Function at 0x1002eea0
Capabilities:
Check if file exists
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a8c4e
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x100d5688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x274], ecx
mov dword [eax], 0
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1002f53a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x258], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1007f220
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x100d8aa0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ef80
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x258]
call fcn.10007bf0
push str.ClsTool.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.10044de0
mov edi, dword [ebp - 0x258]
add esp, 4
test eax, eax
jne 0x1002efdc
mov dword [ebp - 0x24c], 0x80070005
jmp 0x1002f4f8
call fcn.1008daac
cdq
mov ecx, 0x64
idiv ecx
mov eax, dword [esi + 0x48]
cmp edx, dword [eax + 0xc]
jge 0x1002f0f2
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1002f0de
push 4
push str.FILE
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.1000c680
mov byte [ebp - 4], 2
call fcn.1005dde0
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x360]
push 0x1a0
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.10009a70
mov esi, eax
push str.rand_check
push esi
mov byte [ebp - 4], 3
call fcn.100092f0
mov eax, dword [ebp - 0x24c]
add esp, 8
mov ecx, eax
mov edx, dword [eax]
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x360]
call fcn.1000a930
lea ecx, [ebp - 0x230]
call fcn.100074f0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.100074f0
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1002f544
jmp 0x1002f299
call fcn.10027850
test eax, eax
je 0x1002f0de
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1002f54e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24c], eax
push edi
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 4
push str._s_taskpop.exe
push eax
call fcn.100078e0
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x218]
add esp, 0xc
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002f381
lea ecx, [ebp - 0x218]
mov eax, esi
mov edi, ecx
mov edx, 0x104
sub eax, edi
mov edi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002f18e
movzx eax, word [edi + ecx]
test ax, ax
je 0x1002f18e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002f170
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x258]
movzx eax, al
sub eax, 1
jne 0x1002f381
push 4
push str.FILE
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 5
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.1000c680
mov byte [ebp - 4], 6
call fcn.1005dde0
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x360]
push 0x1b4
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.10009a70
mov dword [ebp - 0x254], eax
push str.rand_check_IsxxxSafeRunning
push eax
mov byte [ebp - 4], 7
call fcn.100092f0
mov eax, dword [ebp - 0x250]
add esp, 8
mov ecx, eax
mov edx, dword [eax]
push dword [ebp - 0x254]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x360]
call fcn.1000a930
lea ecx, [ebp - 0x248]
call fcn.100074f0
lea ecx, [ebp - 0x230]
call fcn.100074f0
jmp 0x1002f381
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 8
call fcn.1008daac
cdq
mov esi, 0x1a
idiv esi
lea eax, [edx + 0x61]
mov dword [ebp - 0x254], eax
call fcn.1008daac
cdq
idiv esi
lea eax, [edx + 0x61]
mov dword [ebp - 0x250], eax
call fcn.1008daac
cdq
idiv esi
lea esi, [edx + 0x61]
call fcn.1008daac
cdq
mov ecx, 0x1a
idiv ecx
mov eax, dword [ebp - 0x254]
movzx eax, ax
add edx, 0x61
push eax
mov eax, dword [ebp - 0x250]
movzx eax, ax
push eax
movzx eax, si
push eax
movzx eax, dx
push eax
push edi
lea eax, [ebp - 0x24c]
push str._s_c_c_c_c32.exe
push eax
call fcn.100078e0
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x218]
add esp, 0x1c
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1002f381
lea ecx, [ebp - 0x218]
mov eax, esi
mov edi, ecx
mov edx, 0x104
sub eax, edi
mov edi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002f36e
movzx eax, word [ecx + edi]
test ax, ax
je 0x1002f36e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002f350
mov edi, dword [ebp - 0x258]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1002f39d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1002f558
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24c], eax
push dword [ebp - 0x25c]
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 9
push dword [ebp - 0x260]
push dword [ebp - 0x264]
push dword [ebp + 0x10]
push dword [ebp - 0x268]
push dword [ebp - 0x26c]
push str.Utilsutility.dll
push str.__dll_s___entryRunTB___hwnd_p___filemap__s____length_u___icon_path__s____thumbnail_path__s____preview_path__s_
push eax
call fcn.100078e0
push 0x40
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2c8], 0x44
push 0
push eax
call fcn.1007f220
mov esi, dword [ebp - 0x24c]
xorps xmm0, xmm0
add esp, 0x30
movups xmmword [ebp - 0x284], xmm0
cmp dword [esi - 4], 1
jle 0x1002f43e
push dword [esi - 0xc]
lea ecx, [ebp - 0x24c]
call fcn.10007860
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1002f485
lea eax, [ebp - 0x218]
push eax
call fcn.10039ed0
add esp, 4
mov dword [ebp - 0x24c], 0x80004005
jmp 0x1002f4dc
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x270]
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0x284]
mov dword [ecx], eax
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002f4b0
sub edx, ecx
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x274]
sar edx, 1
push edx
push eax
call fcn.10007bf0
mov dword [ebp - 0x24c], 0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1002f4f8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1002f517
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005f06c
mov esp, ebp
pop ebp
ret 0x20
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
int3