Function at 0x101169ad
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov eax, edx
xor esi, esi
mov dword [ebp - 0xc], eax
test edi, edi
je 0x101169ca
cmp word [edi], si
jne 0x101169e1
push 0x10048c84
mov edx, 0x9c4
mov ecx, 0x10047bd8
call fcn.100e970f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
test eax, eax
je 0x10116bea
mov ecx, eax
call fcn.100b5558
mov ecx, edi
mov edx, eax
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10116a08
sub ecx, dword [ebp - 0x18]
sar ecx, 1
push ecx
push edi
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x10116bea
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.100eb4ef
mov esi, eax
test esi, esi
jns 0x10116a57
push 0x10048ca0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x10116ba9
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push 0x10037980
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10116a79
push 0x10048cc8
jmp 0x10116a42
push 1
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
jne 0x10116ab4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10116aa2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10116aa9
mov esi, 0x80004005
push dword [ebp - 0x10]
push dword [ebp - 0xc]
jmp 0x10116b94
cmp dword [ebp + 8], ebx
je 0x10116b25
push edi
push dword [ebp - 8]
lea eax, [ebp - 4]
push 0x100391f8
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
js 0x10116a72
push 1
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
jne 0x10116b25
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10116afd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10116b04
mov esi, 0x80004005
mov edi, dword [ebp - 4]
push edi
push dword [ebp + 8]
push 0x10048ce8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x18
jmp 0x10116bac
cmp dword [ebp + 0xc], ebx
je 0x10116ba9
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push 0x1003bfc8
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10116b5f
push 0x10048cc8
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 0x14]
add esp, 0x10
jmp 0x10116ba9
mov ebx, dword [ebp - 0x14]
push 1
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
jne 0x10116ba9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10116b89
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10116b90
mov esi, 0x80004005
push ebx
push dword [ebp + 0xc]
push 0x10048ce8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x18
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10116bbd
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10116bce
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
test edi, edi
je 0x10116bdc
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
test ebx, ebx
je 0x10116bea
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8