Function at 0x42d840
Capabilities:
Check mutex on windows
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0378
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1160
call fcn.00488190
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
push str.CInternal::moveCrashLog
push str._UNO___s_Begin_moveCrashLog
mov dword [ebp - 0x1160], ebx
call fcn.00422df0
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0
mov dword [ebp - 0x1144], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 4], 0
call fcn.004866f0
lea esi, [ebx + 0xc44]
add esp, 0x14
test esi, esi
je 0x42dad5
push 0x104
push esi
call fcn.00489354
add esp, 8
test eax, eax
je 0x42dad5
lea eax, [ebx + 0x424]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00488884
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xe64]
call fcn.004146f0
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x114c]
mov byte [ebp - 4], 1
call fcn.0042e920
cmp dword [ebp - 0xe50], 8
mov byte [ebp - 4], 0
jb 0x42d961
push dword [ebp - 0xe64]
call fcn.00486409
add esp, 4
lea ecx, [ebx + 0x14]
lea edx, [ebp - 0x21c]
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d970
lea eax, [ebp - 0x21c]
push eax
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xc44], ax
lea eax, [ebp - 0xc42]
push eax
call fcn.004866f0
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xc44]
push str._s_s
push eax
call fcn.00424c20
add esp, 0x1c
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0xe64]
call fcn.004146f0
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x114c]
mov byte [ebp - 4], 2
call fcn.0042e920
cmp dword [ebp - 0xe50], 8
mov byte [ebp - 4], 0
jb 0x42da02
push dword [ebp - 0xe64]
call fcn.00486409
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xe4c], ax
lea eax, [ebp - 0xe4a]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0xe4c]
push eax
lea esi, [ebx + 0x21c]
push esi
mov ecx, ebx
call fcn.0042d080
cmp dword [ebx + 0x116c], 0
mov dword [ebp - 0x1154], 0
je 0x42daf1
lea eax, [ebp - 0xe4c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x1154], eax
test eax, eax
je 0x42daf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42daf1
push esi
push str._UNO__move_to_TOGO__other_exe_UNO_access_the_TOGO_folder__give_up_this_time:__s
call fcn.00422df0
mov esi, dword [ebp - 0x114c]
add esp, 8
mov eax, dword [ebp - 0x1154]
test eax, eax
je 0x42da9d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CInternal::moveCrashLog
push str._UNO___s_End_moveCrashLog
call fcn.00422df0
add esp, 8
test esi, esi
je 0x42dad5
push dword [ebp - 0x1164]
lea eax, [ebp - 0x113d]
push eax
push dword [ebp - 0x1148]
push esi
call fcn.00424450
push esi
call fcn.00486409
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret
xor edi, edi
mov ecx, dword [ebp - 0x1148]
mov esi, dword [ebp - 0x114c]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x1158], edi
cmp edi, eax
jae 0x42da8c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
call fcn.004866f0
lea eax, [edi + edi*2]
add esp, 0xc
cmp dword [esi + eax*8 + 0x14], 8
lea esi, [esi + eax*8]
jb 0x42db4f
mov eax, dword [esi]
jmp 0x42db51
mov eax, esi
push eax
lea eax, [ebp - 0x424]
push str._s.json
push eax
call fcn.0042f2d0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa3c], ax
lea eax, [ebp - 0xa3a]
push eax
call fcn.004866f0
add esp, 0x18
cmp dword [esi + 0x14], 8
jb 0x42db89
mov esi, dword [esi]
lea eax, [ebp - 0xa3c]
push eax
push esi
mov ecx, ebx
call fcn.0042d080
xor esi, esi
mov dword [ebp - 0x1138], esi
cmp dword [ebx + 0x116c], esi
je 0x42dbf7
lea eax, [ebp - 0xa3c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x1138], esi
test esi, esi
je 0x42dbf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42dbf1
lea eax, [ebp - 0x424]
push eax
push str._UNO__other_exe_UNO_access_the_same_folder__give_up_this_time:__s
call fcn.00422df0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x42daf3
mov esi, dword [ebp - 0x1138]
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x113c], eax
cmp eax, 0xffffffff
je 0x42e0d5
lea ebx, [ebx]
test byte [ebp - 0x1134], 0x10
jne 0x42e0ac
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call fcn.004866f0
mov ecx, dword [ebp - 0x114c]
lea eax, [edi + edi*2]
add esp, 0xc
cmp dword [ecx + eax*8 + 0x14], 8
lea eax, [ecx + eax*8]
jb 0x42dc60
mov eax, dword [eax]
lea ecx, [ebp - 0x1108]
push ecx
push eax
lea eax, [ebp - 0x62c]
push str._s_s
push eax
call fcn.0042f2d0
add esp, 0x10
lea ecx, [ebp - 0xee4]
push 0
push 0x400
push 0
call fcn.00424c80
lea eax, [ebp - 0x1150]
push eax
lea eax, [ebp - 0x62c]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x1150], 0
call fcn.0042f9a0
mov edi, eax
add esp, 8
mov dword [ebp - 0x115c], edi
mov byte [ebp - 4], 4
test edi, edi
je 0x42e021
cmp dword [ebp - 0x1150], 0
jbe 0x42e021
lea eax, [ebp - 0x116c]
push eax
lea ecx, [ebp - 0xee4]
mov dword [ebp - 0x116c], edi
mov dword [ebp - 0x1168], edi
call fcn.00423ea0
cmp dword [eax + 0x30], 0
jne 0x42e021
mov dword [ebp - 0xe98], 0xf
mov dword [ebp - 0xe68], 0xf
mov esi, dword [ebp - 0xee4]
push str.exe_name
lea eax, [ebp - 0x1170]
shl esi, 5
add esi, dword [ebp - 0xedc]
push eax
lea ecx, [ebp - 0xee4]
mov byte [ebp - 4], 6
mov dword [ebp - 0xe9c], 0
mov byte [ebp - 0xeac], 0
mov dword [ebp - 0xe6c], 0
mov byte [ebp - 0xe7c], 0
call fcn.00426ed0
cmp dword [eax], esi
je 0x42dda6
push str.exe_name
lea ecx, [ebp - 0xee4]
call fcn.00422eb0
mov edx, eax
mov eax, 0x1000
test word [edx + 0xe], ax
jne 0x42dd81
mov edx, dword [edx + 8]
cmp byte [edx], 0
jne 0x42dd8a
xor ecx, ecx
jmp 0x42dd99
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42dd90
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xeac]
call fcn.00411dd0
mov esi, dword [ebp - 0xee4]
push str.Process_ID
lea eax, [ebp - 0x1164]
shl esi, 5
add esi, dword [ebp - 0xedc]
push eax
lea ecx, [ebp - 0xee4]
call fcn.00426ed0
cmp dword [eax], esi
je 0x42de16
push str.Process_ID
lea ecx, [ebp - 0xee4]
call fcn.00422eb0
mov edx, eax
mov eax, 0x1000
test word [edx + 0xe], ax
jne 0x42ddf0
mov edx, dword [edx + 8]
cmp byte [edx], 0
jne 0x42ddf9
xor ecx, ecx
jmp 0x42de09
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42de00
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xe7c]
call fcn.00411dd0
cmp dword [ebp - 0xe9c], 0
je 0x42dfb7
cmp dword [ebp - 0xe6c], 0
je 0x42dfb7
xor eax, eax
mov dword [ebp - 0xe50], 7
mov dword [ebp - 0xe54], 0
mov word [ebp - 0xe64], ax
mov dword [ebp - 0xe80], 7
mov dword [ebp - 0xe84], eax
mov word [ebp - 0xe94], ax
cmp dword [ebp - 0xe98], 0x10
lea ecx, [ebp - 0xe64]
lea eax, [ebp - 0xeac]
cmovae eax, dword [ebp - 0xeac]
push ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.0042f1f0
cmp dword [ebp - 0xe68], 0x10
lea ecx, [ebp - 0xe94]
lea eax, [ebp - 0xe7c]
cmovae eax, dword [ebp - 0xe7c]
push ecx
push eax
mov ecx, ebx
call fcn.0042f1f0
cmp dword [ebp - 0xe50], 8
lea eax, [ebx + 0xc44]
lea ecx, [ebp - 0xe64]
cmovae ecx, dword [ebp - 0xe64]
push eax
push ecx
call fcn.004896c8
add esp, 8
test eax, eax
jne 0x42df6c
cmp dword [ebp - 0xe80], 8
lea eax, [ebx + 0xe4c]
lea ecx, [ebp - 0xe94]
cmovae ecx, dword [ebp - 0xe94]
push eax
push ecx
call fcn.004896c8
add esp, 8
test eax, eax
jne 0x42df6c
push 0x206
push eax
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push eax
call fcn.004866f0
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebx + 0x21c]
push eax
lea eax, [ebp - 0x834]
push str._s_s
push eax
call fcn.0042f2d0
add esp, 0x1c
lea eax, [ebp - 0x834]
push 0
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x834]
push eax
push str.CInternal::moveCrashLog
push str._UNO___s_move_file_to_TOGO:__s
call fcn.00422df0
add esp, 0xc
cmp dword [ebp - 0xe80], 8
jb 0x42df83
push dword [ebp - 0xe94]
call fcn.00486409
add esp, 4
xor eax, eax
cmp dword [ebp - 0xe50], 8
mov dword [ebp - 0xe80], 7
mov dword [ebp - 0xe84], 0
mov word [ebp - 0xe94], ax
jb 0x42dfb7
push dword [ebp - 0xe64]
call fcn.00486409
add esp, 4
cmp dword [ebp - 0xe68], 0x10
jb 0x42dfce
push dword [ebp - 0xe7c]
call fcn.00486409
add esp, 4
cmp dword [ebp - 0xe98], 0x10
mov dword [ebp - 0xe68], 0xf
mov dword [ebp - 0xe6c], 0
mov byte [ebp - 0xe7c], 0
jb 0x42e021
push dword [ebp - 0xeac]
call fcn.00486409
add esp, 4
jmp 0x42e021
mov dword [ebp - 4], 3
test edi, edi
je 0x42e035
push edi
call fcn.004871da
add esp, 4
mov esi, dword [ebp - 0xed0]
mov byte [ebp - 4], 0
test esi, esi
je 0x42e087
cmp dword [esi], 0
je 0x42e064
mov edi, dword [esi]
cmp edi, dword [esi + 8]
je 0x42e064
push dword [esi]
mov edi, dword [edi + 8]
call fcn.004871da
add esp, 4
mov dword [esi], edi
test edi, edi
jne 0x42e048
jmp 0x42e076
mov eax, dword [esi]
test eax, eax
je 0x42e076
cmp eax, dword [esi + 8]
jne 0x42e076
mov dword [eax + 4], 0
push dword [esi + 0x10]
call fcn.00486409
push esi
call fcn.00486409
add esp, 8
push dword [ebp - 0xec4]
call fcn.004871da
push dword [ebp - 0xec8]
call fcn.00486409
mov edi, dword [ebp - 0x1158]
mov eax, dword [ebp - 0x113c]
add esp, 8
lea ecx, [ebp - 0x1134]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x113c]
jne 0x42dc20
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x1138]
test esi, esi
je 0x42e0e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x42daf3