Function at 0x100ded7e
Capabilities:
Move file

Disassembly:
push 0x5c
mov eax, 0x100462c3
call fcn.10042456
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push 4
push eax
mov dword [ebp - 0x5c], eax
call fcn.100dde8b
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.1005b2b2
test eax, eax
jne 0x100dedc0
mov esi, 0x80030103
jmp 0x100defc4
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
push eax
push 0x3c
lea ebx, [ebp - 0x4c]
mov edi, esi
mov eax, ebx
mov dword [ebp - 0x50], edi
push eax
push 4
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
mov ecx, dword [ebp - 0x58]
cmp ecx, 0x3c
jbe 0x100dee45
test ecx, ecx
je 0x100dee45
test edi, edi
je 0x100dee09
test ebx, ebx
je 0x100dee05
push ebx
push dword [0x100e510c]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x58]
mov edi, esi
jmp 0x100dee0c
mov edi, dword [ebp - 0x50]
push ecx
push 0xa00000
push dword [0x100e510c]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100deea4
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
push edi
push ebx
push 4
push dword [ebp - 0x5c]
mov dword [ebp - 0x50], edi
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
mov ecx, dword [ebp - 0x58]
cmp edi, ecx
jb 0x100dedeb
test eax, eax
jne 0x100def2c
test byte [0x100e5114], 2
mov edi, 0x80070005
mov esi, edi
je 0x100defaa
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.1005a518
push 0xbc
push edi
cmp eax, 0xffffffff
je 0x100def12
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.1005a518
push eax
push 0x10037808
push 0x2f009
push dword [0x100e8128]
call fcn.100d5b23
add esp, 0x18
jmp 0x100defaa
test byte [0x100e5114], 2
mov esi, 0x8007000e
je 0x100defad
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.1005a518
push 0xaf
push esi
cmp eax, 0xffffffff
je 0x100deef5
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.1005a518
push eax
push 0x10037808
push 0x2bc09
push dword [0x100e8128]
call fcn.100d5b23
add esp, 0x18
jmp 0x100defad
push 0x10037880
push 0x2bc09
push dword [0x100e8128]
call fcn.100d5b23
add esp, 0x14
jmp 0x100defad
push 0x10037880
push 0x2f009
push dword [0x100e8128]
call fcn.100d5b23
add esp, 0x14
jmp 0x100defaa
push ebx
push 4
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x100def89
test byte [0x100e5114], 2
mov edi, 0x80070005
mov esi, edi
je 0x100defaa
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.1005a518
push 0xc0
push edi
cmp eax, 0xffffffff
je 0x100def7d
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.1005a518
push eax
push 0x10037808
push 0x30009
jmp 0x100dee91
push 0x10037880
push 0x30009
jmp 0x100def1c
mov edi, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x54]
push edi
call fcn.100dec37
push edi
push dword [ebp - 0x60]
call dword [sym.imp.msvcrt.dll__wrename]
pop ecx
pop ecx
test eax, eax
je 0x100defaa
mov esi, 0x80030103
mov edi, dword [ebp - 0x50]
test edi, edi
je 0x100defc4
test ebx, ebx
je 0x100defc4
push ebx
push dword [0x100e510c]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
test byte [ebp - 0x64], 2
je 0x100defd3
push dword [ebp - 0x68]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.10042414
ret 8