Function at 0x594330
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00403e28
lea eax, [ebp - 0x4c]
mov edx, dword [0x53da40]
call fcn.00403e48
xor eax, eax
push ebp
push 0x594b18
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004fe288
mov esi, dword [eax + 0x19c]
mov byte [ebp - 0x15], 0
mov eax, dword [edi + 0x168]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 5], 0
je 0x594622
mov dl, 1
mov eax, edi
call fcn.00593a58
test al, al
jne 0x5943ab
mov byte [ebp - 6], 1
jmp 0x594ad7
cmp byte [edi + 0x45c], 0
je 0x5943fa
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.0055fcd8
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
mov edx, dword [0x6690d8]
mov edx, dword [edx + 0x22]
mov ecx, dword [0x66950c]
mov edx, dword [ecx + edx*4]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 4]
pop eax
call fcn.006547e4
mov eax, dword [0x6690d8]
mov eax, dword [eax + 0x22]
call fcn.00534234
mov dword [esi + 0x60], eax
jmp 0x594454
cmp byte [edi + 0x432], 0
jne 0x594454
mov eax, dword [edi + 0x168]
call fcn.005342a8
test al, al
je 0x594422
mov eax, dword [edi + 0x168]
call fcn.00534234
mov dword [esi + 0x60], eax
jmp 0x594454
mov eax, dword [esi + 0x60]
call fcn.00534258
mov edx, dword [0x66950c]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x54]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.006547e4
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.006549c4
cmp dword [ebp - 0x50], 0
jne 0x594472
lea eax, [ebp - 4]
mov edx, 0x594b30
call fcn.00403ac4
cmp byte [edi + 0x427], 0
je 0x5944a0
mov eax, dword [0x669208]
test byte [eax], 2
je 0x5944a0
lea eax, [ebp - 0x50]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0055fe18
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
mov eax, dword [0x6690d8]
test byte [eax + 9], 0x80
jne 0x5944ce
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.00654994
mov ecx, dword [ebp - 0x50]
mov eax, dword [0x6698dc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00403b24
lea eax, [esi + 0x38]
mov edx, dword [ebp - 4]
call fcn.004038bc
lea eax, [esi + 0x34]
mov edx, 0x594b3c
call fcn.004032c8
mov eax, dword [0x6691ac]
mov edx, dword [edi + 0x160]
call fcn.004038bc
mov eax, dword [0x6691ac]
add eax, 4
mov edx, dword [edi + 0x178]
call fcn.004032c8
cmp byte [edi + 0x427], 0
jne 0x594522
cmp byte [edi + 0x43c], 0
jne 0x594522
mov byte [esi + 0x86], 1
mov byte [esi + 0x56], 2
cmp byte [edi + 0x3f6], 0
jne 0x594559
cmp byte [edi + 0x3f5], 0
jne 0x594559
cmp byte [edi + 0x43c], 0
jne 0x594559
cmp byte [edi + 0x45c], 0
jne 0x594559
mov eax, dword [edi + 0x160]
call fcn.00654560
test al, al
jne 0x59455d
xor eax, eax
jmp 0x59455f
mov al, 1
mov byte [esi + 0x84], al
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
jne 0x59458a
mov byte [esi + 0x84], 0
mov byte [ebp - 6], 1
mov eax, dword [0x6691ac]
call fcn.00403880
jmp 0x594ad7
lea edx, [ebp - 4]
mov eax, esi
call fcn.0062d7b8
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.00654730
mov ebx, eax
xor bl, 1
mov al, byte [esi + 0x84]
and al, bl
mov byte [ebp - 0x15], al
mov byte [esi + 0x84], 0
mov eax, dword [esi + 0x60]
call fcn.00534258
mov dword [ebp - 0x14], eax
test bl, bl
je 0x5945e6
mov eax, dword [ebp - 4]
call fcn.00533f84
test al, al
je 0x594622
mov eax, 0x594b50
mov edx, dword [ebp - 4]
call fcn.0061f9ec
jmp 0x594509
cmp byte [edi + 0x3f5], 0
je 0x594604
mov eax, 0x594c50
mov edx, dword [edi + 0x160]
call fcn.0061f9ec
jmp 0x594509
cmp byte [edi + 0x3f6], 0
je 0x594622
mov eax, 0x594c78
mov edx, dword [edi + 0x160]
call fcn.0061f938
jmp 0x594509
cmp byte [ebp - 0x15], 0
je 0x5946ff
cmp byte [edi + 0x38], 0
jne 0x5946ff
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x168]
jne 0x5946ff
mov eax, edi
call fcn.005b4db0
push 3
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x5946bb
mov eax, dword [0x6699a0]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.0064fdd8
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, edi
call fcn.004fe290
mov eax, dword [0x669510]
mov byte [eax + 0xf], 1
mov eax, dword [0x669510]
mov byte [eax + 0x10], 1
mov eax, dword [0x6699a0]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.00618538
mov eax, dword [0x669a50]
or dword [eax], 0x40
mov byte [ebp - 6], 0
jmp 0x5946cc
mov dl, 3
mov eax, dword [edi + 0x160]
call fcn.0061fba8
mov byte [ebp - 6], 1
mov eax, dword [edi + 0x160]
call fcn.0061c66c
test al, al
jne 0x594abf
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.006585a4
mov dword [edi + 0x164], eax
jmp 0x594abf
cmp dword [ebp - 0x14], 6
jne 0x59471b
xor edx, edx
mov eax, edi
call fcn.00593aec
test al, al
jne 0x59471b
mov byte [ebp - 6], 1
jmp 0x594abf
cmp byte [0x66506c], 0
je 0x59479f
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, edi
call fcn.005b4bb4
test al, al
je 0x59479f
mov byte [edi + 0x432], 1
mov eax, dword [0x6694ac]
mov eax, dword [eax + 4]
call fcn.00534234
mov dword [esi + 0x60], eax
lea eax, [ebp - 0x54]
mov edx, dword [0x6694ac]
mov edx, dword [edx + 4]
mov ecx, dword [0x66950c]
mov edx, dword [ecx + edx*4]
call fcn.00403a34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.006547e4
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, edi
call fcn.00594330
mov byte [ebp - 6], al
mov byte [edi + 0x432], 0
cmp byte [ebp - 6], 1
jne 0x594abf
mov byte [edi + 0x431], 0
jmp 0x594abf
cmp byte [0x66c3dd], 0
jne 0x5947d1
mov eax, dword [ebp - 4]
call fcn.00654560
test al, al
je 0x5947d1
lea edx, [ebp - 4]
mov cl, byte [0x594ca0]
mov eax, edi
call fcn.0053e9fc
test al, al
jne 0x5947d1
mov byte [ebp - 6], 1
jmp 0x594abf
cmp dword [ebp - 0x14], 4
sete al
and al, byte [ebp - 5]
je 0x594834
cmp dword [edi + 0x168], 4
jne 0x5947ef
cmp byte [edi + 0x427], 0
jne 0x594834
lea eax, [edi + 0x178]
call fcn.004c4f20
test al, al
je 0x594821
call fcn.00421650
lea ecx, [ebp - 0x58]
mov edx, dword [edi + 0x178]
call fcn.00421030
mov edx, dword [ebp - 0x58]
lea eax, [edi + 0x178]
call fcn.004032c8
jmp 0x594834
mov byte [ebp - 6], 1
mov eax, dword [0x6691ac]
call fcn.00403880
jmp 0x594ad7
mov ebx, dword [edi + 0x164]
test ebx, ebx
je 0x594850
mov eax, ebx
call fcn.0061c7f0
test al, al
jne 0x594850
mov eax, edi
call fcn.005b4db0
mov eax, dword [edi + 0x164]
mov dword [ebp - 0x10], eax
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.00654730
mov ebx, eax
xor bl, 1
cmp dword [edi + 0x164], 0
sete al
or al, bl
je 0x5948b9
mov eax, dword [ebp - 4]
call fcn.006585c4
mov esi, eax
mov dword [edi + 0x164], esi
inc esi
jne 0x5948b9
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0061fba8
cmp ax, 2
jne 0x59487a
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
mov byte [ebp - 6], 2
mov eax, dword [0x6691ac]
call fcn.00403880
jmp 0x594ad7
lea eax, [ebp - 0xc]
mov edx, dword [edi + 0x160]
call fcn.004038bc
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x78]
mov eax, edi
call fcn.005c0e14
push edi
lea esi, [ebp - 0x78]
lea edi, [ebp - 0x48]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0x16c]
mov dword [ebp - 0x24], eax
mov al, byte [edi + 0x170]
mov byte [ebp - 0x4b], al
mov al, byte [0x594ca4]
mov byte [ebp - 0x4a], al
cmp byte [edi + 0x45c], 0
je 0x59491f
or byte [ebp - 0x4a], 1
cmp byte [ebp - 5], 0
je 0x594931
mov dword [edi + 0x1cc], 1
jmp 0x594937
inc dword [edi + 0x1cc]
lea edx, [ebp - 0x4c]
mov eax, edi
call fcn.005b45b8
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x594a7b
cmp byte [0x66c3dd], 0
je 0x594963
mov eax, edi
call fcn.005b4db0
jmp 0x594aaf
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 0x164]
je 0x59498a
cmp dword [ebp - 0x10], 0
je 0x59498a
test bl, bl
jne 0x594981
cmp dword [edi + 0x168], 2
je 0x59498a
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x15], 0
je 0x594999
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, edi
call fcn.005f4c10
mov byte [edi + 0x3f5], 0
mov byte [edi + 0x3f6], 0
push 0
mov eax, dword [edi + 0x164]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [edi + 0x1b8], eax
call fcn.006557f0
fstp qword [edi + 0x1a0]
wait
mov eax, dword [edi + 0x1a0]
mov dword [edi + 0x1a8], eax
mov eax, dword [edi + 0x1a4]
mov dword [edi + 0x1ac], eax
mov eax, edi
call fcn.005b4db0
cmp byte [edi + 0x45c], 0
jne 0x594a20
mov eax, dword [edi + 0x160]
call fcn.0061c66c
test al, al
jne 0x594a20
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.006585a4
mov dword [edi + 0x164], eax
cmp byte [edi + 0x45c], 0
je 0x594a42
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
mov eax, dword [0x6690d8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x22], edx
mov eax, dword [edi + 0x174]
test eax, eax
je 0x594aaf
call fcn.0044b990
push 0x401
push 0
push 0
mov eax, dword [0x66984c]
mov eax, dword [eax]
push eax
call sub.user32.dll_RedrawWindow
mov eax, dword [0x669510]
mov byte [eax + 0xf], 1
mov eax, dword [0x669510]
mov byte [eax + 0x10], 1
jmp 0x594aaf
mov eax, dword [edi + 0x164]
cmp eax, dword [ebp - 0x10]
je 0x594aaf
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
cmp byte [0x66c3dd], 0
jne 0x594abf
mov eax, edi
call fcn.004fe290
mov eax, dword [0x6691ac]
call fcn.00403880
mov eax, dword [0x669510]
mov byte [eax + 0x11], 1
call fcn.004fe3f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594b1f
lea eax, [ebp - 0x58]
call fcn.00403274
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x4c]
mov edx, dword [0x53da40]
call fcn.00403f10
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret