Function at 0x4cc897
Capabilities:
Move file

Disassembly:
push 0x50
mov eax, 0x51e27c
call fcn.0044c7ac
mov eax, dword [ebx]
test byte [eax + 4], 0x20
jne 0x4ccbb5
test byte [eax + 4], 0x40
jne 0x4ccbb5
and dword [ebp - 0x54], 0
or dword [ebp - 0x50], 0xffffffff
or dword [ebp - 0x4c], 0xffffffff
and dword [ebp - 0x48], 0
mov dword [ebp - 0x58], 0x539d88
mov dword [ebp - 4], 0xb
mov edi, dword [eax + 0x1c]
mov eax, dword [eax + 4]
lea esi, [ebp - 0x24]
or edi, 0xf003f
call fcn.004a8f8a
mov ecx, dword [eax]
mov eax, dword [ebx]
mov eax, dword [eax + 4]
test al, 4
je 0x4cc8fd
mov eax, SysReAllocString
jmp 0x4cc902
call fcn.004a8d87
push edi
push ecx
push eax
lea eax, [ebp - 0x54]
call fcn.00411a77
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00410d34
cmp dword [ebp - 0x10], 0
jne 0x4ccba8
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
push 0x5352f8
push eax
lea eax, [ebp - 0x14]
push eax
lea edi, [ebp - 0x58]
call fcn.004d4774
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x14]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x4ccb9d
or dword [ebp - 0x3c], 0xffffffff
or dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0x539d88
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x30], eax
mov dword [ebp - 0x1c], eax
je 0x4cc979
mov dword [ebp - 0x1c], 0x100
mov edi, dword [ebp - 0x1c]
or edi, 0xf003f
mov eax, 0x80
lea esi, [ebp - 0x18]
mov dword [ebp - 0x28], edi
call fcn.004a8f8a
lea ecx, [ebp - 0x20]
push 0x538d8c
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00411aaa
mov byte [ebp - 4], 0xf
mov edx, dword [ebx]
add edx, 0x18
push edx
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.00403e59
mov eax, dword [eax]
add esp, 0x10
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x40]
call fcn.00414747
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00410d34
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00410d34
xor edi, edi
cmp dword [ebp - 0x10], edi
jne 0x4ccb95
mov eax, dword [ebx]
push dword [eax + 0x1c]
mov eax, dword [eax + 4]
lea esi, [ebp - 0x24]
call fcn.004a8f1c
pop ecx
push dword [eax]
lea eax, [ebp - 0x40]
push 0x53cfd4
push eax
call fcn.00414b47
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebx]
push dword [eax + 0x10]
lea eax, [ebp - 0x40]
push str.item
push eax
call fcn.00414b47
mov eax, dword [ebx]
mov eax, dword [eax + 4]
test al, 4
je 0x4cca51
mov eax, SysReAllocString
jmp 0x4cca56
call fcn.004a8d87
lea esi, [ebp - 0x20]
call fcn.004d4864
mov byte [ebp - 4], 0x10
push dword [ebp - 0x20]
lea eax, [ebp - 0x40]
push str.hkey
push eax
call fcn.00414b47
mov esi, dword [ebp + 8]
cmp dword [esi + 0x30], edi
je 0x4ccaa1
push str._programFiles_
push str._ProgramFiles_
lea eax, [ebp - 0x14]
push eax
call fcn.004118cc
push str._Commonprogramfiles_
push str._commonprogramfiles_
lea eax, [ebp - 0x14]
push eax
call fcn.004118cc
push dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push 0x53cff4
push eax
call fcn.00414b47
push 0x53a734
push str.inimapping
lea eax, [ebp - 0x40]
push eax
call fcn.00414b47
cmp byte [esi + 0x2c], 0
je 0x4ccad4
lea eax, [ebp - 0x44]
push eax
call fcn.004cb4c6
cmp dword [ebp - 0x54], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4ccae7
push dword [ebp - 0x54]
call esi
mov dword [ebp - 0x54], edi
mov edi, ebx
call fcn.004cbaa3
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x4ccb0e
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], 0x81
mov eax, dword [ebx]
mov byte [eax + 8], 0
mov eax, dword [ebx]
mov dword [eax + 0x1c], ecx
jmp 0x4ccb8a
cmp dword [ebp - 0x40], 0
je 0x4ccb1d
push dword [ebp - 0x40]
call esi
and dword [ebp - 0x40], 0
mov eax, 0x80
lea esi, [ebp - 0x2c]
call fcn.004a8f8a
lea ecx, [ebp - 0x18]
push 0x538d8c
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.00411aaa
mov byte [ebp - 4], 0x12
mov ecx, dword [ebx]
add ecx, 0x18
push ecx
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call fcn.00403e59
lea ecx, [ebp - 0x30]
push ecx
push dword [eax]
mov eax, dword [ebp - 0x28]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d4a53
mov eax, dword [ebp + 8]
add esp, 0x18
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00410d34
lea ecx, [ebp - 0x44]
call fcn.004d4502
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00410d34
lea ecx, [ebp - 0x58]
call fcn.004d4502
jmp 0x4cce7b
push dword [eax + 4]
lea esi, [ebp - 0x1c]
call fcn.004a8ec7
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
mov dword [esp], str._windir_
push eax
call fcn.004d8ee7
lea ecx, [ebp - 0x24]
push 0x53d064
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00411aaa
add esp, 0x10
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00410d34
push dword [ebp - 0x24]
call fcn.004cd4a6
cmp eax, esi
pop ecx
mov dword [ebp - 0x10], eax
jne 0x4cce65
mov eax, dword [ebx]
add eax, 0x10
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
call fcn.00403e59
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00403e59
add esp, 0x10
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
push 1
push dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4ccc69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x4cce5a
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
sub eax, 0x10
call fcn.00412a2a
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x53d060
push 0x538d8c
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 7
call fcn.004118cc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], esi
mov dword [ebp - 0x20], esi
je 0x4ccca5
mov dword [ebp - 0x20], 0x100
mov edi, dword [ebp - 0x20]
or dword [ebp - 0x3c], 0xffffffff
or dword [ebp - 0x38], 0xffffffff
or edi, 0xf003f
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0x539d88
mov dword [ebp - 0x34], esi
mov eax, 0x200
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.004a8f8a
lea ecx, [ebp - 0x28]
push 0x538d8c
push ecx
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00411aaa
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00403e59
mov eax, dword [eax]
add esp, 0x10
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x40]
call fcn.00414747
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.00410d34
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.00410d34
cmp dword [ebp - 0x10], 0
mov eax, dword [ebx]
push dword [eax + 0x18]
jne 0x4cce3e
lea esi, [ebp - 0x30]
call fcn.004cb7b6
pop ecx
push dword [eax]
lea eax, [ebp - 0x40]
push str.item
push eax
call fcn.00414b47
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebx]
push dword [eax + 0x18]
lea eax, [ebp - 0x40]
push str.path
push eax
call fcn.00414b47
push dword [ebp - 0x18]
lea eax, [ebp - 0x40]
push str.backup
push eax
call fcn.00414b47
mov eax, dword [ebp + 8]
cmp byte [eax + 0x2c], 0
je 0x4ccdcd
mov eax, dword [ebx]
push 1
push dword [eax + 0x18]
lea esi, [ebp - 0x30]
call fcn.004cb71b
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x40]
push str.location
push eax
call fcn.00414b47
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.00410d34
push dword [ebp - 0x1c]
push str.backupExtension
jmp 0x4ccdd5
push dword [ebp - 0x1c]
push str.location
lea eax, [ebp - 0x40]
push eax
call fcn.00414b47
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
lea esi, [ebp - 0x30]
call fcn.004cb810
push dword [eax]
lea eax, [ebp - 0x40]
push 0x53cff4
push eax
call fcn.00414b47
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp + 8]
cmp byte [eax + 0x2c], 0
je 0x4cce18
lea eax, [ebp - 0x44]
push eax
call fcn.004cb4c6
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], 0x201
mov eax, dword [ebx]
mov dword [eax + 0x1c], ecx
mov edi, dword [ebx]
add edi, 0x18
lea eax, [ebp - 0x14]
call fcn.004129e9
mov eax, dword [ebx]
mov byte [eax + 8], 0
jmp 0x4cce47
push dword [ebp - 0x18]
call dword [0x574e40]
lea ecx, [ebp - 0x44]
call fcn.004d4502
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00410d34
mov eax, dword [ebp - 0x10]
call fcn.0044c884
ret 4