Function at 0x101aecb0
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7c]
sub esp, 0x7c
push 0xffffffffffffffff
push 0x101d3dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp + 0x78], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0xe4], 0
je 0x101aecf5
xor al, al
jmp 0x101aef6d
lea esi, [ebx + 0x40]
push esi
mov dword [ebp - 0x18], esi
call fcn.10086a40
add esp, 4
test al, al
je 0x101aecee
lea edi, [ebx + 0x58]
push edi
call fcn.10086a40
add esp, 4
test al, al
je 0x101aecee
mov ecx, esi
call fcn.10003ad0
mov esi, eax
call fcn.1009b280
push ecx
push esi
mov ecx, eax
call fcn.1009b360
test al, al
je 0x101aecee
mov ecx, edi
call fcn.10003ad0
mov esi, eax
call fcn.1009b280
push ecx
push esi
mov ecx, eax
call fcn.1009b360
test al, al
je 0x101aecee
lea edi, [ebx + 0x70]
push str..tmp
mov edx, edi
lea ecx, [ebp + 0x48]
call fcn.100227b0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp]
call fcn.10003bb0
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x10]
call fcn.10003ad0
push eax
lea ecx, [ebp + 0x48]
call fcn.10003ad0
push eax
lea ecx, [ebx + 0x58]
call fcn.10003ad0
push eax
lea eax, [ebp]
push str._m___s___s___s___h__s
push eax
call fcn.100851e0
mov eax, dword [ebx + 0xf0]
lea edx, [ebp]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor bl, bl
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esi
push eax
push esi
mov dword [ebp - 0x10], esi
call fcn.100904a0
add esp, 0x1c
test al, al
je 0x101aede9
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov ecx, esi
mov bl, 1
call fcn.10090980
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xe8], esi
test bl, bl
je 0x101aef50
cmp esi, 0x2710
sete bl
jne 0x101aef50
push edi
mov dword [eax + 0xe8], 0
call fcn.10086a40
add esp, 4
test al, al
je 0x101aee31
push edi
lea eax, [ebp + 0x48]
push eax
call fcn.101ac410
mov bl, al
jmp 0x101aef50
push 0xb
mov ecx, edi
call fcn.10003ad0
push eax
lea ecx, [ebp + 0x48]
call fcn.10003ad0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
test eax, eax
jne 0x101aef1f
lea ecx, [ebp + 0x18]
xor bl, bl
call fcn.10003bb0
mov byte [ebp - 4], 2
lea edx, [ebp + 0x18]
lea ecx, [ebp + 0x48]
call fcn.100a5430
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp + 0x30]
call fcn.10003bb0
mov byte [ebp - 4], 3
lea edx, [ebp + 0x30]
mov ecx, edi
call fcn.100a5430
test al, al
jne 0x101aee98
test bl, bl
je 0x101aeeb2
push 0xb
lea ecx, [ebp + 0x30]
call fcn.10003ad0
push eax
lea ecx, [ebp + 0x18]
call fcn.10003ad0
push eax
call esi
test eax, eax
jne 0x101aef07
mov ecx, edi
call fcn.100a4e30
cmp eax, 0xffffffff
je 0x101aef36
push edi
lea ecx, [ebp + 0x60]
call fcn.10005840
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x60]
call fcn.100a51f0
test al, al
je 0x101aef2a
lea edx, [ebp + 0x60]
mov ecx, edi
call fcn.100a4ed0
test al, al
je 0x101aef2a
mov edx, edi
lea ecx, [ebp + 0x48]
call fcn.100a4ed0
lea ecx, [ebp + 0x60]
test al, al
je 0x101aef23
call fcn.100a4fe0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.10003b10
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.10003b10
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.10003b10
mov bl, 1
jmp 0x101aef50
mov edx, edi
call fcn.100a4ed0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.10003b10
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.10003b10
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.10003b10
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.10003b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x48]
call fcn.10003b10
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x78]
xor ecx, ebp
call fcn.101b075c
lea esp, [ebp + 0x7c]
pop ebp
ret