Function at 0x1000f390
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push 0x103
lea eax, [ebp - 0x123]
push 0
push eax
mov byte [ebp - 0x124], 0
call sub.MSVCRT.dll_memset
push 0x103
lea ecx, [ebp - 0x227]
push 0
push ecx
mov byte [ebp - 0x228], 0
call sub.MSVCRT.dll_memset
add esp, 0x18
xor eax, eax
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1000f3d2
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f3f6
push ebx
push esi
push edi
lea edi, [ebp - 0x124]
sub eax, ecx
mov esi, ecx
dec edi
jmp 0x1000f410
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f410
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea edx, [ebp - 0x124]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call ebx
lea eax, [ebp - 0x124]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f440
mov ecx, dword [str.keys]
mov dl, byte [0x1001c8b8]
mov dword [eax], ecx
mov byte [eax + 4], dl
push 0
lea eax, [ebp - 0x124]
push eax
call ebx
cmp dword [0x1001ff10], 0
je 0x1000f601
lea eax, [ebp - 0x124]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f478
mov ecx, dword [0x1001c8bc]
mov edx, dword [0x1001c8c0]
mov dword [eax], ecx
mov cl, byte [0x1001c8c4]
mov dword [eax + 4], edx
push 0
lea edx, [ebp - 0x124]
push edx
mov byte [eax + 8], cl
call ebx
push str.private_
push 0x1001ff28
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x1000f968
mov byte [esi + 8], 0
xor eax, eax
jmp 0x1000f4d0
mov cl, byte [eax + 0x1001ff28]
mov byte [ebp + eax - 0x228], cl
inc eax
test cl, cl
jne 0x1000f4d0
lea eax, [ebp - 0x228]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f4f0
mov cx, word [0x1001c8d4]
mov dl, byte [0x1001c8d6]
mov word [eax], cx
mov byte [eax + 2], dl
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x124]
mov edx, 0x41c
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], dx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x1000f968
mov byte [esi + 8], 0x5c
mov edi, edi
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1000f560
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f584
lea edi, [ebp - 0x124]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f596
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x124]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f5b3
mov ecx, dword [str.private.txt]
mov edx, dword [0x1001c8dc]
mov dword [eax], ecx
mov ecx, dword [0x1001c8e0]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, 0x1001ff28
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f5e0
sub eax, edx
mov ebx, eax
push 0x1001ff28
lea eax, [ebp - 0x124]
call fcn.10003f60
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
jmp 0x1000f610
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1000f610
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f634
lea edi, [ebp - 0x124]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f646
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x124]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f663
cmp dword [0x1001ff18], 0
mov edx, dword [str.keys]
mov cl, byte [0x1001c8b8]
mov dword [eax], edx
mov byte [eax + 4], cl
je 0x1000f822
lea eax, [ebp - 0x124]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f690
mov edx, dword [0x1001c8e4]
mov ecx, dword [0x1001c8e8]
mov dword [eax], edx
push 0
lea edx, [ebp - 0x124]
push edx
mov dword [eax + 4], ecx
call ebx
push 0x1001c8ec
push 0x10020030
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x1000f968
mov byte [esi + 7], 0
xor eax, eax
jmp 0x1000f6e0
mov cl, byte [eax + 0x10020030]
mov byte [ebp + eax - 0x228], cl
inc eax
test cl, cl
jne 0x1000f6e0
lea eax, [ebp - 0x228]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f700
mov cx, word [0x1001c8d4]
mov dl, byte [0x1001c8d6]
mov word [eax], cx
mov byte [eax + 2], dl
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x124]
mov edx, 0x41c
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], dx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x1000f968
mov byte [esi + 7], 0x5c
mov edi, edi
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1000f770
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f794
lea edi, [ebp - 0x124]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f7a6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x124]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f7c3
mov ecx, dword [str.public.txt]
mov edx, dword [0x1001c8fc]
mov dword [eax], ecx
mov cx, word [0x1001c900]
mov dword [eax + 4], edx
mov dl, byte [0x1001c902]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, 0x10020030
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f7f8
sub eax, edx
mov ebx, eax
push 0x10020030
lea eax, [ebp - 0x124]
call fcn.10003f60
cmp dword [0x1001ff18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jne 0x1000f82f
cmp dword [0x1001ff10], 0
je 0x1000f968
xor eax, eax
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1000f831
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f855
lea edi, [ebp - 0x124]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f867
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x124]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea eax, [ebp - 0x124]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f890
mov ecx, dword [str.keys.zip]
mov edx, dword [0x1001c864]
mov dword [eax], ecx
mov cl, byte [0x1001c868]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
xor eax, eax
jmp 0x1000f8c0
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x228], cl
inc eax
test cl, cl
jne 0x1000f8c0
push 0x100221f8
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, 0x100221f8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f8e4
lea edi, [ebp - 0x228]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000f8f6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x228]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000f913
mov edx, dword [str.keys]
mov cl, byte [0x1001c8b8]
mov dword [eax], edx
lea edx, [ebp - 0x228]
mov byte [eax + 4], cl
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.1001aaf0
test eax, eax
je 0x1000f968
lea ecx, [ebp - 0x228]
push ecx
call fcn.10004120
cmp dword [0x1001ff10], 0
mov eax, 0x1001ff28
jne 0x1000f962
mov eax, 0x10020030
push eax
call fcn.10010170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret