Function at 0x1001bcad
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Query environment variable

Disassembly:
push 0x244
mov eax, 0x1008d11c
call fcn.1004606d
xor esi, esi
mov ecx, 0x100c2c40
mov dword [ebp - 0x250], esi
call fcn.1001a42e
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x1001bd03
mov edi, esi
mov ecx, 0x100c2c40
call fcn.1001aa93
push 0x12c
mov esi, eax
call ebx
test esi, esi
jne 0x1001bd01
mov eax, edi
inc edi
cmp eax, 0x3c
jl 0x1001bcda
xor eax, eax
inc eax
jmp 0x1001c03c
xor esi, esi
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.10023400
add esp, 0xc
mov dword [ebp - 0x24c], esi
mov edi, esi
push 0x104
lea eax, [ebp - 0x218]
push eax
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1001bd56
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, str.dV8KAV7EAsAu
lea ecx, [ebp - 0x248]
call fcn.10002295
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], 0x10
jb 0x1001bd75
mov esi, dword [esi]
test esi, esi
je 0x1001bdb8
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001bd7e
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x1001bd9e
mov edi, dword [ebp - 0x24c]
xor esi, esi
mov eax, esi
jmp 0x1001bdba
lea eax, [edi + edi]
call fcn.10023190
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.1001b6f9
mov edi, dword [ebp - 0x24c]
xor esi, esi
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_s_
push 0x104
push eax
call fcn.1001c5db
add esp, 0x14
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x248]
call fcn.10002c1a
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1001bdf0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x1001be10
xor esi, esi
mov eax, esi
jmp 0x1001be2b
add esi, esi
mov eax, esi
call fcn.10023190
mov ecx, esp
lea edx, [ebp - 0x218]
push 3
push esi
call fcn.1001b72c
xor esi, esi
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x64
call ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001be59
mov eax, edi
inc edi
mov dword [ebp - 0x24c], edi
cmp eax, 0x3c
jl 0x1001bd29
mov ebx, 0x100c1360
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_s
push 0x104
push eax
call fcn.1001c5db
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push ebx
lea ecx, [ebp - 0x230]
call fcn.1000e75a
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24c]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x24c], 0x2e
call fcn.1001c267
mov edi, str.64.dll
mov esi, eax
push edi
call fcn.10014d64
pop ecx
push eax
push edi
push 4
push esi
lea ecx, [ebp - 0x230]
call fcn.1001c0df
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x250], 0
je 0x1001bf85
push str.MoveFileExW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bf38
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x218]
push 3
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push edx
push ecx
call eax
lea ecx, [ebp - 0x218]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1001bf43
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x1001bf61
mov eax, ebx
jmp 0x1001bf7a
add esi, esi
mov eax, esi
call fcn.10023190
mov ecx, esp
lea edx, [ebp - 0x218]
push 3
push esi
call fcn.1001b72c
push eax
call fcn.1001a99c
jmp 0x1001c028
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
push 0x100c1360
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1001bfbe
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x1001bfdc
mov eax, ebx
jmp 0x1001bff5
add esi, esi
mov eax, esi
call fcn.10023190
mov ecx, esp
lea edx, [ebp - 0x218]
push 3
push esi
call fcn.1001b72c
push eax
lea ecx, [ebp - 0x248]
call fcn.10015553
mov byte [ebp - 4], 2
lea eax, [ebp - 0x248]
push eax
mov ecx, 0x100c2c40
call fcn.1001a46c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
push ebx
push 1
call fcn.10002c1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.10001770
xor eax, eax
lea esp, [ebp - 0x260]
call fcn.1004601c
ret