Function at 0x6470ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x6470f4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x64774d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6476a4
mov dl, 1
mov eax, dword [0x48c134]
call fcn.004b80e8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x64714b
call fcn.00409470
test eax, eax
jns 0x647154
call fcn.00409468
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x44], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0x64674c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004c8878
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x6475e6
lea ecx, [ebp - 0x68]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
call fcn.0040c318
mov eax, dword [ebp - 0x64]
mov edx, 0x647768
call fcn.0063c394
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x6c]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
lea eax, [ebp - 4]
call fcn.0040c478
lea ecx, [ebp - 0x70]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 8]
add eax, 0x34
call fcn.0040ba24
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x14]
add eax, 1
jno 0x647204
call fcn.00409470
call fcn.004274a0
push dword [ebp - 0x74]
push 0x647778
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x78]
call fcn.004274a0
push dword [ebp - 0x78]
mov eax, 0x66d258
mov edx, 3
call fcn.0040c500
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x646714
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.004c8878
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x44], edx
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x7c]
call fcn.004276c0
mov esi, eax
test esi, esi
jns 0x647279
call fcn.00409468
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], esi
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x80]
call fcn.004274bc
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.0040ba24
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x64674c
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.004c8878
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
call fcn.00428030
mov eax, dword [ebp - 0x84]
mov dl, 1
call fcn.00427d54
test al, al
jne 0x6472ee
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.00428030
mov eax, dword [ebp - 0x88]
call fcn.00427dfc
push 1
mov eax, dword [ebp - 8]
push dword [eax + 0x48]
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x94]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x94]
mov ecx, 0x647778
mov edx, 0x647788
call fcn.0063c2ac
push dword [ebp - 0x90]
push 0x647798
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.0040c500
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x98]
mov ecx, 0x647798
mov edx, dword [ebp - 4]
call fcn.0040c478
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 8]
pop edx
call fcn.006469a0
mov ebx, eax
test bl, bl
je 0x64756c
xor eax, eax
push ebp
push 0x647529
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x646714
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov eax, dword [ebp - 8]
call fcn.004c8878
lea ecx, [ebp - 0x9c]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x9c]
mov edx, dword [0x665cb0]
mov edx, dword [edx]
call fcn.0040c5b0
jne 0x647438
lea edx, [ebp - 0xa0]
xor eax, eax
call fcn.004076f4
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0xa8]
xor eax, eax
call fcn.004076f4
lea eax, [ebp - 0xa8]
mov edx, 0x6477b0
call fcn.0040c420
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa4]
call fcn.0042807c
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.0040c214
push eax
mov eax, dword [ebp - 0x3c]
call fcn.0040c214
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov byte [0x66554c], 1
mov eax, dword [0x665a54]
mov eax, dword [eax]
mov edx, 0x6477c8
call fcn.0040c5b0
jne 0x64747f
push 0x6477dc
lea ecx, [ebp - 0xac]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xac]
push 0x647798
mov eax, 0x66d264
mov edx, 3
call fcn.0040c500
jmp 0x6474b1
push 0x647804
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xb0]
push 0x647798
mov eax, 0x66d264
mov edx, 3
call fcn.0040c500
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0x646714
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov eax, dword [ebp - 8]
call fcn.004c8878
lea ecx, [ebp - 0xb8]
mov edx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
lea eax, [ebp - 0xb4]
call fcn.0040c478
mov eax, dword [ebp - 0xb4]
push eax
lea eax, [ebp - 0xbc]
mov ecx, 0x647798
mov edx, dword [ebp - 4]
call fcn.0040c478
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00647fa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6475a5
mov eax, dword [0x665a54]
mov eax, dword [eax]
mov edx, 0x6477c8
call fcn.0040c5b0
jne 0x647590
mov eax, 0x66d264
mov edx, 0x6478ec
call fcn.0040ba24
jmp 0x64759f
mov eax, 0x66d264
mov edx, 0x647954
call fcn.0040ba24
mov byte [ebp - 0xd], 1
jmp 0x647603
add dword [ebp - 0x14], 1
jno 0x6475b0
call fcn.00409470
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x6475bc
call fcn.00409468
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0x646900
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov eax, dword [ebp - 8]
call fcn.004c8878
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x647603
mov eax, dword [ebp - 8]
cmp byte [eax + 0xe], 0
je 0x647189
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0x646900
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.004c8878
mov eax, dword [ebp - 0xc]
call fcn.0040985c
cmp byte [ebp - 0xd], 0
jne 0x64771d
mov eax, dword [0x665a54]
mov eax, dword [eax]
mov edx, 0x6477c8
call fcn.0040c5b0
jne 0x64765c
mov eax, 0x66d264
mov edx, 0x6479b0
call fcn.0040ba24
jmp 0x64766b
mov eax, 0x66d264
mov edx, 0x6479f4
call fcn.0040ba24
mov eax, 0x66d258
mov edx, 0x647a30
call fcn.0040ba24
mov eax, dword [0x665ab0]
mov eax, dword [eax]
mov eax, dword [eax + 0x484]
mov dl, 1
call fcn.0054699c
mov eax, dword [0x665ab0]
mov eax, dword [eax]
mov eax, dword [eax + 0x484]
xor edx, edx
call fcn.0054699c
jmp 0x64771d
mov eax, dword [0x665a54]
mov eax, dword [eax]
mov edx, 0x6477c8
call fcn.0040c5b0
jne 0x6476eb
mov eax, 0x66d264
mov edx, 0x647a70
call fcn.0040ba24
mov eax, dword [0x665ab0]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
mov dl, 1
call fcn.0054699c
mov eax, 0x66d258
mov edx, 0x647a9c
call fcn.0040ba24
jmp 0x6476fa
mov eax, 0x66d264
mov edx, 0x647af0
call fcn.0040ba24
mov eax, dword [0x665ab0]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
mov dl, 1
call fcn.0054699c
mov eax, 0x66d258
mov edx, 0x647b14
call fcn.0040ba24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647754
lea eax, [ebp - 0xbc]
mov edx, 0x16
call fcn.0040b694
lea eax, [ebp - 0x64]
call fcn.0040b67c
lea eax, [ebp - 4]
call fcn.0040b634
pop eax
jmp eax