Function at 0x4e1cec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x4e1cf4
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4e1fa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 1
lea eax, [ebp - 0x18]
mov ecx, 0x4e1fbc
mov edx, dword [0x4e8d94]
call fcn.00404fd8
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x439d78]
call fcn.00439e28
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e1f69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x3c8]
mov eax, dword [eax + 8]
push eax
mov ecx, 0x4e1fcc
mov edx, 0x4e1fe0
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi + 0x3c8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4e1edb
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [esi + 0x3c8]
mov edx, ebx
call fcn.0041dc9c
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, pe_nt_image_headers32
call fcn.00404f3c
mov edx, dword [ebp - 0x1c]
mov eax, 0x4e1ff4
call fcn.00409378
test eax, eax
je 0x4e1ed1
mov eax, dword [esi + 0x3c8]
mov edx, ebx
call fcn.0041dc9c
mov edx, eax
lea eax, [ebp - 8]
mov ecx, pe_nt_image_headers32
call fcn.00404f3c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x28]
xor ecx, ecx
mov eax, 0x4e2008
call fcn.0040acbc
mov eax, dword [ebp - 0x20]
push eax
mov edx, 0x4e1fe0
mov eax, dword [ebp - 4]
pop ecx
mov edi, dword [eax]
call dword [edi + 4]
mov byte [ebp - 0xd], 0
push 9
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [0x4e8d94]
call fcn.00404fd8
mov eax, dword [ebp - 0x2c]
call fcn.0040518c
push eax
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov edx, dword [0x4e8d90]
call fcn.00404fd8
mov eax, dword [ebp - 0x30]
call fcn.0040518c
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4e1e42
mov byte [ebp - 0xd], 1
jmp 0x4e1ec7
call sub.kernel32.dll_GetLastError_1
sub eax, 5
jne 0x4e1ec7
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00403068
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov edx, dword [0x4e8d94]
call fcn.00404fd8
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00409490
test eax, eax
jne 0x4e1e97
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 8]
mov edx, dword [0x4e8d90]
call fcn.00404fd8
mov eax, dword [ebp - 0x3c]
call fcn.004e1998
mov byte [ebp - 0xd], 1
jmp 0x4e1ec7
push 0
lea ecx, [ebp - 0x40]
mov eax, dword [esi + 0x3bc]
mov edx, 0x4e2014
call fcn.004d758c
mov eax, dword [ebp - 0x40]
mov cx, word [0x4e201c]
mov dl, 3
call fcn.00436bc4
cmp eax, 6
jne 0x4e1ec7
jmp 0x4e1dfa
cmp byte [ebp - 0xd], 0
jne 0x4e1ed1
mov byte [ebp - 0xe], 0
inc ebx
dec dword [ebp - 0x14]
jne 0x4e1d79
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x4e8d68]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [0x4e8d6c]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [0x4e8d70]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
mov eax, dword [0x4e8d74]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x60]
mov ecx, 3
mov eax, 0x4e2028
call fcn.0040acbc
mov eax, dword [ebp - 0xc]
push eax
mov edx, 0x4e1fe0
mov ecx, 0x4e203c
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp byte [ebp - 0xe], 0
je 0x4e1f53
mov eax, dword [ebp - 0xc]
push eax
mov edx, 0x4e1fe0
mov ecx, 0x4e2054
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1f70
mov eax, dword [ebp - 4]
call fcn.00403e5c
ret