Function at 0x402440
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x412cfb
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str..ACP
push ebp
call fcn.004080c4
mov eax, dword [esp + 0x260]
mov ebx, dword [esp + 0x264]
mov esi, 1
add esp, 8
cmp eax, esi
jle 0x4024ac
lea edi, [ebx + 4]
mov eax, dword [edi]
push 0x41a2fc
push eax
call fcn.0040808f
add esp, 8
test eax, eax
je 0x4024b6
mov eax, dword [esp + 0x258]
inc esi
add edi, 4
cmp esi, eax
jl 0x402489
cmp dword [esp + 0x258], 1
jne 0x4024c0
call fcn.004023d0
jmp 0x4028ba
push 0x41de38
push 0x100
push str.xiaobaohappyxiaohaohappyxiaobaoh
call fcn.00401430
mov eax, dword [esp + 0x264]
add esp, 0xc
cmp eax, 1
jle 0x40281f
add ebx, 4
dec eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov esi, dword [ebx]
push str._...
push esi
push str.Process
push 0x41e130
call fcn.004035c0
add esp, 8
push eax
call fcn.004035c0
add esp, 8
push eax
call fcn.004035c0
add esp, 8
mov edi, eax
mov ecx, edi
push 0xa
call fcn.00402fe0
mov ecx, edi
call fcn.00403150
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402552
push str.File_not_found_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
jmp 0x402560
test al, 0x10
je 0x40257f
push str.Directory_skipped_
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, esi
call fcn.00403150
jmp 0x402805
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bp
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x30]
push esi
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push str._tmp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x402624
push str.Failed_to_rename_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x402611
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402611
mov edi, 4
mov eax, dword [esi]
push ebp
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
jmp 0x402805
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x2c]
push ecx
call fcn.00401f70
add esp, 4
lea edx, [esp + 0x2c]
mov bl, al
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x40268c
push str.Completed_
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x4026d9
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4026d9
jmp 0x4026d4
push str.Failed_to_restore_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x4026d9
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4026d9
mov edi, 4
mov eax, dword [esi]
push ebp
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x258], 2
jle 0x402805
mov cl, byte [esp + 0x13]
push ebp
mov byte [esp + 0x20], cl
lea ecx, [esp + 0x20]
call fcn.004032b0
mov eax, dword [0x416974]
mov esi, 0x4b
cmp eax, esi
jne 0x402722
call fcn.00407689
push 1
push esi
lea ecx, [esp + 0x24]
call fcn.00403380
test al, al
je 0x402751
mov edx, dword [esp + 0x20]
push esi
push 0x3d
push edx
call fcn.004028e0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], esi
add esp, 0xc
mov word [eax + 0x96], bp
mov eax, dword [esp + 0x20]
mov dword [esp + 0x250], ebp
cmp eax, ebp
jne 0x402765
mov eax, 0x416970
push eax
push 0x41e130
call fcn.004035c0
add esp, 8
mov ecx, 0x41e130
push 0xa
call fcn.00402fe0
mov ecx, dword [0x41e130]
xor esi, esi
mov eax, dword [ecx + 4]
test byte [eax + 0x41e134], 6
jne 0x4027aa
mov eax, dword [eax + 0x41e158]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4027aa
mov esi, 4
mov eax, dword [0x41e130]
mov ecx, dword [eax + 4]
add ecx, 0x41e130
cmp esi, ebp
je 0x4027c8
mov eax, dword [ecx + 4]
push ebp
or eax, esi
push eax
call fcn.00403290
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x250], 0xffffffff
cmp ecx, ebp
je 0x4027f9
mov al, byte [ecx - 1]
test al, al
je 0x4027ed
cmp al, 0xff
je 0x4027ed
dec al
mov byte [ecx - 1], al
jmp 0x4027f9
add ecx, 0xfffffffe
push ecx
call fcn.0040767e
add esp, 4
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
jne 0x4024f3
push 0xa
mov ecx, 0x41e0f8
call fcn.00402920
mov ecx, dword [0x41e0f8]
xor esi, esi
mov eax, dword [ecx + 4]
test byte [eax + 0x41e0fc], 6
jne 0x402856
mov eax, dword [eax + 0x41e120]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402856
mov esi, 4
mov eax, dword [0x41e0f8]
mov ecx, dword [eax + 4]
add ecx, 0x41e0f8
cmp esi, ebp
je 0x40287d
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebp
jne 0x402876
or al, 4
push ebp
push eax
call fcn.00407205
mov esi, 3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x244
ret