Function at 0x5901fcb0
Capabilities:
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59141048
push eax
mov eax, dword [0x5919cca0]
mov dword fs:[0], esp
sub esp, 0xc0
test eax, eax
push ebx
mov ebx, dword [esp + 0xd4]
push ebp
mov ebp, dword [esp + 0xdc]
push esi
push edi
je 0x5901fd01
push ebp
push ebx
push str.AnalyseQQExEMailAttach___________08x___d_
push str.MailLog
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x18
mov eax, dword [esp + 0xf4]
test eax, eax
je 0x5901fd12
mov dword [eax], 0
test ebx, ebx
je 0x5902069c
test ebp, ebp
je 0x5902069c
push 0x5919dc50
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebp
call fcn.5909e9e0
lea eax, [esp + 0x14]
mov dword [esp + 0xd8], 0
push eax
push ebp
push ebx
call fcn.59037330
push 0x5917a428
push 0x5917a42c
push ebp
lea ecx, [esp + 0x34]
push ebx
push ecx
mov esi, eax
call fcn.5901c1f0
push 0x5917ae30
push ebp
push ebx
mov byte [esp + 0x104], 1
call fcn.5900f390
mov edx, eax
add esp, 0x2c
cmp edx, 0xffffffff
je 0x59020677
mov edi, 0x5917ae30
or ecx, 0xffffffff
xor eax, eax
push 0x5919dc50
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x1c]
add ebx, edx
sub ebp, edx
call fcn.5909e9e0
cmp ebp, 0x164
mov byte [esp + 0xd8], 2
jle 0x5901fe2d
lea edx, [ebx + 0x144]
push 0x14
lea eax, [esp + 0x24]
push edx
push eax
call fcn.590b3ee0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdc], 3
call fcn.5909f310
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 2
call fcn.5909f180
mov eax, dword [0x5919cca0]
test eax, eax
je 0x5901fe2d
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [ebx + 0x15c]
push edx
push eax
push ecx
push str.AnalyseQQExEMailAttach__1__office:_08x____s__strData_:__s___size:_s_
push str.MailLog
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x20
cmp esi, ebp
jge 0x5901fe39
test esi, esi
jle 0x5901fe39
add ebx, esi
sub ebp, esi
mov eax, dword [0x5919cca0]
test eax, eax
je 0x5901fe5e
push esi
push ebp
push ebx
push str.AnalyseQQExEMailAttach_2___08x___d____d_
push str.MailLog
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x1c
lea ecx, [esp + 0x48]
call fcn.590a4b00
lea ecx, [esp + 0x58]
mov byte [esp + 0xd8], 4
call fcn.590a4b00
lea ecx, [esp + 0x68]
mov byte [esp + 0xd8], 5
call fcn.590ab1c0
mov edx, dword [0x5915584c]
mov byte [esp + 0xd8], 6
mov dword [esp + 0x10], edx
lea eax, [esp + 0x20]
push 0x5917a758
push eax
mov byte [esp + 0xe0], 7
call fcn.590543e0
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 8
call fcn.59099f80
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 7
call fcn.59099e00
mov edi, dword [esp + 0xf4]
test edi, edi
jne 0x5901ff3f
mov ecx, dword [esp + 0x10]
push 0x180
push 0x8101
push ecx
call fcn.590821dd
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x5901ff9b
mov eax, dword [0x5919cca0]
test eax, eax
je 0x5901ff2e
mov edx, dword [esp + 0x10]
push ebx
push edx
push ebp
push str.AnalyseQQExEMailAttach_3_writefile__len_:__d___astrAttachFilePath_:__S_
push str.MailLog
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x1c
push ebp
push ebx
push esi
call fcn.59081fed
push esi
call fcn.59081f0d
add esp, 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
lea ecx, [esp + 0x70]
call fcn.590ab400
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x28]
call fcn.5909e880
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xe0], 9
call fcn.590a5110
mov ecx, dword [esp + 0x5c]
push str.unknow
push ecx
lea ecx, [esp + 0x60]
call fcn.590a5020
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 7
call fcn.5909f180
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 6
call fcn.59099e00
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x59020633
test edi, edi
je 0x5901ffc7
mov dword [edi], 1
jmp 0x59020633
mov eax, dword [0x5919cca0]
mov esi, dword [esp + 0x44]
test eax, eax
je 0x5901fff5
mov edi, dword [esp + 0x40]
push esi
push edi
push str.AnalyseQQExEMailAttach______08x___d_
push str.MailLog
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x18
jmp 0x5901fff9
mov edi, dword [esp + 0x40]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
call fcn.5909e780
mov ebp, dword [esp + 0xec]
mov byte [esp + 0xd8], 0xa
test ebp, ebp
je 0x5902058b
mov eax, dword [esp + 0x4c]
xor ebx, ebx
test eax, eax
jle 0x59020575
jmp 0x59020032
mov esi, dword [esp + 0x44]
mov eax, dword [0x59155850]
mov dword [esp + 0xa4], eax
mov byte [esp + 0xd8], 0xb
mov dword [esp + 0xa8], eax
mov byte [esp + 0xd8], 0xc
mov dword [esp + 0xac], eax
mov ecx, dword [0x5915584c]
mov byte [esp + 0xd8], 0xd
mov dword [esp + 0xb4], ecx
mov byte [esp + 0xd8], 0xe
mov dword [esp + 0xcc], eax
mov edx, dword [esp + 0xe8]
lea eax, [esp + 0x24]
mov byte [esp + 0xd8], 0x10
push eax
lea ecx, [esp + 0xa8]
mov dword [esp + 0x8c], edx
call fcn.5909f310
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
mov eax, dword [ebp + 8]
mov dword [esp + 0x90], edx
mov dword [esp + 0x8c], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x9c]
mov dword [esp + 0x94], eax
push edx
mov dword [esp + 0x9c], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x48]
lea ecx, [eax + ebx*4]
push ecx
lea ecx, [esp + 0x40]
call fcn.5909e780
push 0x5c
lea ecx, [esp + 0x40]
mov byte [esp + 0xdc], 0x11
call fcn.590a0330
inc eax
lea edx, [esp + 0x20]
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.590a1470
lea eax, [esp + 0x78]
mov byte [esp + 0xd8], 0x12
push eax
call fcn.5900d240
add esp, 4
mov eax, dword [eax]
lea ecx, [esp + 0x84]
push eax
mov byte [esp + 0xdc], 0x13
call fcn.5909e880
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0xe4], 0x14
call fcn.5909f720
lea ecx, [esp + 0x84]
mov byte [esp + 0xd8], 0x17
call fcn.5909f180
lea ecx, [esp + 0x78]
mov byte [esp + 0xd8], 0x16
call fcn.59099e00
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov eax, dword [eax + ebx*4]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [esp + 0x28]
lea ecx, [esp + 0xac]
push edx
call fcn.5909f310
push 0x2e
lea ecx, [esp + 0x2c]
call fcn.590a0330
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
call fcn.590a18c0
push 0x5917affc
lea ecx, [esp + 0x38]
mov byte [esp + 0xdc], 0x18
call fcn.5909fdd0
mov ecx, dword [esp + 0x58]
lea edx, [ecx + ebx*4]
lea ecx, [esp + 0xa8]
push edx
call fcn.5909f310
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x34]
push edx
mov ecx, dword [eax + ebx*4]
mov dword [esp + 0xb4], ecx
lea ecx, [esp + 0x80]
call fcn.590996a0
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0xdc], 0x19
call fcn.59099f80
lea ecx, [esp + 0x7c]
mov byte [esp + 0xd8], 0x18
call fcn.59099e00
mov eax, dword [esp + 0xb4]
push 0x180
push 0x8101
push eax
call fcn.590821dd
mov ecx, dword [0x5915584c]
add esp, 0xc
mov edi, eax
mov dword [esp + 0x10], ecx
cmp edi, 0xffffffff
mov byte [esp + 0xd8], 0x1a
je 0x590202c0
mov edx, dword [esp + 0x40]
push esi
push edx
push edi
call fcn.59081fed
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xa8]
mov edx, dword [ebp + 0xc]
add esp, 0xc
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 4]
push edx
mov edx, dword [ebp]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str._r_n_r_nliTickBegin:_I64u__liTickEnd:_I64u__liTickRecord:_I64u
push eax
call fcn.5909cc60
mov ecx, dword [esp + 0x30]
add esp, 0x20
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push 0
call fcn.5909aa90
push eax
push edi
call fcn.59081fed
push edi
call fcn.59081f0d
add esp, 0x10
mov edx, dword [esp + 0x10]
mov ecx, dword [0x5919dafc]
mov eax, dword [edx - 8]
add eax, esi
mov esi, ecx
cmp esi, ecx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x2c], esi
jl 0x59020496
lea edi, [esi + 1]
test edi, edi
jne 0x5902033c
mov edi, dword [0x5919daf8]
test edi, edi
je 0x5902032b
mov eax, ecx
dec ecx
test eax, eax
je 0x59020312
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.5905b490
add edi, 0x48
dec esi
jne 0x590202ff
mov esi, dword [esp + 0x2c]
mov ecx, dword [0x5919daf8]
push ecx
call fcn.591315d9
add esp, 4
mov dword [0x5919daf8], 0
xor eax, eax
mov dword [0x5919db00], eax
mov dword [0x5919dafc], eax
jmp 0x59020496
mov eax, dword [0x5919daf8]
test eax, eax
jne 0x59020371
lea edx, [edi + edi*8]
shl edx, 3
push edx
call fcn.591315b0
push edi
push eax
mov dword [0x5919daf8], eax
call fcn.5905ba30
add esp, 0xc
mov dword [0x5919db00], edi
mov dword [0x5919dafc], edi
jmp 0x59020496
cmp edi, dword [0x5919db00]
jg 0x590203d0
cmp ecx, edi
jge 0x5902039c
sub edi, ecx
lea ecx, [ecx + ecx*8]
push edi
lea edx, [eax + ecx*8]
push edx
call fcn.5905ba30
lea eax, [esi + 1]
add esp, 8
mov dword [0x5919dafc], eax
jmp 0x59020496
jle 0x590203c3
lea edx, [edi + edi*8]
sub ecx, edi
lea edi, [eax + edx*8]
mov eax, ecx
dec ecx
test eax, eax
je 0x590203c3
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.5905b490
add edi, 0x48
dec esi
jne 0x590203b0
mov esi, dword [esp + 0x2c]
lea eax, [esi + 1]
mov dword [0x5919dafc], eax
jmp 0x59020496
mov eax, dword [0x5919db04]
test eax, eax
jne 0x590203fc
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x590203f0
mov eax, 4
jmp 0x590203fc
cmp eax, 0x400
jle 0x590203fc
mov eax, 0x400
mov ecx, dword [0x5919db00]
add eax, ecx
cmp edi, eax
jge 0x5902040e
mov dword [esp + 0x38], eax
jmp 0x59020414
mov dword [esp + 0x38], edi
mov eax, edi
lea edx, [eax + eax*8]
shl edx, 3
push edx
call fcn.591315b0
mov ecx, dword [0x5919dafc]
mov esi, dword [0x5919daf8]
mov edi, eax
mov dword [esp + 0x84], eax
lea ecx, [ecx + ecx*8]
shl ecx, 3
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
lea esi, [ecx + 1]
mov ecx, dword [0x5919dafc]
mov edx, esi
sub edx, ecx
lea ecx, [ecx + ecx*8]
push edx
lea edx, [eax + ecx*8]
push edx
call fcn.5905ba30
mov eax, dword [0x5919daf8]
push eax
call fcn.591315d9
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x48]
mov dword [0x5919dafc], esi
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov dword [0x5919daf8], ecx
mov dword [0x5919db00], edx
mov edx, dword [0x5919daf8]
lea ecx, [esi + esi*8]
lea eax, [esp + 0x88]
push eax
lea ecx, [edx + ecx*8]
call fcn.5905b400
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 0x18
call fcn.59099e00
lea ecx, [esp + 0x34]
mov byte [esp + 0xd8], 0x16
call fcn.5909f180
lea ecx, [esp + 0x28]
mov byte [esp + 0xd8], 0x12
call fcn.5909f180
lea ecx, [esp + 0x20]
mov byte [esp + 0xd8], 0x11
call fcn.5909f180
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd8], 0x10
call fcn.5909f180
lea ecx, [esp + 0xcc]
mov byte [esp + 0xd8], 0x1e
call fcn.5909f180
lea ecx, [esp + 0xb4]
mov byte [esp + 0xd8], 0x1d
call fcn.59099e00
lea ecx, [esp + 0xac]
mov byte [esp + 0xd8], 0x1c
call fcn.5909f180
lea ecx, [esp + 0xa8]
mov byte [esp + 0xd8], 0x1b
call fcn.5909f180
lea ecx, [esp + 0xa4]
mov byte [esp + 0xd8], 0xa
call fcn.5909f180
mov eax, dword [esp + 0x4c]
inc ebx
cmp ebx, eax
jl 0x5902002e
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 6
call fcn.5909f180
jmp 0x59020633
lea ecx, [esp + 0x24]
mov byte [esp + 0xd8], 6
call fcn.5909f180
lea eax, [esp + 0x30]
push 0
push eax
call fcn.590543e0
lea ecx, [esp + 0x60]
push 1
lea edx, [esp + 0x54]
mov eax, dword [esp + 0x3c]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov byte [esp + 0x10c], 0x20
call fcn.5900c0f0
add esp, 0x34
test eax, eax
je 0x59020622
mov ecx, dword [esp + 0x30]
push esi
push edi
push ecx
call fcn.5900bee0
add esp, 0xc
test eax, eax
je 0x59020622
push 0
lea edx, [esp + 0x6c]
push 0
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
mov edx, dword [esp + 0x44]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 1
push edx
push esi
push edi
call fcn.5900e1b0
add esp, 0x44
lea ecx, [esp + 0x30]
mov byte [esp + 0xd8], 6
call fcn.59099e00
lea ecx, [esp + 0x68]
mov byte [esp + 0xd8], 5
call fcn.590ab1d0
lea ecx, [esp + 0x58]
mov byte [esp + 0xd8], 4
call fcn.590a4b10
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], 2
call fcn.590a4b10
lea ecx, [esp + 0x18]
mov byte [esp + 0xd8], 1
call fcn.5909f180
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd8], 0
call fcn.5909f180
lea ecx, [esp + 0x14]
mov dword [esp + 0xd8], 0xffffffff
call fcn.5909f180
mov ecx, dword [esp + 0xd0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xcc
ret