Function at 0x10006850
Capabilities:
Check os version
Copy file
Get common file path

Disassembly:
sub esp, 0x3f0
push ebx
push ebp
push esi
lea eax, [esp + 0x160]
push edi
push eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x168], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.10001e30
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x10006f5c
mov edi, dword [esp + 0x410]
lea ecx, [esp + 0x2fc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
lea ebp, [edi + 0x118]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call fcn.100052e0
mov esi, dword [esp + 0x430]
lea edx, [esp + 0x14]
mov eax, esi
push edx
and eax, 0x7f000000
add edi, 0x18
push eax
push ebx
mov dword [esp + 0x24], edi
push edi
mov edi, dword [esp + 0x43c]
push edi
call fcn.10010b60
mov eax, dword [esp + 0x448]
mov ebx, dword [esp + 0x438]
add esp, 0x14
and eax, 8
mov dword [esp + 0x24], eax
jne 0x100069ca
test ebx, ebx
jne 0x100069ca
cmp dword [esp + 0x174], 2
jne 0x10006b39
cmp dword [esp + 0x168], 4
ja 0x10006b39
test esi, 0x200000
jne 0x10006b39
lea ecx, [esp + 0x1f8]
push 0x104
push ecx
call fcn.1000d960
add esp, 8
test eax, eax
je 0x10006b39
lea edi, [esp + 0x1f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100052e0
lea eax, [esp + 0x2fc]
lea ecx, [esp + 0x60]
push eax
push ecx
call fcn.1001bcb0
add esp, 8
test eax, eax
je 0x10006b39
lea edx, [esp + 0x1f8]
push ebx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10006b39
push ebx
push 2
lea eax, [esp + 0x200]
push ebx
push eax
call fcn.10001ef0
push eax
call fcn.10001f80
add esp, 0x14
jmp 0x10006b39
lea ecx, [esp + 0x1f8]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x1f8]
push 0x1001d368
push edx
call fcn.100053d0
test ebx, ebx
mov esi, ebx
jne 0x100069fc
lea esi, [esp + 0x1f8]
push 4
push ebp
call fcn.10005380
push eax
push esi
push 0
push 0
push ebp
call fcn.10005380
mov ebp, dword [esp + 0x24]
push eax
lea eax, [esp + 0x314]
push 0
push eax
push ebp
call fcn.10002500
mov edx, dword [edi]
add esp, 0x24
mov ecx, edi
push str.CatalogFile
push str.Version
call dword [edx + 0xc]
test eax, eax
je 0x10006b39
mov eax, dword [edi]
push 0
lea ecx, [esp + 0x64]
push 0x104
push ecx
push 1
mov ecx, edi
call dword [eax + 0x38]
test eax, eax
je 0x10006b39
mov al, byte [esp + 0x60]
test al, al
je 0x10006b39
lea edx, [esp + 0x2fc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 0x104]
push eax
call fcn.100168e2
add esp, 4
lea ecx, [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, eax
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x70]
push 0
lea eax, [esp + 0x310]
push edx
push eax
push edi
call esi
push eax
call fcn.100053d0
push eax
call fcn.100023b0
add esp, 0x18
test eax, eax
je 0x10006b00
mov eax, dword [esp + 0x418]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x70]
push 0
push edx
push eax
push edi
call esi
push eax
call fcn.100053d0
push eax
call fcn.100023b0
add esp, 0x18
test eax, eax
jne 0x10006b30
test ebx, ebx
mov eax, ebx
jne 0x10006b0d
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x60]
push 4
push ecx
push eax
push 0
lea edx, [esp + 0x70]
push 0
push edx
push 0
push edi
call fcn.100052e0
push eax
push ebp
call fcn.10002500
add esp, 0x24
push edi
call fcn.100168d7
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
push 1
call fcn.10005800
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
jne 0x10006b59
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x40c]
mov edx, dword [esp + 0x418]
mov ecx, dword [esp + 0x414]
push ebx
lea esi, [edi + 0xc]
push edx
mov edx, dword [esp + 0x18]
add edi, 0x10c
push eax
mov eax, dword [esp + 0x43c]
push esi
push edi
push eax
mov eax, dword [esp + 0x440]
push ecx
push edx
push eax
call fcn.100071a0
mov ebp, eax
add esp, 0x24
test ebp, ebp
je 0x10006bd9
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10006bac
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x430]
mov edx, dword [esp + 0x414]
push ebx
push eax
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x1c]
push edi
push ecx
push edx
push esi
push eax
call fcn.10006fc0
add esp, 0x20
mov ebp, eax
jmp 0x10006bdd
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10006c3e
mov ecx, dword [esp + 0x410]
push 4
lea edi, [ecx + 0x118]
push edi
call fcn.10005380
push eax
push ebx
push 0
push 0
push edi
call fcn.10005380
push eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100052e0
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.10002500
mov esi, dword [esp + 0x34]
add esp, 0x24
mov ecx, dword [esp + 0x434]
mov edx, dword [esp + 0x430]
mov eax, dword [esp + 0x420]
push 4
push ecx
mov ecx, dword [esp + 0x41c]
push edx
push ebx
push eax
push ecx
push esi
call fcn.10007320
lea edx, [esp + 0x3c]
push edx
push esi
push 2
call fcn.10005800
add esp, 0x28
test ebp, ebp
je 0x10006f2e
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x430]
test edi, 0x80800
je 0x10006cb2
push eax
push eax
push eax
mov eax, dword [esp + 0x444]
push 0xffffffffffffffff
push eax
call fcn.10002210
add esp, 0x14
jmp 0x10006cc2
mov ecx, dword [esp + 0x438]
push ecx
call fcn.100021d0
add esp, 4
mov dword [esp + 0x2c], eax
call fcn.10001760
xor ebp, ebp
cmp eax, ebp
je 0x10006ce1
push str.SetupDefaultQueueCallbackA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x428]
cmp eax, ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x38], edx
jne 0x10006cfc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x41c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x418]
lea edx, [esp + 0x60]
push eax
push edx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x410]
mov ecx, dword [esp + 0x42c]
add eax, 0x118
mov dword [esp + 0x30], eax
call fcn.100049a0
lea ecx, [esp + 0x60]
mov dword [esp + 0x34], eax
push ecx
push eax
call fcn.10014a30
add esp, 8
mov ebx, 2
test eax, eax
je 0x10006d61
or dword [esp + 0x4c], ebx
lea edx, [esp + 0x60]
push edx
call fcn.10014850
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
push eax
call fcn.10014940
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x48]
add esp, 8
cmp eax, 0xffffffff
jne 0x10006de5
lea ecx, [esp + 0x60]
push ecx
call fcn.100146b0
add esp, 4
cmp eax, ebp
jne 0x10006dce
test byte [esp + 0x4c], 2
jne 0x10006def
lea edx, [esp + 0x60]
push edx
call fcn.100052e0
push eax
call fcn.100146b0
add esp, 4
cmp eax, ebp
je 0x10006def
mov ecx, dword [esp + 0x4c]
push eax
or ecx, ebx
mov dword [esp + 0x50], ecx
call fcn.100054a0
mov dword [esp + 0x40], eax
jmp 0x10006def
mov ecx, dword [esp + 0x4c]
push eax
or ecx, 1
mov dword [esp + 0x50], ecx
call fcn.100054a0
mov dword [esp + 0x40], eax
jmp 0x10006def
mov eax, dword [esp + 0x4c]
or al, 1
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x24], ebp
je 0x10006dff
mov eax, dword [esp + 0x4c]
or al, 0x40
mov dword [esp + 0x4c], eax
and edi, 0x40
je 0x10006e25
cmp dword [esp + 0x174], ebx
jne 0x10006e25
cmp dword [esp + 0x168], 5
jb 0x10006e25
mov eax, dword [esi + 0x28]
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], eax
mov dword [esi + 0x28], ebp
mov ebx, dword [esp + 0x410]
push ebx
push esi
push 3
call fcn.10005800
mov eax, dword [0x1002362c]
add esp, 0xc
cmp eax, ebp
mov dword [0x10023600], 0x3e3
je 0x10006e61
mov dword [0x10023630], esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3f0
ret
mov edx, dword [esp + 0x438]
lea ecx, [esp + 0x28]
push ecx
push 0x10007d20
push esi
push edx
call fcn.10002180
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10006e90
push ebx
push esi
push 4
call fcn.10005800
add esp, 0xc
jmp 0x10006ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
mov dword [0x10023600], eax
mov dword [0x10023628], 0x230
jne 0x10006eb8
mov dword [0x10023628], 0x1fe
jmp 0x10006ee9
cmp eax, 5
jne 0x10006ec9
mov dword [0x10023628], 0x234
jmp 0x10006ee9
cmp eax, 0x52
jne 0x10006eda
mov dword [0x10023628], 0x237
jmp 0x10006ee9
cmp eax, 0x70
jne 0x10006ee9
mov dword [0x10023628], 0x238
test edi, edi
je 0x10006f0c
cmp dword [esp + 0x174], 2
jne 0x10006f0c
cmp dword [esp + 0x168], 5
jb 0x10006f0c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x28], eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.10002260
mov eax, dword [esp + 0x38]
add esp, 4
test eax, eax
je 0x10006f2e
mov ecx, dword [esp + 0x42c]
push eax
call fcn.10004980
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10006f69
xor ebp, ebp
mov edi, dword [0x10023600]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10006f4d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.10001e70
add esp, 4
mov dword [0x10023600], edi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x3f0
ret
test ebp, ebp
je 0x10006f38
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10006f79
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x408]
mov edx, dword [esp + 0x404]
push ecx
push edx
push 0
mov ecx, dword [esp + 0x444]
push 0
push 0
push 0
push 0
push 0x3ef
push eax
mov eax, dword [esp + 0x44c]
push eax
push ecx
call fcn.100020c0
mov edi, dword [0x10023600]
add esp, 0x2c
mov ebp, 1
jmp 0x10006f3e