Function at 0x4319f0
Capabilities:
Get common file path
Get file size
Move file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
push 5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x431a1a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
mov ecx, dword [0x45785c]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x458420], ecx
test esi, esi
je 0x431aa6
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
push eax
push esi
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x431a5b
mov edi, dword [esp + 0x14]
mov eax, edi
push 0
inc eax
neg eax
sbb eax, eax
and eax, edi
push eax
push 1
push 0
push 1
push 0
push esi
call ebp
cmp eax, 0xffffffff
je 0x431a86
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x431cd4
push 0x400
push 0x458420
push esi
call ebx
test eax, eax
je 0x431cd4
cmp eax, 0x400
jg 0x431cd4
mov ecx, dword [esp + 0x3c]
push 0x400
push 0x458020
push ecx
call ebx
test eax, eax
je 0x431cd4
cmp eax, 0x400
jg 0x431cd4
push 0x458020
push 0x458420
mov ecx, 0x100
xor eax, eax
mov edi, 0x457c20
push str._s_s_r_n
push 0x3ff
push 0x457c20
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
mov esi, eax
mov dword [esp + 0x3c], esi
push 0x3f0
push 0x458020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x431cd4
push str.wininit.ini
push 0x458020
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x431cd4
push 0
push 0x8000080
push 4
push 0
push 0
push 0xc0000000
push 0x458020
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431cd4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x431ccd
lea edx, [edi + esi + 0xa]
push 0
push edx
push 0
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
mov dword [esp + 0x40], esi
je 0x431ccd
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
je 0x431bd2
push str._Rename__r_n
push ebp
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
jne 0x431bf1
push 0x14
lea eax, [edi + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
test eax, eax
jne 0x431be8
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
add edi, 0xa
mov dword [esp + 0x10], edi
jmp 0x431c23
add eax, 0xa
push 0x457834
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x431c23
lea ecx, [edi + ebp]
inc esi
cmp ecx, esi
jb 0x431c1f
mov eax, dword [esp + 0x3c]
mov dl, byte [ecx]
mov byte [ecx + eax], dl
dec ecx
cmp ecx, esi
jae 0x431c11
sub esi, ebp
mov edi, esi
mov ecx, dword [esp + 0x3c]
mov esi, 0x457c20
mov edx, ecx
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x431c61
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
test eax, eax
jne 0x431c7f
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
push 0
add edx, eax
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
push ebx
jne 0x431ca7
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
push ebx
jne 0x431cbe
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret