Function at 0x4108e0
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4ad2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20e8
call fcn.004aa1a0
mov eax, dword [0x4fad60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 0x2018]
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0x20ec], esi
mov dword [ebp - 0x20f4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 7
xor edi, edi
xor edx, edx
mov dword [ebp - 0x2080], ebx
mov dword [ebp - 0x2084], edi
mov word [ebp - 0x2094], dx
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x2064], ebx
mov dword [ebp - 0x2068], edi
mov word [ebp - 0x2078], ax
xor ecx, ecx
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x2020], edi
mov word [ebp - 0x2030], cx
mov dword [ebp - 0x2048], ebx
mov dword [ebp - 0x204c], edi
mov word [ebp - 0x205c], dx
mov byte [ebp - 4], 4
cmp dword [esi + 4], edi
je 0x410d0f
push edi
push 0x80
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 3
push 0x40000000
add esi, 0x1014
push esi
call edi
mov ebx, eax
mov dword [ebp - 0x20f0], ebx
cmp ebx, 0xffffffff
je 0x410cfb
mov eax, dword [ebp - 0x20ec]
cmp dword [eax + 0x10], 0
jle 0x410b03
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x20ec]
cmp eax, dword [ecx + 0x10]
jle 0x410b03
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x2040]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x2012]
push ecx
mov word [ebp - 0x2014], ax
call fcn.00497ad0
movzx edx, word [ebp - 0x2034]
movzx eax, word [ebp - 0x2036]
movzx ecx, word [ebp - 0x2038]
push edx
movzx edx, word [ebp - 0x203a]
push eax
movzx eax, word [ebp - 0x203e]
push ecx
movzx ecx, word [ebp - 0x2040]
push edx
push eax
push ecx
push str._04d_02d_02d_02d_02d_02d
lea edx, [ebp - 0x2014]
call fcn.0040e460
add esp, 0x28
lea eax, [ebp - 0x2014]
lea ecx, [ebp - 0x20e8]
call fcn.00403fb0
mov ebx, eax
mov eax, esi
lea ecx, [ebp - 0x20cc]
mov byte [ebp - 4], 5
call fcn.00403fb0
mov ecx, eax
mov eax, ebx
lea ebx, [ebp - 0x20b0]
mov byte [ebp - 4], 6
call fcn.00412800
lea ecx, [ebp - 0x20cc]
call fcn.00404690
lea ecx, [ebp - 0x20e8]
mov byte [ebp - 4], 4
call fcn.00404690
cmp dword [ebp - 0x209c], 8
mov eax, dword [ebp - 0x20b0]
jae 0x410acf
mov eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push esi
call edi
lea ecx, [ebp - 0x20b0]
mov dword [ebp - 0x20f0], eax
call fcn.00404690
mov ebx, dword [ebp - 0x20f0]
cmp ebx, 0xffffffff
je 0x410cfb
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x410cfb
mov edi, dword [ebp - 0x20ec]
cmp dword [edi + 8], 0
je 0x410b4c
call fcn.00453480
sub esp, 8
lea ecx, [ebp - 0x2094]
fstp qword [esp]
mov ebx, str._Y__m__d__H:_M:_S_t
call fcn.004534e0
add esp, 8
cmp dword [edi + 0xc], 0
je 0x410b89
lea eax, [edi + 0x14]
mov ecx, eax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410b60
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x2078]
call fcn.00403e70
push 1
mov eax, 0x4e3da4
mov ecx, esi
call fcn.00407570
mov esi, dword [edi + 0x201c]
test esi, esi
je 0x410bff
xor edx, edx
push 0xffe
push edx
lea eax, [ebp - 0x1012]
push eax
mov word [ebp - 0x1014], dx
call fcn.00497ad0
push esi
push 0x4e3da8
lea edx, [ebp - 0x1014]
call fcn.0040e460
lea eax, [ebp - 0x1014]
add esp, 0x14
lea edx, [eax + 2]
jmp 0x410bd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410bd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x1014]
lea esi, [ebp - 0x205c]
call fcn.00403e70
push 1
mov eax, 0x4e3da4
mov ecx, esi
call fcn.00407570
push 0
lea ecx, [ebp - 0x2094]
push ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x2030]
call fcn.00404570
push 0
lea edx, [ebp - 0x2078]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x2030]
call fcn.00408c20
push 3
mov eax, 0x4e3db8
mov ecx, esi
call fcn.00407570
mov esi, dword [ebp - 0x20f4]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410c46
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x2030]
call fcn.00407570
push 0
lea eax, [ebp - 0x205c]
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x2030]
call fcn.00408c20
push 2
mov eax, 0x4e3dc0
mov ecx, esi
call fcn.00407570
mov ecx, dword [edi + 0x2014]
push ecx
call fcn.0048d7af
mov edx, dword [ebp - 0x20ec]
mov ebx, eax
mov eax, dword [edx + 0x2014]
add esp, 4
push eax
push 0
push ebx
call fcn.00497ad0
mov esi, dword [ebp - 0x2030]
add esp, 0xc
cmp dword [ebp - 0x201c], 8
jae 0x410cc6
lea esi, [ebp - 0x2030]
push ebx
call fcn.0044c360
mov eax, ebx
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410cd4
push 0
lea ecx, [ebp - 0x20f8]
push ecx
sub eax, edx
mov edx, dword [ebp - 0x20f0]
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x20f0]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x20ec]
mov ebx, 7
xor edi, edi
mov eax, dword [esi + 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 8
cmp dword [ebp - 0x2048], esi
jb 0x410d38
mov ecx, dword [ebp - 0x205c]
push ecx
call fcn.00490a16
add esp, 4
xor edx, edx
mov dword [ebp - 0x2048], ebx
mov dword [ebp - 0x204c], edi
mov word [ebp - 0x205c], dx
cmp dword [ebp - 0x201c], esi
jb 0x410d64
mov eax, dword [ebp - 0x2030]
push eax
call fcn.00490a16
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x2020], edi
mov word [ebp - 0x2030], cx
cmp dword [ebp - 0x2064], esi
jb 0x410d90
mov edx, dword [ebp - 0x2078]
push edx
call fcn.00490a16
add esp, 4
xor eax, eax
mov dword [ebp - 0x2064], ebx
mov dword [ebp - 0x2068], edi
mov word [ebp - 0x2078], ax
cmp dword [ebp - 0x2080], esi
jb 0x410dbc
mov ecx, dword [ebp - 0x2094]
push ecx
call fcn.00490a16
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490a21
mov esp, ebp
pop ebp
ret 4