Function at 0x508520
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b21ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
push 1
call fcn.00506600
test eax, eax
jne 0x508569
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
push 1
mov ecx, edi
call fcn.00506600
test eax, eax
jne 0x508598
mov ecx, esi
call fcn.00506720
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ebx, ebx
lea ecx, [ebp - 0x14c]
push ebx
call fcn.00506430
lea eax, [esi + 0x10]
push str..tmp
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.00575d7d
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14c]
push eax
call fcn.005065e0
push 2
lea ecx, [ebp - 0x14c]
call fcn.00506600
test eax, eax
jne 0x50862c
mov ecx, esi
call fcn.00506720
mov ecx, edi
call fcn.00506720
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00575ae8
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], 0xffffffff
call fcn.00506500
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 0x1000
lea ecx, [esi + 0x14]
push 1
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00579d2d
push ebx
push 0x1000
add edi, 0x14
push 1
push edi
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.00579d2d
push ebx
push 0x1000
lea edx, [ebp - 0x138]
push ebx
push edx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.00579d2d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.0057700b
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 6
call fcn.0051d950
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 7
call fcn.0051d950
mov byte [ebp - 4], 8
xor edi, edi
mov eax, dword [esi + 8]
push 0xfffffc00
push eax
lea ecx, [ebp - 0xf0]
call fcn.0057a1f7
cmp eax, ebx
jne 0x5086c7
mov edi, 1
jmp 0x5086df
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x28c]
push 4
push ecx
push edx
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x5086a8
mov eax, dword [esi + 0xc]
push 0xfffffc00
push eax
lea ecx, [ebp - 0xac]
call fcn.0057a1f7
cmp eax, ebx
je 0x508868
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 0x1ec]
push 4
push ecx
push edx
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x5086df
cmp edi, ebx
jne 0x508863
lea eax, [ebp - 0x1e4]
lea ecx, [ebp - 0x284]
push eax
call fcn.0054ea5d
cmp eax, ebx
je 0x508776
mov ecx, dword [esi + 8]
push ecx
lea ecx, [ebp - 0x68]
call fcn.0057a1da
mov edx, dword [esi + 8]
push 0xfffffc00
push edx
lea ecx, [ebp - 0xf0]
call fcn.0057a1f7
cmp eax, ebx
jne 0x50875c
mov edi, 1
jmp 0x508713
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x28c]
push 4
push eax
push ecx
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x50873d
jmp 0x508713
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x284]
push edx
call fcn.0054ea93
cmp eax, ebx
je 0x5087d7
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x68]
push eax
call fcn.0057a1da
mov ecx, dword [esi + 0xc]
push 0xfffffc00
push ecx
lea ecx, [ebp - 0xac]
call fcn.0057a1f7
cmp eax, ebx
jne 0x5087ba
mov edi, 2
jmp 0x508713
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x1ec]
push 4
push edx
push eax
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x508798
jmp 0x508713
mov ecx, dword [esi + 8]
push ecx
lea ecx, [ebp - 0x68]
call fcn.0057a1da
mov edx, dword [esi + 8]
push 0xfffffc00
push edx
lea ecx, [ebp - 0xf0]
call fcn.0057a1f7
cmp eax, ebx
jne 0x508807
mov eax, dword [esi + 8]
mov edi, 1
mov byte [eax], bl
jmp 0x50881f
mov edx, dword [esi + 8]
lea ecx, [ebp - 0x28c]
push 4
push ecx
push edx
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x5087e3
mov eax, dword [esi + 0xc]
push 0xfffffc00
push eax
lea ecx, [ebp - 0xac]
call fcn.0057a1f7
cmp eax, ebx
jne 0x508846
mov ecx, dword [esi + 0xc]
mov edi, 2
mov byte [ecx], bl
jmp 0x508713
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x1ec]
push 4
push edx
push eax
mov ecx, esi
call fcn.00509810
cmp eax, ebx
je 0x50881f
jmp 0x508713
cmp edi, 2
jne 0x508896
mov eax, dword [esi + 8]
cmp byte [eax], bl
je 0x508878
push eax
lea ecx, [ebp - 0x68]
call fcn.0057a1da
mov ecx, dword [esi + 8]
push 0xfffffc00
push ecx
lea ecx, [ebp - 0xf0]
call fcn.0057a1f7
cmp eax, ebx
je 0x5088c4
mov edx, dword [esi + 8]
push edx
jmp 0x508870
mov eax, dword [esi + 0xc]
cmp byte [eax], bl
je 0x5088a6
push eax
lea ecx, [ebp - 0x68]
call fcn.0057a1da
mov eax, dword [esi + 0xc]
push 0xfffffc00
push eax
lea ecx, [ebp - 0xac]
call fcn.0057a1f7
cmp eax, ebx
je 0x5088c4
mov ecx, dword [esi + 0xc]
push ecx
jmp 0x50889e
lea ecx, [ebp - 0xac]
call fcn.00579e91
lea ecx, [ebp - 0xf0]
call fcn.00579e91
lea ecx, [ebp - 0x68]
call fcn.00579e91
mov ecx, dword [ebp + 8]
call fcn.00506720
mov ecx, esi
call fcn.00506720
lea ecx, [ebp - 0x14c]
call fcn.00506720
add esi, 0x10
push str..bak
lea edx, [ebp - 0x18]
push esi
push edx
call fcn.00575d7d
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push ecx
push eax
call edi
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
push esi
push edx
call edi
lea ecx, [ebp - 0x18]
call fcn.00575ae8
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 7
call fcn.0051da80
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 6
call fcn.0051da80
mov dword [ebp - 4], 4
call fcn.00577049
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.00579e09
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.00579e09
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 1
call fcn.00579e09
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00575ae8
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], 0xffffffff
call fcn.00506500
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4