Function at 0x402fae
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x744
mov al, byte [0x41fcac]
push ebx
push esi
push edi
mov byte [ebp - 0x744], al
mov ecx, 0x8b
xor eax, eax
lea edi, [ebp - 0x743]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00409c47
test eax, eax
je 0x403051
xor edi, edi
cmp dword [0x4210a8], edi
jne 0x403053
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
or dword [ebp - 4], 0xffffffff
push eax
push edi
push edi
push 7
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 4], edi
jl 0x40303e
push dword [ebp - 4]
call fcn.00411290
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x40303e
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push dword [ebp - 4]
push ebx
push 7
push dword [ebp + 0xc]
call esi
cmp eax, edi
je 0x403037
push ebx
push 7
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
push ebx
call fcn.00411340
pop ecx
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x40327d
xor edi, edi
call fcn.00409c75
test eax, eax
jne 0x403068
cmp dword [0x4210a8], edi
je 0x40327d
cmp dword [0x424ee0], edi
jne 0x40309b
mov esi, 0x1000
push esi
call fcn.00409f27
cmp eax, edi
pop ecx
mov dword [0x424ee0], eax
je 0x40324c
push 0x41c05c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x42016c], esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0xc]
call fcn.0040a040
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
pop ecx
mov ebx, 0x104
lea eax, [ebp - 0x210]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0xc]
call fcn.0040a004
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.0040a040
pop ecx
lea eax, [ebp - 0x314]
pop ecx
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.0040a004
pop ecx
lea eax, [ebp - 0x10c]
pop ecx
push eax
lea eax, [ebp - 0x314]
push eax
call esi
cmp dword [0x4210a8], 0
je 0x4031eb
mov al, byte [0x41fcac]
push 0x7f
mov byte [ebp - 0x514], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x513]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x514]
push str._echo_off_r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x514]
push str.attrib__r__s___nul_r_n
push eax
call esi
mov edi, str.erase__s___nul_r_n
lea eax, [ebp - 0x514]
push edi
push eax
call esi
lea eax, [ebp - 0x514]
push str.copy__s__s___nul_r_n
push eax
call esi
lea eax, [ebp - 0x514]
push edi
push eax
call esi
lea eax, [ebp - 0x514]
push str.echo_on_r_n
push eax
call esi
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x744]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
jmp 0x40320e
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x744]
push str._s_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [0x424ee0]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
mov ebx, eax
lea eax, [ebp - 0x744]
push eax
call edi
add ebx, eax
cmp ebx, dword [0x42016c]
jl 0x40326e
push 0x1004
push dword [0x424ee0]
call fcn.00409f6e
pop ecx
mov dword [0x424ee0], eax
test eax, eax
pop ecx
jne 0x403264
push dword [0x423660]
push 1
push 0x10
push 1
call fcn.00405290
add esp, 0x10
xor eax, eax
jmp 0x40327d
add dword [0x42016c], 0x1000
lea eax, [ebp - 0x744]
push eax
push dword [0x424ee0]
call esi
pop edi
pop esi
pop ebx
leave
ret