Function at 0x59c850
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x4c]
mov edx, dword [0x546530]
call fcn.00403e48
xor eax, eax
push ebp
push 0x59d041
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005093e8
mov esi, dword [eax + 0x19c]
mov byte [ebp - 0x15], 0
mov eax, dword [edi + 0x168]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 5], 0
je 0x59cb4b
mov dl, 1
mov eax, edi
call fcn.0059c070
test al, al
jne 0x59c8cb
mov byte [ebp - 6], 1
jmp 0x59d000
cmp byte [edi + 0x45c], 0
je 0x59c91a
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.00568530
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
mov edx, dword [0x671910]
mov edx, dword [edx + 0x22]
mov ecx, dword [0x6723c4]
mov edx, dword [ecx + edx*4]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 4]
pop eax
call fcn.00658754
mov eax, dword [0x671910]
mov eax, dword [eax + 0x22]
call fcn.0053cdd8
mov dword [esi + 0x60], eax
jmp 0x59c974
cmp byte [edi + 0x432], 0
jne 0x59c974
mov eax, dword [edi + 0x168]
call fcn.0053ce4c
test al, al
je 0x59c942
mov eax, dword [edi + 0x168]
call fcn.0053cdd8
mov dword [esi + 0x60], eax
jmp 0x59c974
mov eax, dword [esi + 0x60]
call fcn.0053cdfc
mov edx, dword [0x6723c4]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x54]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00658754
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00658934
cmp dword [ebp - 0x50], 0
jne 0x59c992
lea eax, [ebp - 4]
mov edx, 0x59d058
call fcn.00403ac4
cmp byte [edi + 0x427], 0
je 0x59c9c0
mov eax, dword [0x671c60]
test byte [eax], 2
je 0x59c9c0
lea eax, [ebp - 0x50]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00568670
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
mov eax, dword [0x671910]
test byte [eax + 9], 0x80
jne 0x59c9ee
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00658904
mov ecx, dword [ebp - 0x50]
mov eax, dword [0x672ce4]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00403b24
lea eax, [esi + 0x38]
mov edx, dword [ebp - 4]
call fcn.004038bc
lea eax, [esi + 0x34]
mov edx, dword [0x672384]
mov edx, dword [edx]
call fcn.00403438
mov eax, dword [0x671ba4]
mov edx, dword [edi + 0x160]
call fcn.004038bc
mov eax, dword [0x671ba4]
add eax, 4
mov edx, dword [edi + 0x178]
call fcn.004032c8
cmp byte [edi + 0x427], 0
jne 0x59ca45
cmp byte [edi + 0x43c], 0
jne 0x59ca45
mov byte [esi + 0x86], 1
mov byte [esi + 0x56], 2
cmp byte [edi + 0x3f6], 0
jne 0x59ca7c
cmp byte [edi + 0x3f5], 0
jne 0x59ca7c
cmp byte [edi + 0x43c], 0
jne 0x59ca7c
cmp byte [edi + 0x45c], 0
jne 0x59ca7c
mov eax, dword [edi + 0x160]
call fcn.006584d0
test al, al
jne 0x59ca80
xor eax, eax
jmp 0x59ca82
mov al, 1
mov byte [esi + 0x84], al
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
jne 0x59caad
mov byte [esi + 0x84], 0
mov byte [ebp - 6], 1
mov eax, dword [0x671ba4]
call fcn.00403880
jmp 0x59d000
lea edx, [ebp - 4]
mov eax, esi
call fcn.00630c9c
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.006586a0
mov ebx, eax
xor bl, 1
mov al, byte [esi + 0x84]
and al, bl
mov byte [ebp - 0x15], al
mov byte [esi + 0x84], 0
mov eax, dword [esi + 0x60]
call fcn.0053cdfc
mov dword [ebp - 0x14], eax
test bl, bl
je 0x59cb0b
mov eax, dword [ebp - 4]
call fcn.0053cb28
test al, al
je 0x59cb4b
mov eax, dword [0x672da4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00623554
jmp 0x59ca2c
cmp byte [edi + 0x3f5], 0
je 0x59cb2b
mov eax, dword [0x672468]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.00623554
jmp 0x59ca2c
cmp byte [edi + 0x3f6], 0
je 0x59cb4b
mov eax, dword [0x67319c]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.006234a0
jmp 0x59ca2c
cmp byte [ebp - 0x15], 0
je 0x59cc28
cmp byte [edi + 0x38], 0
jne 0x59cc28
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x168]
jne 0x59cc28
mov eax, edi
call fcn.005bcb08
push 3
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x59cbe4
mov eax, dword [0x672ee4]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.00653ce8
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, edi
call fcn.005093f0
mov eax, dword [0x6723cc]
mov byte [eax + 0xf], 1
mov eax, dword [0x6723cc]
mov byte [eax + 0x10], 1
mov eax, dword [0x672ee4]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.0061bf14
mov eax, dword [0x6730b4]
or dword [eax], 0x40
mov byte [ebp - 6], 0
jmp 0x59cbf5
mov dl, 3
mov eax, dword [edi + 0x160]
call fcn.006236a4
mov byte [ebp - 6], 1
mov eax, dword [edi + 0x160]
call fcn.00620024
test al, al
jne 0x59cfe8
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.0065c53c
mov dword [edi + 0x164], eax
jmp 0x59cfe8
cmp dword [ebp - 0x14], 6
jne 0x59cc44
xor edx, edx
mov eax, edi
call fcn.0059c104
test al, al
jne 0x59cc44
mov byte [ebp - 6], 1
jmp 0x59cfe8
cmp byte [0x66d860], 0
je 0x59ccc8
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, edi
call fcn.005bca00
test al, al
je 0x59ccc8
mov byte [edi + 0x432], 1
mov eax, dword [0x6722cc]
mov eax, dword [eax + 4]
call fcn.0053cdd8
mov dword [esi + 0x60], eax
lea eax, [ebp - 0x54]
mov edx, dword [0x6722cc]
mov edx, dword [edx + 4]
mov ecx, dword [0x6723c4]
mov edx, dword [ecx + edx*4]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00658754
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, edi
call fcn.0059c850
mov byte [ebp - 6], al
mov byte [edi + 0x432], 0
cmp byte [ebp - 6], 1
jne 0x59cfe8
mov byte [edi + 0x431], 0
jmp 0x59cfe8
cmp byte [0x6763f9], 0
jne 0x59ccfa
mov eax, dword [ebp - 4]
call fcn.006584d0
test al, al
je 0x59ccfa
lea edx, [ebp - 4]
mov cl, byte [0x59d05c]
mov eax, edi
call fcn.005474ec
test al, al
jne 0x59ccfa
mov byte [ebp - 6], 1
jmp 0x59cfe8
cmp dword [ebp - 0x14], 4
sete al
and al, byte [ebp - 5]
je 0x59cd5d
cmp dword [edi + 0x168], 4
jne 0x59cd18
cmp byte [edi + 0x427], 0
jne 0x59cd5d
lea eax, [edi + 0x178]
call fcn.004d4c48
test al, al
je 0x59cd4a
call fcn.00431054
lea ecx, [ebp - 0x58]
mov edx, dword [edi + 0x178]
call fcn.00430a54
mov edx, dword [ebp - 0x58]
lea eax, [edi + 0x178]
call fcn.004032c8
jmp 0x59cd5d
mov byte [ebp - 6], 1
mov eax, dword [0x671ba4]
call fcn.00403880
jmp 0x59d000
mov ebx, dword [edi + 0x164]
test ebx, ebx
je 0x59cd79
mov eax, ebx
call fcn.006201a8
test al, al
jne 0x59cd79
mov eax, edi
call fcn.005bcb08
mov eax, dword [edi + 0x164]
mov dword [ebp - 0x10], eax
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.006586a0
mov ebx, eax
xor bl, 1
cmp dword [edi + 0x164], 0
sete al
or al, bl
je 0x59cde2
mov eax, dword [ebp - 4]
call fcn.0065c55c
mov esi, eax
mov dword [edi + 0x164], esi
inc esi
jne 0x59cde2
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.006236a4
cmp ax, 2
jne 0x59cda3
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
mov byte [ebp - 6], 2
mov eax, dword [0x671ba4]
call fcn.00403880
jmp 0x59d000
lea eax, [ebp - 0xc]
mov edx, dword [edi + 0x160]
call fcn.004038bc
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x78]
mov eax, edi
call fcn.005c8b04
push edi
lea esi, [ebp - 0x78]
lea edi, [ebp - 0x48]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0x16c]
mov dword [ebp - 0x24], eax
mov al, byte [edi + 0x170]
mov byte [ebp - 0x4b], al
mov al, byte [0x59d060]
mov byte [ebp - 0x4a], al
cmp byte [edi + 0x45c], 0
je 0x59ce48
or byte [ebp - 0x4a], 1
cmp byte [ebp - 5], 0
je 0x59ce5a
mov dword [edi + 0x1cc], 1
jmp 0x59ce60
inc dword [edi + 0x1cc]
lea edx, [ebp - 0x4c]
mov eax, edi
call fcn.005bc404
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x59cfa4
cmp byte [0x6763f9], 0
je 0x59ce8c
mov eax, edi
call fcn.005bcb08
jmp 0x59cfd8
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 0x164]
je 0x59ceb3
cmp dword [ebp - 0x10], 0
je 0x59ceb3
test bl, bl
jne 0x59ceaa
cmp dword [edi + 0x168], 2
je 0x59ceb3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x15], 0
je 0x59cec2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, edi
call fcn.005fb918
mov byte [edi + 0x3f5], 0
mov byte [edi + 0x3f6], 0
push 0
mov eax, dword [edi + 0x164]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [edi + 0x1b8], eax
call fcn.00659760
fstp qword [edi + 0x1a0]
wait
mov eax, dword [edi + 0x1a0]
mov dword [edi + 0x1a8], eax
mov eax, dword [edi + 0x1a4]
mov dword [edi + 0x1ac], eax
mov eax, edi
call fcn.005bcb08
cmp byte [edi + 0x45c], 0
jne 0x59cf49
mov eax, dword [edi + 0x160]
call fcn.00620024
test al, al
jne 0x59cf49
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.0065c53c
mov dword [edi + 0x164], eax
cmp byte [edi + 0x45c], 0
je 0x59cf6b
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
mov eax, dword [0x671910]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x22], edx
mov eax, dword [edi + 0x174]
test eax, eax
je 0x59cfd8
call fcn.004626c4
push 0x401
push 0
push 0
mov eax, dword [0x672b78]
mov eax, dword [eax]
push eax
call sub.user32.dll_RedrawWindow
mov eax, dword [0x6723cc]
mov byte [eax + 0xf], 1
mov eax, dword [0x6723cc]
mov byte [eax + 0x10], 1
jmp 0x59cfd8
mov eax, dword [edi + 0x164]
cmp eax, dword [ebp - 0x10]
je 0x59cfd8
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
cmp byte [0x6763f9], 0
jne 0x59cfe8
mov eax, edi
call fcn.005093f0
mov eax, dword [0x671ba4]
call fcn.00403880
mov eax, dword [0x6723cc]
mov byte [eax + 0x11], 1
call fcn.00509530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d048
lea eax, [ebp - 0x58]
call fcn.00403274
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x4c]
mov edx, dword [0x546530]
call fcn.00403f10
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret