Function at 0x4208e8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff388
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edx, [ebx + 0x8de8]
mov eax, dword [ebx + 0x856c]
mov ecx, dword [eax]
test ecx, ecx
je 0x420919
mov eax, dword [eax + 4]
add eax, 0x68
push eax
push edx
call fcn.0069a464
add esp, 8
lea edx, [ebx + 0x8e08]
mov eax, dword [ebx + 0x856c]
mov ecx, dword [eax]
test ecx, ecx
je 0x42093d
mov eax, dword [eax + 4]
add eax, 0x268
push eax
push edx
call fcn.0069a464
add esp, 8
lea edx, [ebx + 0x8e08]
push edx
call fcn.004014ac
pop ecx
test al, al
jne 0x42095f
lea ecx, [ebx + 0x8de8]
push ecx
call fcn.004014ac
pop ecx
test al, al
je 0x420984
push 0xffffffffffffffff
push 0x4a1
lea eax, [ebx + 0x8544]
push eax
call fcn.00415004
add esp, 0xc
push eax
push ebx
call fcn.004365c8
add esp, 8
jmp 0x420bc6
mov edx, dword [ebx + 0x8df0]
push edx
mov ecx, dword [ebx + 0x8e10]
push ecx
call fcn.0069cfd8
add esp, 8
test eax, eax
je 0x4209e6
lea eax, [ebx + 0x8e08]
push eax
call fcn.00401498
pop ecx
test al, al
je 0x4209e6
lea eax, [ebx + 0x8e08]
mov edx, dword [eax + 8]
push edx
mov ecx, dword [ebx + 0x8568]
push ecx
call fcn.0042c67c
add esp, 8
mov eax, dword [ebx + 0x8e10]
push eax
call fcn.0069e948
pop ecx
test eax, eax
je 0x4209e6
mov edx, dword [ebx + 0x8568]
push edx
call fcn.0042c638
pop ecx
mov eax, dword [ebx + 0x8e10]
mov edx, dword [ebx + 0x8df0]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x420a14
test cl, cl
je 0x420a0e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x420a14
add eax, 2
add edx, 2
test cl, cl
jne 0x4209f2
je 0x420ab3
mov al, byte [ebx + 0x8578]
test al, al
je 0x420a23
call fcn.0040a35c
mov byte [ebp - 1], 0
call fcn.00401a80
cmp al, 2
jne 0x420a4d
mov edx, dword [ebx + 0x8e10]
push edx
mov ecx, dword [ebx + 0x8df0]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x420a6a
mov byte [ebp - 1], 1
jmp 0x420a6a
push 2
mov eax, dword [ebx + 0x8e10]
push eax
mov edx, dword [ebx + 0x8df0]
push edx
call sub.KERNEL32.DLL_MoveFileExA
test eax, eax
jne 0x420a6a
mov byte [ebp - 1], 1
mov cl, byte [ebp - 1]
test cl, cl
je 0x420ab3
mov eax, dword [ebx + 0x8e20]
push eax
push 0xffffffffffffffff
push 0x432
lea edx, [ebx + 0x8544]
push edx
call fcn.00415004
add esp, 0xc
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.006a0ad0
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
push ebx
call fcn.004365c8
add esp, 8
jmp 0x420bc6
push 0xffffffffffffffff
push 0x433
lea edx, [ebx + 0x8544]
push edx
call fcn.00415004
add esp, 0xc
push eax
push ebx
call fcn.004365c8
mov esi, dword [ebx + 0x856c]
add esp, 8
lea edi, [ebx + 0x8de8]
mov eax, dword [esi]
test eax, eax
je 0x420b07
push pe_nt_image_headers32
mov edx, dword [edi + 8]
push edx
mov ecx, dword [esi + 4]
add ecx, 0x68
push ecx
call fcn.0069d020
add esp, 0xc
mov eax, dword [esi + 4]
mov byte [eax + 0x267], 0
lea edi, [ebx + 0x8e08]
mov esi, dword [ebx + 0x856c]
mov eax, dword [esi]
test eax, eax
je 0x420b3e
push pe_nt_image_headers32
mov edx, dword [edi + 8]
push edx
mov ecx, dword [esi + 4]
add ecx, 0x268
push ecx
call fcn.0069d020
add esp, 0xc
mov eax, dword [esi + 4]
mov byte [eax + 0x467], 0
mov ebx, dword [ebx + 0x856c]
mov edx, dword [ebx]
test edx, edx
je 0x420bc6
mov esi, dword [ebx + 4]
mov dword [esi], 0xf
xor eax, eax
mov dword [esi + 4], eax
push 0x474
push esi
lea edx, [ebp - 0xc78]
push edx
call fcn.0069cc60
add esp, 0xc
lea ecx, [ebp - 0xc78]
push ecx
mov eax, dword [0x6b07c0]
push eax
call fcn.0040d1b4
add esp, 8
mov edx, dword [ebp - 0xc14]
mov dword [ebx + 8], edx
lea ecx, [ebp - 0xc10]
push pe_nt_image_headers32
push ecx
mov edi, eax
mov eax, dword [ebx + 4]
add eax, 0x68
push eax
call fcn.0069cc60
add esp, 0xc
lea edx, [ebp - 0xa10]
push pe_nt_image_headers32
push edx
mov ecx, dword [ebx + 4]
add ecx, 0x268
push ecx
call fcn.0069cc60
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret