Function at 0x133cef70
Capabilities:
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x134bf388
push eax
mov eax, dword [0x13511b00]
mov dword fs:[0], esp
sub esp, 0xc0
test eax, eax
push ebx
mov ebx, dword [esp + 0xd4]
push ebp
mov ebp, dword [esp + 0xdc]
push esi
push edi
je 0x133cefc1
push ebp
push ebx
push str.AnalyseQQExEMailAttach___________08x___d_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x18
mov eax, dword [esp + 0xf4]
test eax, eax
je 0x133cefd2
mov dword [eax], 0
test ebx, ebx
je 0x133cf95c
test ebp, ebp
je 0x133cf95c
push 0x13512ab0
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
call fcn.13443cf0
lea eax, [esp + 0x14]
mov dword [esp + 0xd8], 0
push eax
push ebp
push ebx
call fcn.133e6410
push 0x134effa8
push 0x134effac
push ebp
lea ecx, [esp + 0x34]
push ebx
push ecx
mov esi, eax
call fcn.133cb4b0
push 0x134f0944
push ebp
push ebx
mov byte [esp + 0x104], 1
call fcn.133be650
mov edx, eax
add esp, 0x2c
cmp edx, 0xffffffff
je 0x133cf937
mov edi, 0x134f0944
or ecx, 0xffffffff
xor eax, eax
push 0x13512ab0
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x1c]
add ebx, edx
sub ebp, edx
call fcn.13443cf0
cmp ebp, 0x164
mov byte [esp + 0xd8], 2
jle 0x133cf0ed
lea edx, [ebx + 0x144]
push 0x14
lea eax, [esp + 0x24]
push edx
push eax
call fcn.134591f0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdc], 3
call fcn.13444620
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 2
call fcn.13444490
mov eax, dword [0x13511b00]
test eax, eax
je 0x133cf0ed
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0x15c]
push edx
push eax
push ecx
push str.AnalyseQQExEMailAttach__1__office:_08x____s__strData_:__s___size:_s_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x20
cmp esi, ebp
jge 0x133cf0f9
test esi, esi
jle 0x133cf0f9
add ebx, esi
sub ebp, esi
mov eax, dword [0x13511b00]
test eax, eax
je 0x133cf11e
push esi
push ebp
push ebx
push str.AnalyseQQExEMailAttach_2___08x___d____d_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x1c
lea ecx, [esp + 0x48]
call fcn.13449e10
lea ecx, [esp + 0x58]
mov byte [esp + 0xd8], 4
call fcn.13449e10
lea ecx, [esp + 0x68]
mov byte [esp + 0xd8], 5
call fcn.134504d0
mov edx, dword [0x134d0d8c]
mov byte [esp + 0xd8], 6
mov dword [esp + 0x10], edx
lea eax, [esp + 0x20]
push 0x134f02cc
push eax
mov byte [esp + 0xe0], 7
call fcn.134034c0
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 8
call fcn.1343f290
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 7
call fcn.1343f110
mov edi, dword [esp + 0xf4]
test edi, edi
jne 0x133cf1ff
mov ecx, dword [esp + 0x10]
push 0x180
push 0x8101
push ecx
call fcn.1342bac5
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x133cf25b
mov eax, dword [0x13511b00]
test eax, eax
je 0x133cf1ee
mov edx, dword [esp + 0x10]
push ebx
push edx
push ebp
push str.AnalyseQQExEMailAttach_3_writefile__len_:__d___astrAttachFilePath_:__S_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x1c
push ebp
push ebx
push esi
call fcn.1342b8d5
push esi
call fcn.1342b7f5
add esp, 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
lea ecx, [esp + 0x70]
call fcn.13450710
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x28]
call fcn.13443b90
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xe0], 9
call fcn.1344a420
mov ecx, dword [esp + 0x5c]
push str.unknow
push ecx
lea ecx, [esp + 0x60]
call fcn.1344a330
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 7
call fcn.13444490
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 6
call fcn.1343f110
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x133cf8f3
test edi, edi
je 0x133cf287
mov dword [edi], 1
jmp 0x133cf8f3
mov eax, dword [0x13511b00]
mov esi, dword [esp + 0x44]
test eax, eax
je 0x133cf2b5
mov edi, dword [esp + 0x40]
push esi
push edi
push str.AnalyseQQExEMailAttach______08x___d_
push str.MailLog
push 0xffffffffffffffff
push 0x13511a94
call fcn.13426d30
add esp, 0x18
jmp 0x133cf2b9
mov edi, dword [esp + 0x40]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
call fcn.13443a90
mov ebp, dword [esp + 0xec]
mov byte [esp + 0xd8], 0xa
test ebp, ebp
je 0x133cf84b
mov eax, dword [esp + 0x4c]
xor ebx, ebx
test eax, eax
jle 0x133cf835
jmp 0x133cf2f2
mov esi, dword [esp + 0x44]
mov eax, dword [0x134d0d90]
mov dword [esp + 0xa4], eax
mov byte [esp + 0xd8], 0xb
mov dword [esp + 0xa8], eax
mov byte [esp + 0xd8], 0xc
mov dword [esp + 0xac], eax
mov ecx, dword [0x134d0d8c]
mov byte [esp + 0xd8], 0xd
mov dword [esp + 0xb4], ecx
mov byte [esp + 0xd8], 0xe
mov dword [esp + 0xcc], eax
mov edx, dword [esp + 0xe8]
lea eax, [esp + 0x24]
mov byte [esp + 0xd8], 0x10
push eax
lea ecx, [esp + 0xa8]
mov dword [esp + 0x8c], edx
call fcn.13444620
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
mov eax, dword [ebp + 8]
mov dword [esp + 0x90], edx
mov dword [esp + 0x8c], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x9c]
mov dword [esp + 0x94], eax
push edx
mov dword [esp + 0x9c], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x48]
lea ecx, [eax + ebx*4]
push ecx
lea ecx, [esp + 0x40]
call fcn.13443a90
push 0x5c
lea ecx, [esp + 0x40]
mov byte [esp + 0xdc], 0x11
call fcn.13445640
inc eax
lea edx, [esp + 0x20]
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.13446780
lea eax, [esp + 0x78]
mov byte [esp + 0xd8], 0x12
push eax
call fcn.133bc590
add esp, 4
mov eax, dword [eax]
lea ecx, [esp + 0x84]
push eax
mov byte [esp + 0xdc], 0x13
call fcn.13443b90
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0xe4], 0x14
call fcn.13444a30
lea ecx, [esp + 0x84]
mov byte [esp + 0xd8], 0x17
call fcn.13444490
lea ecx, [esp + 0x78]
mov byte [esp + 0xd8], 0x16
call fcn.1343f110
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov eax, dword [eax + ebx*4]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [esp + 0x28]
lea ecx, [esp + 0xac]
push edx
call fcn.13444620
push 0x2e
lea ecx, [esp + 0x2c]
call fcn.13445640
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
call fcn.13446bd0
push 0x134f0b10
lea ecx, [esp + 0x38]
mov byte [esp + 0xdc], 0x18
call fcn.134450e0
mov ecx, dword [esp + 0x58]
lea edx, [ecx + ebx*4]
lea ecx, [esp + 0xa8]
push edx
call fcn.13444620
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x34]
push edx
mov ecx, dword [eax + ebx*4]
mov dword [esp + 0xb4], ecx
lea ecx, [esp + 0x80]
call fcn.1343e9b0
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0xdc], 0x19
call fcn.1343f290
lea ecx, [esp + 0x7c]
mov byte [esp + 0xd8], 0x18
call fcn.1343f110
mov eax, dword [esp + 0xb4]
push 0x180
push 0x8101
push eax
call fcn.1342bac5
mov ecx, dword [0x134d0d8c]
add esp, 0xc
mov edi, eax
mov dword [esp + 0x10], ecx
cmp edi, 0xffffffff
mov byte [esp + 0xd8], 0x1a
je 0x133cf580
mov edx, dword [esp + 0x40]
push esi
push edx
push edi
call fcn.1342b8d5
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xa8]
mov edx, dword [ebp + 0xc]
add esp, 0xc
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 4]
push edx
mov edx, dword [ebp]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str._r_n_r_nliTickBegin:_I64u__liTickEnd:_I64u__liTickRecord:_I64u
push eax
call fcn.13441f70
mov ecx, dword [esp + 0x30]
add esp, 0x20
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push 0
call fcn.1343fda0
push eax
push edi
call fcn.1342b8d5
push edi
call fcn.1342b7f5
add esp, 0x10
mov edx, dword [esp + 0x10]
mov ecx, dword [0x1351295c]
mov eax, dword [edx - 8]
add eax, esi
mov esi, ecx
cmp esi, ecx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x2c], esi
jl 0x133cf756
lea edi, [esi + 1]
test edi, edi
jne 0x133cf5fc
mov edi, dword [0x13512958]
test edi, edi
je 0x133cf5eb
mov eax, ecx
dec ecx
test eax, eax
je 0x133cf5d2
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.1340a5d0
add edi, 0x48
dec esi
jne 0x133cf5bf
mov esi, dword [esp + 0x2c]
mov ecx, dword [0x13512958]
push ecx
call fcn.13429bc8
add esp, 4
mov dword [0x13512958], 0
xor eax, eax
mov dword [0x13512960], eax
mov dword [0x1351295c], eax
jmp 0x133cf756
mov eax, dword [0x13512958]
test eax, eax
jne 0x133cf631
lea edx, [edi + edi*8]
shl edx, 3
push edx
call fcn.1342ad5a
push edi
push eax
mov dword [0x13512958], eax
call fcn.1340ab70
add esp, 0xc
mov dword [0x13512960], edi
mov dword [0x1351295c], edi
jmp 0x133cf756
cmp edi, dword [0x13512960]
jg 0x133cf690
cmp ecx, edi
jge 0x133cf65c
sub edi, ecx
lea ecx, [ecx + ecx*8]
push edi
lea edx, [eax + ecx*8]
push edx
call fcn.1340ab70
lea eax, [esi + 1]
add esp, 8
mov dword [0x1351295c], eax
jmp 0x133cf756
jle 0x133cf683
lea edx, [edi + edi*8]
sub ecx, edi
lea edi, [eax + edx*8]
mov eax, ecx
dec ecx
test eax, eax
je 0x133cf683
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.1340a5d0
add edi, 0x48
dec esi
jne 0x133cf670
mov esi, dword [esp + 0x2c]
lea eax, [esi + 1]
mov dword [0x1351295c], eax
jmp 0x133cf756
mov eax, dword [0x13512964]
test eax, eax
jne 0x133cf6bc
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x133cf6b0
mov eax, 4
jmp 0x133cf6bc
cmp eax, 0x400
jle 0x133cf6bc
mov eax, 0x400
mov ecx, dword [0x13512960]
add eax, ecx
cmp edi, eax
jge 0x133cf6ce
mov dword [esp + 0x38], eax
jmp 0x133cf6d4
mov dword [esp + 0x38], edi
mov eax, edi
lea edx, [eax + eax*8]
shl edx, 3
push edx
call fcn.1342ad5a
mov ecx, dword [0x1351295c]
mov esi, dword [0x13512958]
mov edi, eax
mov dword [esp + 0x84], eax
lea ecx, [ecx + ecx*8]
shl ecx, 3
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
lea esi, [ecx + 1]
mov ecx, dword [0x1351295c]
mov edx, esi
sub edx, ecx
lea ecx, [ecx + ecx*8]
push edx
lea edx, [eax + ecx*8]
push edx
call fcn.1340ab70
mov eax, dword [0x13512958]
push eax
call fcn.13429bc8
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x48]
mov dword [0x1351295c], esi
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov dword [0x13512958], ecx
mov dword [0x13512960], edx
mov edx, dword [0x13512958]
lea ecx, [esi + esi*8]
lea eax, [esp + 0x88]
push eax
lea ecx, [edx + ecx*8]
call fcn.1340a540
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 0x18
call fcn.1343f110
lea ecx, [esp + 0x34]
mov byte [esp + 0xd8], 0x16
call fcn.13444490
lea ecx, [esp + 0x28]
mov byte [esp + 0xd8], 0x12
call fcn.13444490
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 0x11
call fcn.13444490
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd8], 0x10
call fcn.13444490
lea ecx, [esp + 0xcc]
mov byte [esp + 0xd8], 0x1e
call fcn.13444490
lea ecx, [esp + 0xb4]
mov byte [esp + 0xd8], 0x1d
call fcn.1343f110
lea ecx, [esp + 0xac]
mov byte [esp + 0xd8], 0x1c
call fcn.13444490
lea ecx, [esp + 0xa8]
mov byte [esp + 0xd8], 0x1b
call fcn.13444490
lea ecx, [esp + 0xa4]
mov byte [esp + 0xd8], 0xa
call fcn.13444490
mov eax, dword [esp + 0x4c]
inc ebx
cmp ebx, eax
jl 0x133cf2ee
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 6
call fcn.13444490
jmp 0x133cf8f3
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 6
call fcn.13444490
lea eax, [esp + 0x30]
push 0
push eax
call fcn.134034c0
lea ecx, [esp + 0x60]
push 1
lea edx, [esp + 0x54]
mov eax, dword [esp + 0x3c]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x10c], 0x20
call fcn.133bb440
add esp, 0x34
test eax, eax
je 0x133cf8e2
mov ecx, dword [esp + 0x30]
push esi
push edi
push ecx
call fcn.133bb230
add esp, 0xc
test eax, eax
je 0x133cf8e2
push 0
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
mov edx, dword [esp + 0x44]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 1
push edx
push esi
push edi
call fcn.133bd470
add esp, 0x44
lea ecx, [esp + 0x30]
mov byte [esp + 0xd8], 6
call fcn.1343f110
lea ecx, [esp + 0x68]
mov byte [esp + 0xd8], 5
call fcn.134504e0
lea ecx, [esp + 0x58]
mov byte [esp + 0xd8], 4
call fcn.13449e20
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], 2
call fcn.13449e20
lea ecx, [esp + 0x18]
mov byte [esp + 0xd8], 1
call fcn.13444490
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd8], 0
call fcn.13444490
lea ecx, [esp + 0x14]
mov dword [esp + 0xd8], 0xffffffff
call fcn.13444490
mov ecx, dword [esp + 0xd0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xcc
ret