Function at 0x531500
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65cc43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea eax, [esi + 0x410]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x531537
sub eax, edx
sar eax, 1
jne 0x53157c
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.Empty_XML
call fcn.0040bea0
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0052c770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x2c
push ebx
lea eax, [esi + 0x694]
push eax
call fcn.006100a0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x690], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
push 0x17
push ebx
push 0x66ec28
lea ecx, [ebp - 0x1c]
call fcn.00404c50
cmp eax, ebx
jge 0x5315d5
push str.pxmlDOM.CreateInstance____uuidof__MSXML2::DOMDocument30__
push eax
lea ecx, [ebp - 0x64]
call fcn.0040de50
push 0x6ba4dc
lea edx, [ebp - 0x64]
push edx
call fcn.0060fb01
mov eax, 0xb
mov word [ebp - 0x4c], ax
or ecx, 0xffffffff
mov word [ebp - 0x44], cx
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
call fcn.004014f0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00404700
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x531612
push 0x80004003
call fcn.0060f000
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.0052cc90
push eax
lea ecx, [ebp - 0x4c]
call fcn.00501610
lea ecx, [ebp - 0x4c]
call fcn.00501380
test al, al
jne 0x531643
mov dword [ebp - 0x3c], ebx
push 0x6bf548
lea edx, [ebp - 0x3c]
push edx
call fcn.0060fb01
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x53165b
push 0x80004003
call fcn.0060f000
mov edi, eax
mov esi, dword [eax]
lea ecx, [ebp - 0x20]
call fcn.00501bf0
push eax
push edi
mov eax, dword [esi + 0x30]
call eax
cmp eax, ebx
jge 0x531694
push str.pxmlDOM__get_childNodes__pNodes_
push eax
lea ecx, [ebp - 0x84]
call fcn.0040de50
push 0x6ba4dc
lea ecx, [ebp - 0x84]
push ecx
call fcn.0060fb01
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
jmp 0x5316a0
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
jne 0x5316b1
push 0x80004003
call fcn.0060f000
call fcn.004ffc50
cmp ebx, eax
jge 0x531918
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 6
mov dword [ebp + 8], esi
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x20]
cmp eax, esi
jne 0x5316dd
push 0x80004003
call fcn.0060f000
mov edi, eax
mov esi, dword [eax]
lea ecx, [ebp + 8]
call fcn.00501bf0
push eax
push ebx
push edi
mov edx, dword [esi + 0x1c]
call edx
test eax, eax
jns 0x531711
push str.pNodes__get_item_i__pChildNode_
push eax
lea ecx, [ebp - 0x74]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x74]
push eax
call fcn.0060fb01
mov edi, dword [ebp + 8]
test edi, edi
jne 0x531722
push 0x80004003
call fcn.0060f000
push 0
lea ecx, [ebp - 0x30]
call fcn.00506ee0
mov ecx, dword [edi]
mov esi, dword [ebp - 0x30]
push esi
push edi
mov edx, dword [ecx + 0x1c]
call edx
test eax, eax
jns 0x53175e
push str.pChildNode__get_nodeName_name.GetAddress___
push eax
lea ecx, [ebp - 0x94]
call fcn.0040de50
push 0x6ba4dc
lea eax, [ebp - 0x94]
push eax
call fcn.0060fb01
push str.report
lea ecx, [ebp - 0x18]
call fcn.00404680
mov byte [ebp - 4], 8
or dword [ebp - 0x14], 1
mov ecx, dword [eax]
cmp esi, ecx
je 0x5317f4
test esi, esi
jne 0x531798
test ecx, ecx
je 0x5317f4
mov eax, ecx
cmp dword [eax], esi
je 0x5317f4
mov ecx, dword [eax]
push ecx
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
call edi
test eax, eax
jne 0x5317b7
jmp 0x5317f4
test ecx, ecx
jne 0x5317a5
cmp dword [esi], ecx
je 0x5317f4
mov edx, dword [esi]
push edx
jmp 0x53178a
push ecx
mov ecx, esi
call fcn.004ffb50
test eax, eax
je 0x5317f4
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push str.screenshots
lea ecx, [ebp - 0x38]
call fcn.00404680
mov dword [ebp - 4], 9
or dword [ebp - 0x14], 2
mov ecx, dword [eax]
cmp esi, ecx
je 0x5317f4
test esi, esi
jne 0x53187d
test ecx, ecx
je 0x5317f4
mov eax, ecx
cmp dword [eax], esi
je 0x5317f4
mov ecx, dword [eax]
push ecx
call edi
test eax, eax
jne 0x5318a1
mov bl, 1
mov dword [ebp - 4], 9
test byte [ebp - 0x14], 4
je 0x53180f
and dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0x34]
call fcn.00407570
mov dword [ebp - 4], 8
test byte [ebp - 0x14], 2
je 0x531828
and dword [ebp - 0x14], 0xfffffffd
lea ecx, [ebp - 0x38]
call fcn.00407570
mov dword [ebp - 4], 7
test byte [ebp - 0x14], 1
je 0x531841
and dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.00407570
test bl, bl
je 0x531851
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00530b20
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x531864
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.00407570
inc dword [ebp - 0x28]
xor esi, esi
mov ebx, dword [ebp - 0x28]
jmp 0x5316a0
test ecx, ecx
jne 0x531891
cmp dword [esi], ecx
je 0x5317f4
mov edx, dword [esi]
push edx
jmp 0x5317ea
push ecx
mov ecx, esi
call fcn.004ffb50
test eax, eax
je 0x5317f4
push str.icons
lea ecx, [ebp - 0x34]
call fcn.00404680
mov dword [ebp - 4], 0xa
or dword [ebp - 0x14], 4
mov ecx, dword [eax]
cmp esi, ecx
je 0x5317f4
test esi, esi
jne 0x5318e7
test ecx, ecx
je 0x5317f4
mov eax, ecx
cmp dword [eax], esi
je 0x5317f4
mov ecx, dword [eax]
push ecx
call edi
test eax, eax
jne 0x531911
jmp 0x5317f4
test ecx, ecx
jne 0x531901
cmp dword [esi], ecx
je 0x5317f4
mov edx, dword [esi]
push edx
call edi
test eax, eax
jne 0x531911
jmp 0x5317f4
push ecx
mov ecx, esi
call fcn.004ffb50
test eax, eax
je 0x5317f4
xor bl, bl
jmp 0x5317f6
mov esi, dword [ebp - 0x2c]
mov ecx, esi
call fcn.0052cac0
push esi
lea ecx, [ebp + 0xc]
call fcn.0040bea0
mov byte [ebp - 4], 0xb
push str.Data_
lea ecx, [ebp + 0xc]
call fcn.004017a0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.004011f0
add esp, 4
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xc
mov bl, 0xd
mov byte [ebp - 4], bl
push str.Last
lea ecx, [ebp + 0xc]
call fcn.004017a0
push 0x66ea40
lea ecx, [ebp + 0xc]
call fcn.004017a0
mov edi, esi
lea esi, [edi + 0x410]
push esi
lea ecx, [ebp + 0xc]
call fcn.004017a0
push esi
lea ecx, [ebp - 0x24]
call fcn.004017a0
push 1
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x24]
push eax
call fcn.00401450
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp + 0xc]
push edx
call fcn.00401450
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.00530f80
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x24]
call fcn.004014a0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0xc]
call fcn.004014a0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x5319f9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x531a1a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8