Function at 0x100049c0
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082f3c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10b4
call fcn.100790e0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 0x2018]
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0x10bc], esi
mov dword [ebp - 0x10c0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esi, 0x1014
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10004d0c
mov edx, dword [ebp - 0x10bc]
cmp dword [edx + 0x10], 0
jle 0x10004bd9
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x10bc]
cmp eax, dword [ecx + 0x10]
jle 0x10004bd9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x102c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x101a]
push ecx
mov word [ebp - 0x101c], ax
call fcn.1006b580
movzx edx, word [ebp - 0x1020]
movzx eax, word [ebp - 0x1022]
movzx ecx, word [ebp - 0x1024]
push edx
movzx edx, word [ebp - 0x1026]
push eax
movzx eax, word [ebp - 0x102a]
push ecx
movzx ecx, word [ebp - 0x102c]
push edx
push eax
push ecx
push str._04d_02d_02d_02d_02d_02d
lea edx, [ebp - 0x101c]
call fcn.10005ff0
add esp, 0x28
lea eax, [ebp - 0x101c]
lea ecx, [ebp - 0x10b8]
call fcn.100036d0
mov ebx, eax
mov eax, esi
lea ecx, [ebp - 0x109c]
mov byte [ebp - 4], 1
call fcn.100036d0
mov ecx, eax
mov eax, ebx
lea ebx, [ebp - 0x1080]
mov byte [ebp - 4], 2
call fcn.10005c90
mov ebx, 8
cmp dword [ebp - 0x1088], ebx
jb 0x10004b3a
mov edx, dword [ebp - 0x109c]
push edx
call fcn.10066b10
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1088], 7
mov dword [ebp - 0x108c], 0
mov word [ebp - 0x109c], ax
cmp dword [ebp - 0x10a4], ebx
jb 0x10004b71
mov ecx, dword [ebp - 0x10b8]
push ecx
call fcn.10066b10
add esp, 4
mov eax, dword [ebp - 0x1080]
cmp dword [ebp - 0x106c], ebx
jae 0x10004b85
lea eax, [ebp - 0x1080]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push esi
call edi
cmp dword [ebp - 0x106c], 8
mov ebx, eax
jb 0x10004bbc
mov edx, dword [ebp - 0x1080]
push edx
call fcn.10066b10
add esp, 4
xor eax, eax
mov dword [ebp - 0x106c], 7
mov dword [ebp - 0x1070], 0
mov word [ebp - 0x1080], ax
cmp ebx, 0xffffffff
je 0x10004d0c
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10004d0c
xor edi, edi
mov dword [ebp - 0x1050], 0xf
mov dword [ebp - 0x1054], edi
mov byte [ebp - 0x1064], 0
mov esi, dword [ebp - 0x10c0]
mov byte [ebp - 4], 3
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x1034], 7
mov dword [ebp - 0x1038], edi
mov word [ebp - 0x1048], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10004c40
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0x1048]
call fcn.10003a30
lea edx, [ebp - 0x1064]
push edx
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x10c0], esp
xor eax, eax
mov esi, 7
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push edi
lea edx, [ebp - 0x1048]
mov word [ecx], ax
push edx
or eax, 0xffffffff
call fcn.10003850
call fcn.10020cd0
mov eax, dword [ebp - 0x1064]
add esp, 0x20
cmp dword [ebp - 0x1050], 0x10
jae 0x10004cb0
lea eax, [ebp - 0x1064]
mov edx, dword [ebp - 0x1054]
push edi
lea ecx, [ebp - 0x10c4]
push ecx
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x1034], 8
jb 0x10004cdf
mov eax, dword [ebp - 0x1048]
push eax
call fcn.10066b10
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x1050], 0x10
mov dword [ebp - 0x1034], esi
mov dword [ebp - 0x1038], edi
mov word [ebp - 0x1048], cx
jb 0x10004d0c
mov edx, dword [ebp - 0x1064]
push edx
call fcn.10066b10
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10bc]
mov ecx, dword [eax + 0x2018]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4