mov byte [esp + 0x134], 3
mov eax, dword [eax]
add eax, 0x5c
push eax
lea ecx, [esp + 0x14]
call fcn.100078e0
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea edx, [edi + 4]
push edx
call esi
test eax, eax
jg 0x1000cd8f
push edi
call fcn.100569b3
add esp, 4
lea eax, [esp + 0x10]
push eax
call fcn.1000c9c0
add esp, 4
test al, al
je 0x1000cdf1
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x13c]
mov dword [ebx], edi
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x20], 1
mov byte [esp + 0x134], 1
add ebp, 0xfffffff8
lea edx, [ebp + 4]
push edx
call esi
test eax, eax
jg 0x1000cde0
push ebp
call fcn.100569b3
add esp, 4
mov byte [esp + 0x134], 0
lea eax, [edi + 4]
push eax
jmp 0x1000d145
push 1
push 0x1a
lea ecx, [esp + 0x2c]
push ecx
push 0
call ebx
test eax, eax
je 0x1000ce20
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.100078e0
push str.MicrosoftSysDiag_
lea ecx, [esp + 0x18]
call fcn.10008230
jmp 0x1000ce61
lea eax, [esp + 0x18]
push eax
call fcn.1006c8d0
add esp, 4
mov byte [esp + 0x134], 4
push eax
lea ecx, [esp + 0x18]
call fcn.10007e70
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call esi
test eax, eax
jg 0x1000ce61
push edi
call fcn.100569b3
add esp, 4
push str._SysDiag.cfg
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov byte [esp + 0x134], 5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete bl
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000cead
push edi
call fcn.100569b3
add esp, 4
test bl, bl
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
je 0x1000cf41
push str._SysDiag.cfg
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov edi, eax
mov bl, 6
mov byte [esp + 0x134], bl
push str._SysDiag.cfg
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call fcn.100082c0
mov byte [esp + 0x134], 7
mov edi, dword [edi]
mov eax, dword [eax]
push 0
push edi
push eax
call ebp
mov byte [esp + 0x134], bl
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000cf1f
push edi
call fcn.100569b3
add esp, 4
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x1c]
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call esi
test eax, eax
jg 0x1000cf41
push edi
call fcn.100569b3
add esp, 4
push str._SysDiag.sav
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov byte [esp + 0x134], 8
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete bl
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x1c]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000cf8d
push edi
call fcn.100569b3
add esp, 4
test bl, bl
je 0x1000d01b
push str._SysDiag.sav
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov edi, eax
mov bl, 9
mov byte [esp + 0x134], bl
push str._SysDiag.sav
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call fcn.100082c0
mov byte [esp + 0x134], 0xa
mov edi, dword [edi]
mov eax, dword [eax]
push 0
push edi
push eax
call ebp
mov byte [esp + 0x134], bl
mov edi, dword [esp + 0x1c]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000cff9
push edi
call fcn.100569b3
add esp, 4
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call esi
test eax, eax
jg 0x1000d01b
push edi
call fcn.100569b3
add esp, 4
push str._SysDiag2.dat
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov byte [esp + 0x134], 0xb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete bl
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x1c]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000d067
push edi
call fcn.100569b3
add esp, 4
test bl, bl
je 0x1000d0f5
push str._SysDiag2.dat
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100082c0
mov edi, eax
mov bl, 0xc
mov byte [esp + 0x134], bl
push str._SysDiag2.dat
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call fcn.100082c0
mov byte [esp + 0x134], 0xd
mov edi, dword [edi]
mov eax, dword [eax]
push 0
push edi
push eax
call ebp
mov byte [esp + 0x134], bl
mov edi, dword [esp + 0x1c]
add edi, 0xfffffff8
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000d0d3
push edi
call fcn.100569b3
add esp, 4
mov byte [esp + 0x134], 2
mov edi, dword [esp + 0x18]
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call esi
test eax, eax
jg 0x1000d0f5
push edi
call fcn.100569b3
add esp, 4
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x13c]
lea edi, [eax - 8]
lea edx, [edi + 4]
push edx
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x20], 1
mov byte [esp + 0x134], 1
lea eax, [edi + 4]
push eax
call esi
test eax, eax
jg 0x1000d132
push edi
call fcn.100569b3
add esp, 4
mov byte [esp + 0x134], 0
mov edi, dword [esp + 0x10]
add edi, 0xfffffff8
lea ecx, [edi + 4]
push ecx
call esi
test eax, eax
jg 0x1000d154
push edi
call fcn.100569b3
add esp, 4
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov eax, ebx
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
pop ebx
call fcn.100571c6
add esp, 0x128
ret