Function at 0x406fcb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e0
mov dword [ebp - 0x8dc], ecx
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x14]
add eax, 0x30
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x890], eax
push dword [ebp - 0x890]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
je 0x4070f5
lea eax, [ebp - 0x400]
mov dword [ebp - 0x86c], eax
push 0x4098b4
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x404]
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4098b0
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x86c]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x86c], eax
push 0x4098ac
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x404]
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x86c]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x86c], eax
push 0x40989c
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x86c]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0x86c], eax
push 0x409898
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x407107
push str.All_files
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x58
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.00401e5a
add esp, 0xc
mov dword [ebp - 0x468], 0x58
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x400]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x438], 0x409878
mov dword [ebp - 0x434], 6
mov dword [ebp - 0x42c], 0x4094b8
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x14]
add eax, 0x30
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
cmp dword [eax + 4], 0
je 0x40719e
mov eax, dword [ebp - 0x894]
mov eax, dword [eax + 4]
movsx eax, byte [eax]
test eax, eax
je 0x40719e
and dword [ebp - 0x8e0], 0
jmp 0x4071a8
mov dword [ebp - 0x8e0], 1
movzx eax, byte [ebp - 0x8e0]
test eax, eax
je 0x4071b8
jmp 0x40749e
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x14]
add eax, 0x30
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov eax, dword [eax + 4]
mov dword [ebp - 0x89c], eax
push dword [ebp - 0x89c]
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x868]
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x40728d
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x8a4], eax
push dword [ebp - 0x8a4]
push dword [ebp - 0x8a0]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x8dc]
push dword [eax + 0x1c]
mov ecx, dword [ebp - 0x8dc]
call fcn.00402371
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x8dc]
mov byte [ecx + 0x3d], al
mov eax, dword [ebp - 0x8dc]
push dword [eax + 0x18]
mov ecx, dword [ebp - 0x8dc]
call fcn.00402371
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x8dc]
mov byte [ecx + 0x3c], al
push 6
mov ecx, dword [ebp - 0x8dc]
call fcn.00402478
push 0x400
lea ecx, [ebp - 0x40c]
call fcn.004084c7
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x8a8], eax
push 0x400
push dword [ebp - 0x8a8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x8b0], eax
push dword [ebp - 0x8ac]
push dword [ebp - 0x8b0]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407486
push 0
lea ecx, [ebp - 0x87c]
call fcn.004084c7
push 0
lea ecx, [ebp - 0x874]
call fcn.004084c7
xor eax, eax
je 0x407314
jmp 0x4073fc
mov dword [ebp - 0x880], 1
jmp 0x40732d
mov eax, dword [ebp - 0x880]
inc eax
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x8b4], eax
push dword [ebp - 0x8b4]
push str._s
lea eax, [ebp - 0x874]
push eax
call fcn.0040869d
add esp, 0xc
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x8b8], eax
mov edx, str..exe
mov ecx, dword [ebp - 0x8b8]
call fcn.004089cd
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0
je 0x4073b3
mov eax, dword [ebp - 0x888]
mov byte [eax], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x8bc], eax
push dword [ebp - 0x880]
push dword [ebp - 0x8bc]
push str._s._d.exe
lea eax, [ebp - 0x87c]
push eax
call fcn.0040869d
add esp, 0x10
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x8c0], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 0x8c0]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 0xffffffff
jne 0x4073eb
jmp 0x4073fc
push dword [ebp - 0x884]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407320
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x8c8], eax
push dword [ebp - 0x8c4]
push dword [ebp - 0x8c8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x14]
mov byte [eax + 0x40], 1
mov eax, dword [ebp - 0x8dc]
mov eax, dword [eax + 0x14]
add eax, 0x44
mov dword [ebp - 0x8cc], eax
push dword [ebp - 0x878]
mov ecx, dword [ebp - 0x8cc]
call fcn.0040853c
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x8d0], eax
push dword [ebp - 0x8d0]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x8d4], eax
push dword [ebp - 0x8d4]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x8d8], eax
push dword [ebp - 0x8d8]
call fcn.00401eb5
pop ecx
leave
ret