Function at 0x3000c0e3
Capabilities:
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [0x30002838]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
push 0x206
mov dword [ebp - 0xa38], eax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0xa50], edi
mov word [ebp - 0x20c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp edi, ebx
je 0x3000c159
push edi
call dword [sym.imp.MSO.dll_Ordinal_295]
mov dword [ebp - 0xa58], eax
jmp 0x3000c15f
mov dword [ebp - 0xa58], ebx
xor eax, eax
cmp dword [ebp + 0x20], 4
mov dword [ebp - 0xa3c], ebx
sete al
mov dword [ebp - 0xa4c], ebx
mov edi, eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xa54], edi
neg edi
sbb edi, edi
and edi, 3
and al, 0xf0
inc edi
cmp al, 0x40
jne 0x3000c345
mov ecx, dword [ebp - 0xa38]
lea eax, [ebp - 0xa40]
push eax
push ebx
lea eax, [esi + 0x50]
push eax
add ecx, 0x30
call fcn.3000abf0
mov ecx, dword [ebp - 0xa40]
cmp ecx, esi
je 0x3000c33e
lea eax, [ebp - 0xa34]
push eax
push 0x104
lea eax, [ebp - 0xa2c]
push eax
call fcn.300067c4
lea eax, [ebp - 0xa44]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
mov ecx, esi
call fcn.300067c4
mov eax, dword [ebp - 0xa34]
cmp word [eax], bx
je 0x3000c345
mov ecx, dword [ebp - 0xa44]
cmp word [ecx], bx
je 0x3000c345
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x3000c345
cmp dword [esi + 8], ebx
jne 0x3000c22f
push 0x10
push 0x20
push 4
lea eax, [esi + 4]
push eax
call fcn.30010b87
mov ecx, dword [ebp - 0xa40]
cmp dword [ecx + 8], ebx
mov dword [ebp - 0xa34], ebx
jbe 0x3000c289
lea eax, [ebp - 0xa30]
push eax
push dword [ebp - 0xa34]
call fcn.300079f2
mov eax, dword [ebp - 0xa30]
push ebx
push 0x30006758
mov dword [eax], esi
push 1
lea eax, [ebp - 0xa30]
push eax
lea eax, [esi + 4]
push eax
call fcn.30010bd4
inc dword [ebp - 0xa34]
mov ecx, dword [ebp - 0xa40]
mov eax, dword [ebp - 0xa34]
cmp eax, dword [ecx + 8]
jb 0x3000c240
push 1
push ecx
mov ecx, dword [ebp - 0xa38]
call fcn.30009b20
mov eax, dword [ebp - 0xa40]
mov eax, dword [eax]
cmp dword [eax + 8], ebx
mov dword [ebp - 0xa34], eax
jbe 0x3000c30b
mov ecx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.300079f2
mov eax, dword [ebp - 0xa30]
cmp eax, dword [ebp - 0xa40]
je 0x3000c2d9
mov eax, dword [ebp - 0xa34]
inc ebx
cmp ebx, dword [eax + 8]
jb 0x3000c2aa
jmp 0x3000c30b
mov ecx, dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
push eax
push ebx
call fcn.300078c0
mov ecx, dword [ebp - 0xa30]
add ecx, 4
call fcn.300076c9
push dword [ebp - 0xa30]
mov ecx, dword [ebp - 0xa38]
call fcn.3000af00
mov ecx, dword [ebp - 0xa38]
push esi
call fcn.3000b44d
push dword [ebp - 0xa44]
lea eax, [esi + 0x1c]
push eax
call fcn.30006ef4
and dword [esi + 0x68], 0xfffffff9
mov ecx, dword [ebp - 0xa40]
mov ecx, dword [ecx + 0x68]
mov eax, dword [esi + 0x68]
and ecx, 6
or ecx, eax
mov dword [esi + 0x68], ecx
and dword [esi + 0x18], 0xffffff0f
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6877]
push 0x208
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa48]
call ebx
test word [esi + 0x66], 0x280
mov dword [ebp - 0xa30], eax
jne 0x3000c379
add dword [ebp - 0xa30], 2
mov word [eax], 0x2f
lea eax, [ebp - 0xa48]
push eax
mov ecx, esi
call fcn.3000684e
lea ecx, [ebp - 0x20c]
sub ecx, dword [ebp - 0xa30]
sar ecx, 1
cmp ecx, eax
ja 0x3000c3a3
mov eax, 0x80004005
jmp 0x3000c80f
add eax, eax
push eax
push dword [ebp - 0xa48]
mov dword [ebp - 0xa44], eax
push dword [ebp - 0xa30]
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebp - 0xa44]
mov ecx, dword [ebp - 0xa30]
and word [eax + ecx], 0
add esp, 0xc
mov ecx, esi
call fcn.30006c37
test eax, eax
je 0x3000c3e0
xor ecx, ecx
jmp 0x3000c3e6
mov ecx, dword [ebp - 0xa58]
test byte [esi + 0x1c], 0x10
jne 0x3000c68b
cmp dword [ebp - 0xa54], 0
je 0x3000c417
cmp byte [esi + 0x19], 6
jne 0x3000c410
push dword [ebp - 0xa38]
mov ecx, esi
call fcn.3000aeba
mov byte [esi + 0x19], 0
xor eax, eax
jmp 0x3000c80f
mov eax, dword [esi + 0x18]
mov edx, eax
and edx, 0xf
cmp dl, 5
jne 0x3000c42e
and eax, 0xfffffff0
mov dword [esi + 0x18], eax
mov byte [esi + 0x19], 2
xor eax, eax
cmp dword [esi + 0x70], 0xffffffff
sete al
mov edi, eax
mov eax, dword [esi]
test dword [eax + 0x64], 0x820000
jne 0x3000c45e
test ecx, ecx
jbe 0x3000c45e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa50]
call ebx
jmp 0x3000c464
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x20c]
mov ecx, eax
sub ecx, edx
sar ecx, 1
mov edx, 0x104
sub edx, ecx
cmp dword [esi + 0x4c], edx
jae 0x3000c399
lea ecx, [ebp - 4]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push dword [esi + 0x78]
call ebx
mov eax, dword [esi + 0x60]
cmp eax, dword [esi + 0x70]
push 0x11
pop ebx
jae 0x3000c516
mov eax, dword [esi + 0x18]
test eax, eax
je 0x3000c4cb
cmp eax, 3
je 0x3000c4cb
and al, 0xf
cmp al, 1
jne 0x3000c525
test edi, edi
setne al
mov ecx, esi
lea eax, [eax + eax + 1]
mov byte [esi + 0x19], al
call fcn.3000693c
cmp dword [ebp + 0x20], ebx
mov byte [esi + 0x1a], al
jne 0x3000c525
jmp 0x3000c399
test edi, edi
je 0x3000c4d5
mov byte [esi + 0x19], 3
jmp 0x3000c525
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.30006661
test eax, eax
je 0x3000c525
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.30006ef4
mov eax, dword [esi + 0x70]
mov dword [esi + 0x60], eax
lea eax, [esi + 0x38]
push eax
mov dword [ebp - 0xa3c], 1
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
and dword [esi + 0x18], 0
jmp 0x3000c525
xor eax, eax
inc eax
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa4c], eax
cmp byte [esi + 0x19], 3
jne 0x3000c5ed
mov eax, dword [esi + 0x18]
and eax, 0xf
cmp eax, 3
je 0x3000c542
test eax, eax
jne 0x3000c5ed
xor edi, edi
push edi
push 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.30003ef8
cmp eax, 1
jne 0x3000c585
or dword [esi + 0x70], 0xffffffff
cmp dword [ebp + 0x20], ebx
mov byte [esi + 0x19], 0
jne 0x3000c410
cmp dword [ebp - 0xa3c], edi
je 0x3000c399
xor eax, eax
cmp dword [ebp - 0xa4c], edi
setne al
jmp 0x3000c80f
lea eax, [ebp - 0x20c]
push eax
call fcn.3000f9b5
mov edi, eax
test edi, edi
je 0x3000c5ae
mov eax, dword [esi + 0x80]
mov dword [esi + 0x60], eax
add esi, 0x50
push esi
call fcn.30006560
jmp 0x3000c7ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x3000c5c3
or dword [esi + 0x70], 0xffffffff
mov byte [esi + 0x19], 0
jmp 0x3000c5d5
cmp eax, 2
jne 0x3000c7ff
mov eax, dword [esi + 0x80]
mov dword [esi + 0x60], eax
cmp dword [ebp + 0x20], ebx
jne 0x3000c5e5
mov edi, dword [ebp - 0xa3c]
jmp 0x3000c7ff
xor edi, edi
inc edi
jmp 0x3000c7ff
cmp dword [ebp + 0x20], ebx
jne 0x3000c60c
cmp dword [ebp - 0xa3c], 0
je 0x3000c399
xor eax, eax
cmp dword [ebp - 0xa4c], eax
jmp 0x3000c57d
mov ecx, esi
call fcn.30006bae
test eax, eax
je 0x3000c64c
cmp byte [esi + 0x19], 2
jne 0x3000c410
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.30006bee
test eax, eax
jl 0x3000c399
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.30006ef4
jmp 0x3000c40c
mov al, byte [esi + 0x19]
cmp al, 1
je 0x3000c661
cmp al, 2
je 0x3000c661
cmp dword [ebp + 0x20], 9
jne 0x3000c410
push dword [ebp + 0x20]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xa5c]
push esi
push dword [ebp - 0xa64]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.300113d3
mov edi, eax
jmp 0x3000c7ff
test word [esi + 0x66], 0x287
jne 0x3000c6e1
mov eax, dword [esi + 0x4c]
lea eax, [eax + ecx + 1]
cmp eax, 0x104
jae 0x3000c399
test ecx, ecx
lea eax, [ebp - 0x20c]
jbe 0x3000c6bd
push 0x104
push eax
push dword [ebp - 0xa50]
call ebx
lea ecx, [ebp - 4]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push dword [esi + 0x78]
call ebx
lea ecx, [ebp - 4]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push 0x300017fc
mov dword [ebp - 0xa30], eax
call ebx
mov eax, dword [esi + 0x18]
and eax, 0xffffff00
cmp eax, 0x200
jne 0x3000c710
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x3000c399
mov eax, dword [esi + 0x80]
mov dword [esi + 0x60], eax
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x3000c75f
cmp dword [ebp + 0x14], 0
jbe 0x3000c75f
lea eax, [ebp - 0xa60]
push eax
push ebx
mov ecx, esi
call fcn.300079f2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xa60]
push edi
push dword [ebp - 0xa38]
dec eax
push dword [ebp - 0xa5c]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.3000c0e3
inc ebx
cmp ebx, dword [esi + 8]
jb 0x3000c717
xor ecx, ecx
cmp dword [ebp - 0xa54], ecx
je 0x3000c7e5
mov eax, dword [esi + 0x18]
mov edx, eax
and edx, 0xffffff00
cmp edx, 0x300
jne 0x3000c820
movzx edx, byte [esi + 0x64]
movzx edi, byte [esi + 0x65]
cmp edx, edi
jbe 0x3000c820
cmp word [ebp - 0x20c], cx
je 0x3000c7a2
mov eax, dword [ebp - 0xa30]
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.3000f9b5
mov edi, eax
test edi, edi
je 0x3000c7bf
mov eax, dword [esi + 0x80]
mov dword [esi + 0x60], eax
jmp 0x3000c7e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x3000c7d7
or dword [esi + 0x70], 0xffffffff
xor edi, edi
mov byte [esi + 0x19], 0
inc edi
jmp 0x3000c7ec
cmp eax, 2
jne 0x3000c7ff
mov eax, dword [esi + 0x80]
mov dword [esi + 0x60], eax
xor edi, edi
inc edi
test edi, edi
je 0x3000c7ff
push esi
call fcn.30006fcb
test eax, eax
jne 0x3000c7ff
cmp byte [esi + 0x19], 6
je 0x3000c7ff
mov byte [esi + 0x19], al
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.30015018
leave
ret 0x1c
cmp byte [esi + 0x19], 6
jne 0x3000c7e5
test al, 0xf
jne 0x3000c7e5
push dword [ebp - 0xa38]
mov ecx, esi
call fcn.3000aeba
mov edi, eax
mov byte [esi + 0x19], 0
jmp 0x3000c7e8