Function at 0x111242e
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x127fa0f
call fcn.01160168
sub esp, 0x4a4
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [0x12ce0a0]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4a8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x104
lea ecx, [ebp - 0x4a8]
call fcn.0103299e
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push eax
push ebx
push ebx
push 0x800e
push ebx
mov dword [ebp - 0x494], eax
call esi
test eax, eax
jge 0x1112496
push dword [ebp - 0x494]
push ebx
push ebx
push 0x8005
push ebx
call esi
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 1
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 2
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 3
mov eax, dword [edi + 0xda0]
xor esi, esi
cmp eax, 2
jne 0x11124dc
mov esi, 0xf4af
push 0x100cb58
jmp 0x11124fb
cmp eax, 1
jne 0x11124ed
mov esi, 0xf018
push 0x100cb50
jmp 0x11124fb
cmp eax, ebx
jne 0x1112506
mov esi, 0xf019
push 0x100cb48
lea ecx, [ebp - 0x4a0]
call fcn.01032977
push ebx
lea eax, [ebp - 0x4ac]
push eax
push esi
call fcn.01104f07
push 0x219
lea ecx, [ebp - 0x4a4]
call fcn.01032a95
mov eax, dword [edi + 0xf20]
push ebx
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x490]
push 0x20806
push eax
push dword [ebp - 0x4a0]
push ebx
call fcn.01068c6a
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x448], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x490]
call fcn.01065cb1
mov esi, eax
dec esi
neg esi
sbb esi, esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x4a8]
inc esi
call fcn.01032a0b
cmp esi, ebx
je 0x11126dc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x498]
call fcn.01045d3e
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x498]
cmp dword [eax - 8], 0x104
jl 0x111264f
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x494], eax
mov byte [ebp - 4], 6
push 0xf03d
lea ecx, [ebp - 0x494]
call fcn.01032a95
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 7
push 0xf006
lea ecx, [ebp - 0x4b0]
call fcn.01032a95
call fcn.0115c814
or eax, 0x30
push eax
push dword [ebp - 0x4b0]
lea ecx, [edi + 0x18]
push dword [ebp - 0x494]
call fcn.01061647
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4b0]
call fcn.010328fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x494]
call fcn.010328fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.010454b8
mov esi, 0x80004005
jmp 0x11126de
lea ecx, [ebp - 0x49c]
call fcn.01044ec9
mov byte [ebp - 4], 8
lea eax, [ebp - 0x49c]
push eax
push ebx
mov ecx, edi
call fcn.0110a19a
mov esi, eax
cmp esi, ebx
jge 0x1112693
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.010454b8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.010454b8
jmp 0x11126de
push ebx
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x11126be
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.010454b8
jmp 0x1112636
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x49c]
call fcn.010454b8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x498]
call fcn.010454b8
xor esi, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x490]
call fcn.0106772f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4a0]
call fcn.010328fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a4]
call fcn.010328fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4ac]
call fcn.010328fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a8]
call fcn.010328fa
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret