Function at 0x405813
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size
Move file

Disassembly:
push 0xffffffffffffffff
push 0x42af2c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x437280]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437280]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
call fcn.00403b2e
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x405867
push 0x80004005
call fcn.00403c6b
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
and dword [esp + 0x50], 0
call fcn.00403b2e
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x40585d
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x24], edi
xor eax, eax
mov byte [esp + 0x50], 1
push eax
push eax
push 3
push eax
push eax
push SysReAllocStringLen
push dword [ebx]
mov dword [esp + 0x4c], 0x76697264
mov dword [esp + 0x50], 0x5c737265
mov dword [esp + 0x54], 0x5c637465
mov dword [esp + 0x58], 0x74736f68
mov word [esp + 0x5c], 0x73
mov dword [esp + 0x44], 0x7461642e
mov byte [esp + 0x48], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x405b2d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0x1c]
mov ebp, eax
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.0040f176
mov ebp, eax
pop ecx
test ebp, ebp
je 0x405b2d
mov edi, 0x3e8
lea ecx, [esp + 0x24]
push edi
call fcn.00403d16
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [esp + 0x24]
push dword [edi - 8]
push edi
call fcn.0040fe1c
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00403bc4
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
mov edx, ebp
call fcn.00401d27
pop ecx
pop ecx
test eax, eax
je 0x405b26
mov ecx, dword [esp + 0x18]
mov ebx, ebp
mov eax, dword [ebx]
lea edx, [esp + 0x28]
cmp eax, dword [edx]
jne 0x405981
movzx eax, byte [ebx + 4]
cmp al, byte [edx + 4]
je 0x405990
lea eax, [ecx - 5]
inc ebx
add eax, ebp
cmp ebx, eax
jbe 0x40596e
jmp 0x405b26
add ebx, 0xfffffff3
mov ecx, 0x439bbc
push ebx
call fcn.00401e48
push 0x11
lea eax, [esp + 0x20]
mov ecx, 0x439bbc
push eax
call fcn.00404682
push eax
mov ecx, 0x439bbc
mov byte [esp + 0x54], 2
call fcn.00401dfd
mov byte [esp + 0x50], 1
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00403bea
push 0x12
lea eax, [esp + 0x34]
push eax
push 0x12
push ebx
call fcn.0040f934
mov ebx, dword [esp + 0x30]
add esp, 0x10
mov eax, dword [ebx]
cmp dword [eax - 4], 1
jle 0x4059f8
push dword [eax - 0xc]
mov ecx, ebx
call fcn.00403c06
mov ecx, dword [ebx]
call fcn.00405c54
push dword [esp + 0x18]
mov edx, ebp
mov ecx, ebx
call fcn.00401cb7
pop ecx
test al, al
jne 0x405b26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x20
jne 0x405a81
push str.nib.d
push 0x432f28
push 0x432f2c
push 0x432f30
call fcn.004117c3
push eax
push 0x432f00
push 0x432f34
push edi
lea eax, [esp + 0x34]
push 0x432f38
push eax
call fcn.004068ad
push dword [esp + 0x3c]
push dword [ebx]
call fcn.00411ba7
push dword [esp + 0x48]
mov edx, ebp
mov ecx, ebx
call fcn.00401cb7
add esp, 0x34
test al, al
jne 0x405a7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x405a81
xor esi, esi
push ebx
lea ecx, [esp + 0x18]
call fcn.00401dfd
test esi, esi
mov esi, dword [esp + 0x14]
je 0x405b26
push 0x5c
push esi
call fcn.00411f03
pop ecx
pop ecx
test eax, eax
jne 0x405aaa
or eax, 0xffffffff
jmp 0x405aac
sub eax, esi
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404682
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 3
call fcn.00401dfd
mov byte [esp + 0x50], 1
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.00403bea
mov esi, dword [esp + 0x14]
cmp dword [esi - 4], 1
jle 0x405af5
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.00403c06
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00405c54
push dword [esp + 0x18]
mov edx, ebp
mov ecx, ebx
call fcn.00401cb7
pop ecx
test al, al
jne 0x405b16
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405b18
xor eax, eax
cmp dword [esi - 0xc], 4
jl 0x405b26
test eax, eax
jne 0x405a97
push ebp
call fcn.0040f17f
pop ecx
lea ecx, [edi - 0x10]
call fcn.00403bea
lea ecx, [esi - 0x10]
call fcn.00403bea
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0040f167
add esp, 0x40
ret