Function at 0x46e480
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x944]
sub esp, 0x944
push 0xffffffffffffffff
push 0x640e88
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x74d890]
xor eax, ebp
mov dword [ebp + 0x940], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
cmp dword [0x747d18], ebx
je 0x46e51e
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x1fc]
push ebx
push ebx
push 0x1032
mov eax, dword [eax + 0x20]
push eax
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
cmp eax, 1
jbe 0x46e920
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], ebx
xor ecx, ecx
mov word [ebp + 0x10], cx
mov byte [ebp - 4], 1
lea edx, [ebp + 0xc]
push edx
call fcn.0046df10
add esp, 4
test eax, eax
jne 0x46e543
mov byte [ebp - 4], al
lea ecx, [ebp + 0xc]
call fcn.00401210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x940]
xor ecx, ebp
call fcn.006157d3
add ebp, 0x944
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
cmp edx, ebx
jne 0x46e54d
lea edx, [ebp + 0x10]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46e552
sub eax, esi
sar eax, 1
cmp word [edx + eax*2 - 2], 0x5c
je 0x46e576
push 0x66e980
lea ecx, [ebp + 0xc]
call fcn.00405300
lea ecx, [edi + 0x5d0]
call fcn.00450e40
mov dword [ebp + 0x938], eax
jmp 0x46e590
cmp dword [ebp + 0x938], ebx
je 0x46e908
lea esi, [edi + 0x5d0]
lea eax, [ebp + 0x938]
push eax
mov ecx, esi
call fcn.00450e60
push eax
mov ecx, esi
call fcn.005f5c7d
push eax
mov ecx, edi
call fcn.00458da0
cmp eax, ebx
jl 0x46e590
push eax
mov ecx, dword [edi + 0x234]
call fcn.004c7a00
mov esi, dword [eax]
cmp dword [esi + 0x5c], ebx
je 0x46e590
cmp dword [esi + 0x54], ebx
je 0x46e5e1
mov eax, dword [esi + 0x54]
jmp 0x46e5e4
lea eax, [esi + 0x58]
push eax
lea ecx, [ebp + 0x24]
call fcn.00402180
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x46e5fb
lea eax, [ebp + 0x28]
push 0x5c
push eax
call fcn.006152e7
add esp, 8
cmp eax, ebx
jne 0x46e61b
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
jmp 0x46e590
add eax, 2
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x46e62d
lea eax, [ebp + 0x10]
mov ecx, dword [ebp + 0x24]
cmp ecx, ebx
jne 0x46e637
lea ecx, [ebp + 0x28]
push eax
push ecx
call fcn.0061acda
add esp, 8
test eax, eax
jne 0x46e656
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
jmp 0x46e590
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x20], ebx
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 3
cmp dword [esi + 0x54], ebx
je 0x46e670
mov eax, dword [esi + 0x54]
jmp 0x46e673
lea eax, [esi + 0x58]
push 0x5c
push eax
call fcn.006152e7
add esp, 8
cmp eax, ebx
jne 0x46e69f
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x18]
call fcn.00401210
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
jmp 0x46e590
add eax, 2
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
jne 0x46e6ac
lea ecx, [ebp + 0x10]
push ebx
push eax
push ecx
push 0x66dde0
lea ecx, [ebp + 0x18]
call fcn.00402320
cmp dword [esi + 0x944], 3
jne 0x46e881
cmp dword [esi + 0x54], ebx
je 0x46e6d3
mov eax, dword [esi + 0x54]
jmp 0x46e6d6
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46e8e6
test al, 0x10
jne 0x46e8e6
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov word [ebp - 0x44], ax
cmp dword [esi + 0x54], eax
je 0x46e713
mov eax, dword [esi + 0x54]
jmp 0x46e716
lea eax, [esi + 0x58]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e720
sub eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x46e73c
lea eax, [ebp + 0x1c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e740
sub eax, edx
sar eax, 1
mov edi, eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
add eax, 2
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005e9aa7
mov ebx, eax
lea eax, [edi + 2]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005e9aa7
add esp, 8
mov edi, eax
mov dword [ebp - 0x20], edi
test ebx, ebx
je 0x46e8e6
test edi, edi
je 0x46e8e6
cmp dword [esi + 0x54], 0
je 0x46e7ae
mov ecx, dword [esi + 0x54]
jmp 0x46e7b1
lea ecx, [esi + 0x58]
mov edx, ebx
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x46e7b3
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov word [ebx + ecx*2 + 2], ax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x46e7d8
lea ecx, [ebp + 0x1c]
mov edx, edi
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x46e7e0
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov word [edi + eax*2 + 2], dx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x58], ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], 1
mov eax, pe_nt_image_headers32
mov word [ebp - 0x50], ax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46e870
cmp dword [ebp - 0x4e], eax
jne 0x46e870
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x46e837
lea eax, [ebp + 0x1c]
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.005c35d0
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x46e854
push eax
mov ecx, edi
call fcn.005c52d0
mov edx, dword [esi + 0x4e8]
push edx
push 0x149e
push 0x111
mov ecx, dword [ebp - 0x14]
call fcn.004015b0
mov edi, dword [ebp - 0x20]
push edi
call fcn.005e9ab2
push ebx
call fcn.005e9ab2
add esp, 8
jmp 0x46e8e6
mov byte [esi + 0x1a2], 1
cmp dword [esi + 0x944], 5
jne 0x46e8ad
cmp dword [esi + 0xcc], ebx
je 0x46e8ad
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x46e8a3
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.005ae5a0
jmp 0x46e8ce
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x46e8b7
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.005b36b0
mov eax, dword [esi + 0x4e8]
push eax
lea ecx, [esi + 0x20]
call fcn.005c5200
mov ecx, dword [esi + 0x4e8]
push ecx
push 0x149e
push 0x111
mov ecx, edi
call fcn.0042df00
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x18]
call fcn.00401210
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
xor ebx, ebx
mov edi, dword [ebp - 0x14]
jmp 0x46e590
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
jmp 0x46e51e
jne 0x46eeb2
mov eax, dword [edi + 0x1fc]
push ebx
push ebx
push 0x1042
mov edx, dword [eax + 0x20]
push edx
call esi
mov dword [ebp - 0xec], 4
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], ebx
mov eax, dword [edi + 0x1fc]
lea ecx, [ebp - 0xec]
push ecx
push ebx
push 0x1005
mov edx, dword [eax + 0x20]
push edx
call esi
test eax, eax
je 0x46e51e
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, edi
call fcn.00458da0
push eax
mov ecx, dword [edi + 0x234]
call fcn.004c7a00
mov esi, dword [eax]
cmp esi, ebx
je 0x46e51e
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor ecx, ecx
mov word [ebp + 0x28], cx
mov byte [ebp - 4], 4
push pe_nt_image_headers32
push ebx
lea edx, [ebp + 0x430]
push edx
call fcn.00615eb0
push 0x58
push ebx
lea eax, [ebp - 0xb8]
push eax
call fcn.00615eb0
add esp, 0x18
mov dword [ebp - 0xb8], 0x58
cmp dword [esi + 0x5c], ebx
je 0x46ea3e
cmp dword [esi + 0x54], ebx
je 0x46e9e1
mov eax, dword [esi + 0x54]
jmp 0x46e9e4
lea eax, [esi + 0x58]
push 0x104
push eax
lea ecx, [ebp + 0x630]
push ecx
call fcn.0061914d
add esp, 0xc
cmp dword [esi + 0x54], ebx
je 0x46ea03
mov eax, dword [esi + 0x54]
jmp 0x46ea06
lea eax, [esi + 0x58]
push pe_nt_image_headers32
lea edx, [ebp + 0x430]
push edx
push pe_nt_image_headers32
lea ecx, [ebp + 0x30]
push ecx
push pe_nt_image_headers32
lea edx, [ebp + 0x230]
push edx
push 3
lea ecx, [ebp + 0x938]
push ecx
push eax
call fcn.00618767
add esp, 0x24
jmp 0x46eae0
push 0x208
push ebx
lea edx, [ebp + 0x630]
push edx
call fcn.00615eb0
add esp, 0xc
cmp dword [esi + 0x28], ebx
je 0x46eae0
mov eax, dword [esi + 0x28]
push eax
lea ecx, [ebp + 0x18]
call fcn.00406f90
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x46ea76
lea eax, [ebp + 0x1c]
push 0x104
push eax
lea ecx, [ebp + 0x630]
push ecx
call fcn.0061914d
push 0x2e
lea edx, [ebp + 0x630]
push edx
call fcn.006152e7
add esp, 0x14
cmp eax, ebx
je 0x46ead1
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x46eaa2
sub ecx, edi
sar ecx, 1
cmp ecx, 0xa
jae 0x46ead1
mov ecx, eax
lea edx, [ebp + 0x430]
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x46eac0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00401210
mov edi, dword [ebp - 0x14]
lea eax, [ebp + 0x430]
push eax
lea ecx, [ebp + 0xc]
call fcn.00402180
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x630]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x98], 0x104
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x94], ebx
push pe_nt_image_headers32
push ebx
lea edx, [ebp + 0x838]
push edx
call fcn.00615eb0
add esp, 0xc
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
xor eax, eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 7
mov ecx, dword [0x752d00]
push ecx
mov edx, dword [0x753e90]
push edx
lea ecx, [ebp]
call fcn.00401980
mov eax, dword [ebp]
cmp eax, ebx
jne 0x46eb64
lea eax, [ebp + 4]
push eax
push str._s__._
lea eax, [ebp + 0x838]
push eax
call fcn.0040f8d0
add esp, 0xc
lea eax, [ebp + 0x838]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46eb82
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 + 0x83a]
mov ecx, dword [0x676950]
mov dword [eax], ecx
mov dx, word [0x676954]
mov word [eax + 4], dx
lea eax, [ebp + 0x838]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x8c], ebx
lea ecx, [ebp + 0x432]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0xb8]
push edx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
cmp eax, 1
je 0x46ec06
mov byte [ebp - 4], 6
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 4
lea ecx, [ebp + 0xc]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
jmp 0x46e519
push 0x2e
mov eax, dword [ebp - 0x9c]
push eax
call fcn.006152e7
add esp, 8
cmp eax, ebx
je 0x46ec2c
mov ecx, dword [ebp - 0x9c]
push ecx
lea ecx, [ebp + 0x24]
call fcn.004017f0
jmp 0x46ec4c
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x46ec36
lea eax, [ebp + 0x10]
push ebx
push eax
mov edx, dword [ebp - 0x9c]
push edx
push 0x66dde0
lea ecx, [ebp + 0x24]
call fcn.00402320
cmp dword [esi + 0x944], 3
jne 0x46ee11
cmp dword [0x747d18], ebx
je 0x46ee8e
cmp dword [esi + 0x54], ebx
je 0x46ec6f
mov eax, dword [esi + 0x54]
jmp 0x46ec72
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46ee8e
test al, 0x10
jne 0x46ee8e
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
cmp dword [esi + 0x54], ebx
je 0x46ecaf
mov eax, dword [esi + 0x54]
jmp 0x46ecb2
lea eax, [esi + 0x58]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46ecb5
sub eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x46ecd1
lea eax, [ebp + 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46ecd4
sub eax, edx
sar eax, 1
mov edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x18]
add eax, 2
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005e9aa7
mov ebx, eax
lea eax, [edi + 2]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005e9aa7
add esp, 8
mov edi, eax
mov dword [ebp - 0x1c], edi
test ebx, ebx
je 0x46ee8e
test edi, edi
je 0x46ee8e
cmp dword [esi + 0x54], 0
je 0x46ed42
mov ecx, dword [esi + 0x54]
jmp 0x46ed45
lea ecx, [esi + 0x58]
mov edx, ebx
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x46ed47
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov word [ebx + ecx*2 + 2], ax
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jne 0x46ed6c
lea ecx, [ebp + 0x28]
mov edx, edi
mov edi, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x46ed70
xor edx, edx
mov eax, dword [ebp - 0x20]
mov word [edi + eax*2 + 2], dx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 1
mov eax, pe_nt_image_headers32
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46ee00
cmp dword [ebp - 0x2e], eax
jne 0x46ee00
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x46edc7
lea eax, [ebp + 0x28]
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.005c35d0
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x46ede4
push eax
mov ecx, edi
call fcn.005c52d0
mov edx, dword [esi + 0x4e8]
push edx
push 0x149e
push 0x111
mov ecx, dword [ebp - 0x14]
call fcn.004015b0
mov edi, dword [ebp - 0x1c]
push edi
call fcn.005e9ab2
push ebx
call fcn.005e9ab2
add esp, 8
jmp 0x46ee8e
mov byte [esi + 0x1a2], 1
cmp dword [esi + 0x944], 5
jne 0x46ee3d
cmp dword [esi + 0xcc], ebx
je 0x46ee3d
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x46ee33
lea eax, [ebp + 0x28]
push eax
mov ecx, esi
call fcn.005ae5a0
jmp 0x46ee76
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x46ee47
lea eax, [ebp + 0x28]
push eax
mov ecx, esi
call fcn.005b36b0
mov ecx, dword [esi + 0x4e8]
push ecx
lea ecx, [esi + 0x20]
call fcn.005c5200
mov edx, dword [esi + 0x4e8]
push edx
push 0x13c9
push 0x111
mov ecx, edi
call fcn.004015b0
mov eax, dword [esi + 0x4e8]
push eax
push 0x149e
push 0x111
mov ecx, edi
call fcn.0042df00
mov byte [ebp - 4], 6
lea ecx, [ebp]
call fcn.00401210
mov byte [ebp - 4], 4
lea ecx, [ebp + 0xc]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
jmp 0x46e51e