Function at 0x401200
Capabilities:
Delete file
Hash data using sha256
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x180], edx
mov edx, dword [0x46fcb4]
push esi
push edi
mov esi, dword [ebx]
add esi, 8
lea ecx, [esi + 0xa]
call fcn.004060a0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [ebx]
push dword [ebx + 4]
push dword [edi + 4]
call fcn.00423710
mov ecx, dword [edi + 4]
add esp, 0xc
mov eax, dword [ebx]
mov edx, dword [str._old]
mov esi, dword [0x466434]
mov dword [ecx + eax], edx
lea edx, [ebp - 0x17c]
mov dword [ecx + eax + 4], esi
mov ecx, dword [edi + 4]
call fcn.00410b20
test eax, eax
jns 0x401092
nop dword [eax + eax]
cmp eax, 0xc0000043
je 0x401092
cmp eax, 0xc0000022
jne 0x4011b9
push dword [ebp + 8]
mov edx, dword [ebp - 0x180]
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x154], 3
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0x6a09e667
mov dword [ebp - 0x144], 0xbb67ae85
mov dword [ebp - 0x140], 0x3c6ef372
mov dword [ebp - 0x13c], 0xa54ff53a
mov dword [ebp - 0x138], 0x510e527f
mov dword [ebp - 0x134], 0x9b05688c
mov dword [ebp - 0x130], 0x1f83d9ab
mov dword [ebp - 0x12c], 0x5be0cd19
call fcn.00412ae0
mov eax, dword ds:[ebp - 0x154]
cmp eax, 3
ja case.default.0x401129
jmp dword [eax*4 + 0x4011f0]
lea ecx, [ebp - 0x150]
call fcn.0041ebb0
movups xmm0, xmmword [ebp - 0xf8]
movups xmmword [ebp - 0x28], xmm0
jmp 0x401171
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x150]
call fcn.00420480
jmp 0x401171
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x28], eax
jmp 0x401171
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x150]
call fcn.0041e910
lea edx, [ebp - 0x48]
mov ecx, edi
call fcn.00405700
test al, al
je 0x4011b9
lea edx, [ebp - 0x28]
mov esi, 0x1c
lea eax, [ebp - 0x48]
nop word [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4011b9
add edx, 4
add eax, 4
sub esi, 4
jae 0x401190
mov edx, dword [ebx + 4]
mov ecx, dword [edi + 4]
push 1
call fcn.00411480
test eax, eax
setns bl
jmp 0x4011bb
xor bl, bl
lea ecx, [edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4011ce
call fcn.00406180
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret 4
push 0xc000000d
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
xor byte [ecx], dl
inc eax
add byte [eax + 0x11], cl
inc eax
add byte [eax + 0x11], bl
inc eax
add byte [ebx + 0x11], ah
inc eax
add byte [esi], bh
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x46e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x154], eax
mov edi, ecx
mov dword [ebp - 0x150], 3
mov edx, eax
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0x6a09e667
mov dword [ebp - 0x140], 0xbb67ae85
mov dword [ebp - 0x13c], 0x3c6ef372
mov dword [ebp - 0x138], 0xa54ff53a
mov dword [ebp - 0x134], 0x510e527f
mov dword [ebp - 0x130], 0x9b05688c
mov dword [ebp - 0x12c], 0x1f83d9ab
mov dword [ebp - 0x128], 0x5be0cd19
call fcn.00412ae0
mov eax, dword [ebp - 0x150]
cmp eax, 3
ja case.default.0x4012b4
jmp dword [eax*4 + 0x401408]
lea ecx, [ebp - 0x14c]
call fcn.0041ebb0
movups xmm0, xmmword [ebp - 0xf4]
movups xmmword [ebp - 0x24], xmm0
jmp 0x401305
lea edx, ds:[ebp - 0x24]
lea ecx, [ebp - 0x14c]
call fcn.00420480
jmp 0x401305
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x24], eax
jmp 0x401305
lea edx, ds:[ebp - 0x24]
lea ecx, [ebp - 0x14c]
call fcn.0041e910
lea edx, [ebp - 0x44]
mov ecx, ebx
call fcn.00405700
test al, al
jne 0x40131a
xor bl, bl
jmp 0x4013e8
lea ecx, [ebp - 0x24]
mov esi, 0x1c
lea edx, [ebp - 0x44]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40133d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401325
mov bl, 1
jmp 0x4013e8
mov edx, dword [0x46fcb4]
mov byte [edi + 0x6c], 1
mov esi, dword [ebx]
add esi, 8
lea ecx, [esi + 0xa]
call fcn.004060a0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], esi
mov dword [edi + 4], eax
mov word [eax + esi], cx
push dword [ebx]
push dword [ebx + 4]
push dword [edi + 4]
call fcn.00423710
mov ecx, dword [edi + 4]
add esp, 0xc
mov eax, dword [ebx]
mov edx, dword [str._old]
mov esi, dword [0x466434]
mov dword [ecx + eax], edx
mov dword [ecx + eax + 4], esi
mov ecx, dword [edi + 4]
call fcn.00410c60
mov edx, dword ds:[edi + 4]
mov ecx, dword [ebx + 4]
push 1
call fcn.00411480
test eax, eax
jns 0x4013ad
xor bl, bl
jmp 0x4013cf
push 4
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x154]
mov ecx, ebx
call fcn.004055e0
test al, al
setne bl
test edi, edi
je 0x4013e8
lea ecx, ds:[edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4013e8
call fcn.00406180
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004218f3
mov esp, ebp
pop ebp
ret 8
push 0xc000000d
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ebx, 0xd3004012
adc al, byte [eax]
out 0x12, eax
inc eax
add dl, dh
adc al, byte [eax]
int3