Function at 0x10002857
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path
Get file attributes
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10031548
mov eax, dword fs:[0]
push eax
sub esp, 0x708
mov eax, dword [0x1003c030]
xor eax, esp
mov dword [esp + 0x700], eax
push ebx
push esi
push edi
mov eax, dword [0x1003c030]
xor eax, esp
push eax
lea eax, [esp + 0x718]
mov dword fs:[0], eax
lea eax, [esp + 0xe0]
push eax
mov edi, ecx
call fcn.10002206
and dword [esp + 0x720], 0
cmp dword [edi + 0x50], 8
jb 0x100028b9
mov eax, dword [edi + 0x3c]
jmp 0x100028bc
lea eax, [edi + 0x3c]
push dword [edi + 0xbc]
push eax
push str.process_file_dispatch:__s__conflict_mode:__d
call fcn.10008226
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
cmp dword [edi + 0xb4], 0
je 0x1000290c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
push ebx
call fcn.10019e25
pop ecx
call fcn.10019e37
xor edx, edx
div dword [edi + 0xb4]
imul edx, edx, 0x3e8
push edx
call esi
and dword [esp + 0x10], 0
lea ebx, [edi + 0x20]
inc dword [esp + 0x10]
cmp dword [esp + 0xf8], 8
mov edx, dword [esp + 0xe4]
jae 0x10002930
lea edx, [esp + 0xe4]
mov ecx, ebx
call fcn.10001dfa
test eax, eax
je 0x100029d6
push str.download_attach_error__retry_later
call fcn.100084fc
mov dword [esp], 0xbb8
call esi
cmp dword [esp + 0x10], 3
jl 0x10002914
push str.download_task_file_err
lea esi, [esp + 0xac]
call fcn.10003a3e
mov eax, esi
push eax
lea eax, [esp + 0xc8]
push eax
mov byte [esp + 0x728], 1
call fcn.10001206
push eax
push 4
push edi
mov byte [esp + 0x734], 2
call fcn.100019ec
add esp, 0x14
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xcc]
call fcn.10003e16
push ebx
push 1
mov byte [esp + 0x728], bl
call fcn.10003f0e
cmp dword [edi + 0x18], 0x10
jb 0x100029c1
mov edi, dword [edi + 4]
jmp 0x100029c4
add edi, 4
push edi
push str.download_attach_err__task:_hs
call fcn.100084fc
pop ecx
pop ecx
jmp 0x100032d1
and dword [esp + 0xa0], 0
xor eax, eax
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
mov byte [esp + 0x720], 3
mov eax, dword [edi + 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x10002a70
push 0xffffffffffffffff
lea ecx, [esp + 0x90]
lea eax, [edi + 0x58]
push ecx
xor ebx, ebx
call fcn.10003e61
cmp dword [esp + 0xa4], 8
mov eax, dword [esp + 0x90]
jae 0x10002a34
lea eax, [esp + 0x90]
push eax
call esi
cmp eax, 0xffffffff
jne 0x10002a5f
cmp dword [esp + 0xa4], 8
mov eax, dword [esp + 0x90]
jae 0x10002a54
lea eax, [esp + 0x90]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esp + 0xa4], 8
mov eax, dword [esp + 0x90]
jae 0x10002a77
lea eax, [esp + 0x90]
push eax
call esi
cmp eax, 0xffffffff
jne 0x10002aee
xor eax, eax
cmp dword [esp + 0xf8], 8
mov word [esp + 0xfc], ax
mov eax, dword [esp + 0xe4]
jae 0x10002aa1
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10034c8c
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xfc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10002acd
sub eax, edx
sar eax, 1
lea ecx, [esp + 0xfc]
lea esi, [esp + 0x8c]
call fcn.100044cf
and dword [esp + 0x84], 0
xor eax, eax
mov dword [esp + 0x88], 7
mov word [esp + 0x74], ax
mov byte [esp + 0x720], 4
cmp byte [edi + 0x54], al
je 0x10002c6b
mov edx, dword [esp + 0x90]
push 8
pop esi
cmp dword [esp + 0xa4], esi
jae 0x10002b33
lea edx, [esp + 0x90]
mov ecx, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x10002b4a
lea ecx, [esp + 0xe4]
push dword [edi + 0xbc]
call fcn.10016f48
pop ecx
test eax, eax
je 0x10002b98
mov edx, dword [esp + 0x90]
cmp dword [esp + 0xa4], esi
jae 0x10002b71
lea edx, [esp + 0x90]
mov ecx, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x10002b88
lea ecx, [esp + 0xe4]
push eax
push edx
push ecx
push str.archive_extract_failed:__s___s:__d
call fcn.100084fc
add esp, 0x10
xor eax, eax
push 0x206
push eax
mov word [esp + 0x104], ax
lea eax, [esp + 0x106]
push eax
call fcn.1001bc00
add esp, 0xc
cmp dword [edi + 0x50], esi
jb 0x10002bc2
mov eax, dword [edi + 0x3c]
jmp 0x10002bc5
lea eax, [edi + 0x3c]
push 0x104
push eax
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor ecx, ecx
mov word [eax], cx
push 0x10034ce0
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xcc]
push eax
call fcn.100051f0
add esp, 0xc
lea ecx, [esp + 0xfc]
push ecx
push eax
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x72c], 5
call fcn.100051f0
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
push ecx
xor ebx, ebx
mov byte [esp + 0x728], 6
call fcn.10003e61
push ebx
push 1
lea esi, [esp + 0xb0]
call fcn.10003f0e
push ebx
push 1
lea esi, [esp + 0xcc]
mov byte [esp + 0x728], 4
call fcn.10003f0e
jmp 0x10002da6
push 0x10034ce0
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xcc]
push eax
call fcn.100051f0
add esp, 0xc
lea ecx, [edi + 0x38]
push ecx
push eax
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0x72c], 7
call fcn.10005236
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
push ecx
xor ebx, ebx
mov byte [esp + 0x728], 8
call fcn.10003e61
push ebx
push 1
lea esi, [esp + 0xb0]
call fcn.10003f0e
push ebx
push 1
lea esi, [esp + 0xcc]
mov byte [esp + 0x728], 4
call fcn.10003f0e
cmp dword [esp + 0x88], 8
mov eax, dword [esp + 0x74]
jae 0x10002cf3
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002d66
cmp dword [edi + 0xbc], 2
jne 0x10002d66
cmp dword [esp + 0x88], 8
mov edx, dword [esp + 0x74]
jae 0x10002d19
lea edx, [esp + 0x74]
lea ecx, [esp + 0xc4]
call fcn.10005c3d
cmp dword [esp + 0xdc], 8
mov ecx, dword [esp + 0xc8]
jae 0x10002d3d
lea ecx, [esp + 0xc8]
cmp dword [esp + 0x88], 8
mov eax, dword [esp + 0x74]
jae 0x10002d4f
lea eax, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
push 1
lea esi, [esp + 0xcc]
call fcn.10003f0e
cmp dword [esp + 0x88], 8
mov ecx, dword [esp + 0x74]
jae 0x10002d78
lea ecx, [esp + 0x74]
cmp dword [esp + 0xf8], 8
mov eax, dword [esp + 0xe4]
jae 0x10002d90
lea eax, [esp + 0xe4]
xor edx, edx
cmp dword [edi + 0xbc], ebx
setne dl
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
cmp byte [edi + 0x94], bl
je 0x10002de9
cmp dword [esp + 0x88], 8
mov eax, dword [esp + 0x74]
jae 0x10002dc0
lea eax, [esp + 0x74]
push eax
push 0x10034ce4
call fcn.10008391
cmp dword [esp + 0x90], 8
mov eax, dword [esp + 0x7c]
pop ecx
pop ecx
jae 0x10002ddf
lea eax, [esp + 0x74]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push ebx
lea eax, [esp + 0x1c]
call fcn.1000e9d9
movzx eax, byte [edi + 0x94]
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x28], esp
push eax
call fcn.1000db06
lea eax, [esp + 0x2c]
push eax
mov edx, str.autoDelete
mov byte [esp + 0x73c], 0xc
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0xb
call fcn.1000ddc2
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.10001206
sub esp, 0x10
mov byte [esp + 0x738], 0xd
mov edx, eax
mov esi, esp
mov dword [esp + 0x28], esp
call fcn.1000dbcc
lea eax, [esp + 0x2c]
push eax
mov edx, str.filePath
mov byte [esp + 0x73c], 0xe
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0xd
call fcn.1000ddc2
push ebx
push 1
lea ecx, [esp + 0xb0]
mov byte [esp + 0x728], 0xb
call fcn.10003e16
lea eax, [edi + 0x38]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.10001206
sub esp, 0x10
mov byte [esp + 0x738], 0xf
mov edx, eax
mov esi, esp
mov dword [esp + 0x28], esp
call fcn.1000dbcc
lea eax, [esp + 0x2c]
push eax
mov edx, str.fileName
mov byte [esp + 0x73c], 0x10
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0xf
call fcn.1000ddc2
push ebx
push 1
lea ecx, [esp + 0xb0]
mov byte [esp + 0x728], 0xb
call fcn.10003e16
lea eax, [edi + 0x78]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.10001206
sub esp, 0x10
mov byte [esp + 0x738], 0x11
mov dword [esp + 0x28], esp
mov edx, eax
mov esi, esp
call fcn.1000dbcc
lea eax, [esp + 0x2c]
push eax
mov edx, str.argv
mov byte [esp + 0x73c], 0x12
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0x11
call fcn.1000ddc2
push ebx
push 1
lea ecx, [esp + 0xb0]
call fcn.10003e16
movzx eax, byte [edi + 0x74]
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x28], esp
push eax
call fcn.1000db06
lea eax, [esp + 0x2c]
push eax
mov edx, str.exec
mov byte [esp + 0x73c], 0x13
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0xb
call fcn.1000ddc2
movzx eax, byte [edi + 0x95]
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x28], esp
push eax
call fcn.1000db06
lea eax, [esp + 0x2c]
push eax
mov edx, str.alert
mov byte [esp + 0x73c], 0x14
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0xb
call fcn.1000ddc2
cmp dword [edi + 0xac], ebx
je 0x10003039
lea eax, [edi + 0x98]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.10001206
sub esp, 0x10
mov byte [esp + 0x738], 0x15
mov edx, eax
mov esi, esp
mov dword [esp + 0x28], esp
call fcn.1000dbcc
lea eax, [esp + 0x2c]
push eax
mov edx, str.message
mov byte [esp + 0x73c], 0x16
call fcn.1000ec75
mov esi, eax
mov byte [esp + 0x738], 0x15
call fcn.1000ddc2
push ebx
push 1
lea ecx, [esp + 0xb0]
call fcn.10003e16
xor eax, eax
mov word [esp + 0x50c], ax
mov esi, 0x100
push esi
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [esp + 0xfc], ax
cmp dword [edi + 0xb8], ebx
je 0x1000311a
push 0x40e
lea eax, [esp + 0x102]
push ebx
push eax
call fcn.1001bc00
add esp, 0xc
cmp dword [edi + 0x90], 8
jb 0x10003091
mov eax, dword [edi + 0x7c]
jmp 0x10003094
lea eax, [edi + 0x7c]
cmp dword [esp + 0x88], 8
mov ecx, dword [esp + 0x74]
jae 0x100030a6
lea ecx, [esp + 0x74]
push eax
push ecx
push str.__s___s
lea eax, [esp + 0x108]
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [esp + 0xfc]
push eax
call fcn.10005ecc
mov dword [esp + 0x10], eax
mov byte [esp + 0x720], 0x17
cmp eax, ebx
je 0x100030e5
cmp eax, 0xffffffff
jne 0x10003104
cmp dword [esp + 0x88], 8
mov eax, dword [esp + 0x74]
jae 0x100030f7
lea eax, [esp + 0x74]
push eax
push str.exec_failed:__s
call fcn.100084fc
pop ecx
pop ecx
lea eax, [esp + 0x10]
mov byte [esp + 0x720], 0xb
call fcn.100011b0
jmp 0x1000326a
push esi
lea eax, [esp + 0x100]
push eax
push dword [0x1003f000]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [esp + 0x34]
mov dword [esp + 0x30], vtable.Json::FastWriter.0
call fcn.1000398b
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x58]
mov byte [esp + 0x724], 0x18
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x38]
call dword [eax + 4]
push eax
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x728], 0x19
call fcn.10016756
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x5c]
call fcn.10003e16
push ebx
mov byte [esp + 0x724], 0x1c
push 1
mov ecx, esi
mov dword [esp + 0x38], vtable.Json::FastWriter.0
call fcn.10003e16
cmp dword [esp + 0xc0], 0x10
mov eax, dword [esp + 0xac]
mov dword [esp + 0x30], vtable.Json::Writer.0
jae 0x100031c7
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x514]
push eax
push str._ls_rundll32.exe__ls_RunAsUser__hs
lea ecx, [esp + 0xd4]
call fcn.100063d6
add esp, 0x10
mov byte [esp + 0x720], 0x1d
cmp dword [esp + 0xdc], 8
mov eax, dword [esp + 0xc8]
jae 0x1000320c
lea eax, [esp + 0xc8]
push eax
push str.rundll32:_ls
call fcn.10017419
cmp dword [esp + 0xe4], 8
mov eax, dword [esp + 0xd0]
pop ecx
pop ecx
jae 0x10003231
lea eax, [esp + 0xc8]
push eax
call fcn.10006019
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
call fcn.100011b0
push ebx
push 1
lea esi, [esp + 0xcc]
call fcn.10003f0e
push ebx
push 1
lea ecx, [esp + 0xb0]
mov byte [esp + 0x728], 0xb
call fcn.10003e16
push 0x1003484b
lea ecx, [esp + 0xac]
call fcn.1000399e
lea eax, [esp + 0xa8]
push eax
push 3
push edi
mov byte [esp + 0x72c], 0x1e
call fcn.100019ec
add esp, 0xc
push ebx
push 1
lea ecx, [esp + 0xb0]
call fcn.10003e16
lea ecx, [esp + 0x14]
mov byte [esp + 0x720], 4
call fcn.1000dd5c
push ebx
push 1
lea esi, [esp + 0x78]
call fcn.10003f0e
push ebx
push 1
lea esi, [esp + 0x94]
call fcn.10003f0e
push ebx
push 1
lea esi, [esp + 0xe8]
call fcn.10003f0e
mov ecx, dword [esp + 0x718]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x700]
xor ecx, esp
call fcn.1001997f
mov esp, ebp
pop ebp
ret