Function at 0x4e274b
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov word [ebx + 0x820], 0x101
mov dword [ebx + 0x824], 0xc8
mov eax, dword [esi]
push 0x400
push str.http:__dump.upload.duba.net_DumpFileUploader_duba_dump___utm.gif
mov eax, dword [eax]
mov dword [ebx + 0x828], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x82c], eax
lea eax, [ebx + 0x3d68]
push eax
call fcn.00427870
xor eax, eax
push eax
push eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebx + 0x830], eax
call fcn.004e1864
push ebx
push esi
push edi
call fcn.004e1c44
mov dword [ebp - 0x660], eax
xor esi, esi
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.004f28b0
add esp, 0x3c
lea eax, [ebp - 0x44]
push 0x10
push 0x20
push eax
movzx eax, byte [ebx + 0x820]
push esi
push esi
push eax
call fcn.004e272f
add esp, 0xc
push eax
call fcn.004f8d41
xor eax, eax
push 0x206
mov word [ebp - 0x454], ax
lea eax, [ebp - 0x452]
push esi
push eax
call fcn.004f28b0
lea eax, [ebp - 0x44]
mov edi, 0x104
push eax
push ebx
lea eax, [ebx + 0x2874]
push eax
lea eax, [ebx + 0x266c]
push eax
push str._s____s____s____s
lea eax, [ebp - 0x454]
push edi
push eax
call fcn.004f8b54
xor eax, eax
push 0x206
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push esi
push eax
call fcn.004f28b0
add esp, 0x44
lea eax, [ebx + 0x834]
push edi
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00427870
add esp, 0xc
cmp word [ebp - 0x24c], si
je 0x4e289e
lea eax, [ebp - 0x24c]
push 0x5c
push eax
call fcn.004f4fbb
pop ecx
pop ecx
test eax, eax
je 0x4e289e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._s_s.dmp
lea esi, [ebx + 0x1a3c]
push edi
push esi
call fcn.004f8b54
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x24c]
push ecx
push str._s_s.txt
lea eax, [ebx + 0x1c44]
push edi
push eax
call fcn.004f8b54
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._s_s.log
lea edi, [ebx + 0x1e4c]
push 0x104
push edi
call fcn.004f8b54
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x65c], ax
lea eax, [ebp - 0x65a]
push eax
call fcn.004f28b0
add esp, 0x48
lea eax, [ebx + 0x410]
push eax
push str._sliebao.log
lea eax, [ebp - 0x65c]
push 0x104
push eax
call fcn.004f8b54
add esp, 0x10
lea eax, [ebp - 0x65c]
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
lea edi, [ebx + 0x834]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4e296b
xor al, al
jmp 0x4e2a5c
push 0x104
push esi
push edi
call fcn.00427870
push 0x20
lea eax, [ebx + 0x4770]
push str.1441792
push eax
call fcn.00427870
lea edi, [ebx + 0x2464]
push edi
push str.__s_
lea eax, [ebx + 0x3adc]
push 0x106
push eax
call fcn.004f8b54
push dword [ebp - 0x660]
mov esi, 0x55d334
lea eax, [ebx + 0x3ce8]
push esi
push 0x20
push eax
call fcn.004f8b54
push dword [0x5aca48]
lea eax, [ebx + 0x3d28]
push esi
push 0x20
push eax
call fcn.004f8b54
add esp, 0x48
lea esi, [ebx + 0x4568]
push 0x104
push esi
call fcn.004e2332
movzx eax, byte [ebx + 0x821]
lea ecx, [ebx + 0x618]
push 0
push esi
push 0
push str.1625462909
push dword [ebx + 0x824]
push eax
movzx eax, byte [ebx + 0x820]
push eax
lea eax, [ebx + 0x3d68]
push eax
lea eax, [ebx + 0x1e4c]
push eax
lea eax, [ebx + 0x1c44]
push eax
lea eax, [ebx + 0x1a3c]
push eax
lea eax, [ebx + 0x2a7c]
push eax
push edi
push dword [ebx + 0x82c]
push dword [ebx + 0x828]
push ecx
push str.__s___exception_code__u__exception_address__u__program_path___s___exception_file_path___s___dump_file___s___txt_file___s___log_file___s___server_address___s___show_gui__d__up_dump__d__dump_channel__u__liebao_QQ__s__try_except_count__d__browser_version___s___except_why___d_
lea ecx, [ebx + 0xa3c]
push 0x800
push ecx
call fcn.004f8b54
add esp, 0x54
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret