Function at 0x4a3d90
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7c]
sub esp, 0x7c
push 0xffffffffffffffff
push 0x570f48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5a800c]
xor eax, ebp
mov dword [ebp + 0x78], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0xe4], 0
je 0x4a3dd5
xor al, al
jmp 0x4a4047
lea esi, [ebx + 0x40]
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0041aa00
test al, al
je 0x4a3dce
lea ecx, [ebx + 0x58]
call fcn.0041aa00
test al, al
je 0x4a3dce
mov ecx, esi
call fcn.004023c0
mov esi, eax
call fcn.004a4930
push ecx
push esi
mov ecx, eax
call fcn.004a4a30
test al, al
je 0x4a3dce
lea ecx, [ebx + 0x58]
call fcn.004023c0
mov esi, eax
call fcn.004a4930
push ecx
push esi
mov ecx, eax
call fcn.004a4a30
test al, al
je 0x4a3dce
lea edi, [ebx + 0x70]
push str..tmp
mov edx, edi
lea ecx, [ebp + 0x48]
call fcn.0040fde0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp]
call fcn.00402410
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x10]
call fcn.004023c0
push eax
lea ecx, [ebp + 0x48]
call fcn.004023c0
push eax
lea ecx, [ebx + 0x58]
call fcn.004023c0
push eax
lea eax, [ebp]
push str._m___s___s___s___h__s
push eax
call fcn.00419340
mov eax, dword [ebx + 0xf0]
lea edx, [ebp]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor bl, bl
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esi
push eax
push esi
mov dword [ebp - 0x10], esi
call fcn.00420900
add esp, 0x1c
test al, al
je 0x4a3ec7
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
or edx, 0xffffffff
mov ecx, esi
mov bl, 1
call fcn.00420de0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xe8], esi
test bl, bl
je 0x4a402a
cmp esi, 0x2710
sete bl
jne 0x4a402a
mov ecx, edi
mov dword [eax + 0xe8], 0
call fcn.0041aa00
test al, al
je 0x4a3f0d
push edi
lea eax, [ebp + 0x48]
push eax
call fcn.004a11f0
mov bl, al
jmp 0x4a402a
push 0xb
mov ecx, edi
call fcn.004023c0
push eax
lea ecx, [ebp + 0x48]
call fcn.004023c0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
test eax, eax
jne 0x4a3ff9
lea ecx, [ebp + 0x18]
xor bl, bl
call fcn.00402410
mov byte [ebp - 4], 2
mov edx, ecx
lea ecx, [ebp + 0x48]
call fcn.0042cbb0
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp + 0x30]
call fcn.00402410
mov byte [ebp - 4], 3
mov edx, ecx
mov ecx, edi
call fcn.0042cbb0
test al, al
jne 0x4a3f72
test bl, bl
je 0x4a3f8c
push 0xb
lea ecx, [ebp + 0x30]
call fcn.004023c0
push eax
lea ecx, [ebp + 0x18]
call fcn.004023c0
push eax
call esi
test eax, eax
jne 0x4a3fe1
mov ecx, edi
call fcn.0042c590
cmp eax, 0xffffffff
je 0x4a4010
push edi
lea ecx, [ebp + 0x60]
call fcn.00402430
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x60]
call fcn.0042c970
test al, al
je 0x4a4004
lea edx, [ebp + 0x60]
mov ecx, edi
call fcn.0042c630
test al, al
je 0x4a4004
mov edx, edi
lea ecx, [ebp + 0x48]
call fcn.0042c630
lea ecx, [ebp + 0x60]
test al, al
je 0x4a3ffd
call fcn.0042c740
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.00402400
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.00402400
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00402400
mov bl, 1
jmp 0x4a402a
mov edx, edi
call fcn.0042c630
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.00402400
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.00402400
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00402400
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00402400
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x48]
call fcn.00402400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x78]
xor ecx, ebp
call fcn.0055929f
lea esp, [ebp + 0x7c]
pop ebp
ret