Function at 0x449bb0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov eax, 0x41dc
mov ebp, esp
push edi
push esi
push ebx
call fcn.005d4d10
sub esp, eax
mov edi, ecx
lea ecx, [ebp - 0x4018]
mov dword [esp], 0x8578a8
call fcn.0054fd92
sub esp, 4
cmp dword [edi + 4], 0
mov eax, dword [ebp - 0x4018]
mov dword [0x8554b4], 1
mov dword [ebp - 0x41c0], eax
jle 0x44a3f0
xor ebx, ebx
lea esi, [eax + 8]
jmp 0x449c0a
mov eax, dword [edi + 4]
add ebx, 1
cmp eax, ebx
jle 0x449c6a
mov dword [esp], ebx
mov ecx, 0x8578a8
call fcn.0054c04e
sub esp, 4
test eax, eax
je 0x449c00
lea ecx, [ebp - 0x2018]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0050c8cc
mov eax, dword [ebp - 0x2018]
sub esp, 8
mov dword [esp + 4], str.indexesSDI
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIA
lea ecx, [ebp - 0x2018]
sub esp, 8
mov dword [ebp - 0x41bc], eax
call fcn.0050c25c
mov eax, dword [ebp - 0x41bc]
test eax, eax
je 0x449c00
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x449d17
lea eax, [ebp - 0x2018]
lea edx, [ebp - 0x2006]
xor esi, esi
mov dword [esp + 8], 0x8431c0
mov dword [esp + 4], str._c_del__ws_.bin
mov dword [esp], eax
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x2010], edx
mov dword [ebp - 0x200c], pe_nt_image_headers32
mov byte [ebp - 0x2008], 0
mov dword [ebp - 0x2018], 0x75d6e8
mov word [ebp - 0x2006], si
call fcn.00403910
mov eax, dword [ebp - 0x2010]
mov dword [esp + 0xc], 1
mov ecx, 0x8554b8
mov dword [esp + 8], 0
mov dword [esp], 0x7316a4
mov dword [esp + 4], eax
call fcn.00440110
mov eax, dword [ebp - 0x2014]
sub esp, 0x10
mov dword [ebp - method.nInst.virtual_0], vtable.nInst.0
test eax, eax
je 0x449d14
mov dword [esp], eax
call fcn.006eb310
mov ebx, dword [edi + 4]
test ebx, ebx
jle 0x449e22
xor ebx, ebx
jmp 0x449d2f
add ebx, 1
cmp dword [edi + 4], ebx
jle 0x449e22
mov dword [esp], ebx
mov ecx, 0x8578a8
call fcn.0054c04e
sub esp, 4
test eax, eax
je 0x449d23
mov eax, dword [ebp - 0x41c0]
lea ecx, [ebp - 0x4198]
mov dword [esp + 4], ebx
add eax, 8
mov dword [esp], eax
call fcn.0050c8cc
lea eax, [ebp - 0x41a8]
mov esi, dword [ebp - 0x4194]
sub esp, 8
mov dword [ebp - 0x41b0], eax
mov eax, dword [ebp - 0x4198]
mov edx, eax
mov dword [ebp - 0x41bc], eax
add edx, esi
je 0x449d95
test eax, eax
jne 0x449d95
mov dword [esp], 0x7314dc
call fcn.006dfd70
cmp esi, 0xf
mov dword [ebp - 0x412c], esi
ja 0x449e80
cmp esi, 1
je 0x449f30
test esi, esi
lea eax, [ebp - 0x41a8]
jne 0x449eb1
mov dword [ebp - 0x41ac], esi
mov byte [eax + esi], 0
cmp dword [0x70ec64], 1
je 0x449ee0
mov eax, dword [ebp - 0x41b0]
mov dword [esp + 4], 0x7316d4
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIA
sub esp, 8
test eax, eax
je 0x449f50
mov eax, dword [ebp - 0x41b0]
lea edx, [ebp - 0x41a8]
cmp eax, edx
je 0x449e0b
mov dword [esp], eax
call fcn.006eb330
lea ecx, [ebp - 0x4198]
add ebx, 1
call fcn.0050c25c
cmp dword [edi + 4], ebx
jg 0x449d2f
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov ecx, 0x8554b8
mov dword [esp + 4], str.__c_rd__s__q_update
mov dword [esp], 0x7316a4
call fcn.00440110
mov ebx, dword [ebp - 0x41c0]
sub esp, 0x10
test ebx, ebx
je 0x449e70
mov eax, 0xffffffff
mov edi, dword [ebp - 0x41c0]
lock xadd dword [edi], eax
cmp eax, 1
je 0x44a39c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x412c]
lea ecx, [ebp - 0x41b0]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.006bef90
mov edx, dword [ebp - 0x412c]
sub esp, 8
mov dword [ebp - 0x41b0], eax
mov dword [ebp - 0x41a8], edx
mov edx, dword [ebp - 0x41bc]
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0x412c]
mov eax, dword [ebp - 0x41b0]
jmp 0x449dbb
mov eax, dword [ebp - 0x4198]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_strchr
lea esi, [eax + 1]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x41ac]
lea ecx, [ebp - 0x41b0]
mov dword [esp + 8], esi
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.006bcb90
sub esp, 0x10
jmp 0x449dd2
mov eax, dword [ebp - 0x41bc]
movzx eax, byte [eax]
mov byte [ebp - 0x41a8], al
lea eax, [ebp - 0x41a8]
jmp 0x449dbb
mov eax, dword [ebp - 0x41b0]
mov dword [esp + 4], str..bat
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIA
sub esp, 8
test eax, eax
jne 0x449df3
mov eax, dword [ebp - 0x4198]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax]
mov dword [esp + 4], str._s_S
mov dword [esp + 8], eax
lea eax, [ebp - 0x4018]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x41b0]
mov dword [esp + 4], 0x731516
mov dword [esp + 8], eax
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call esi
lea eax, [ebp - 0x2018]
mov dword [esp + 8], 0x8431c0
mov dword [esp + 4], 0x7315c6
mov dword [esp], eax
call fcn.00403e50
lea eax, [ebp - 0x2018]
mov dword [esp + 8], 0x83d1c0
mov dword [esp + 4], str.drivers
mov dword [esp], eax
call fcn.00403e50
lea eax, [ebp - 0x2018]
mov dword [esp + 8], 0x8451c0
mov dword [esp + 4], str.toolsSDI
mov dword [esp], eax
call fcn.00403e50
mov eax, dword [ebp - 0x41b0]
mov dword [esp + 4], 0x731541
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIA
sub esp, 8
test eax, eax
je 0x44a044
lea eax, [ebp - 0x2008]
mov ecx, edi
mov dword [esp], eax
call fcn.004459e0
sub esp, 4
lea esi, [ebp - 0x2018]
jmp 0x44a063
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
lea esi, [eax + 2]
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
test eax, eax
jne 0x44a050
lea eax, [ebp - 0x4018]
mov dword [esp + 4], 0x73170a
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x44a09c
mov ecx, 0x5f
mov word [esi], cx
lea eax, [ebp - 0x411a]
lea ecx, [ebp - 0x412c]
xor edx, edx
mov dword [ebp - 0x4128], 0
mov dword [ebp - 0x4120], pe_nt_image_headers32
mov dword [ebp - 0x4124], eax
lea eax, [ebp - 0x2018]
mov byte [ebp - 0x411c], 0
mov dword [ebp - 0x412c], 0x75d6e8
mov word [ebp - 0x411a], dx
mov dword [esp], eax
call fcn.00403cc0
sub esp, 4
mov esi, dword [ebp - 0x4124]
jmp 0x44a108
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_wcschr
lea esi, [eax + 2]
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
test eax, eax
jne 0x44a0f5
cmp word [esi - 2], 0x5c
je 0x44a383
mov eax, dword [ebp - 0x4128]
mov dword [ebp - method.nInst.virtual_0], vtable.nInst.0
test eax, eax
je 0x44a143
mov dword [esp], eax
call fcn.006eb310
mov dword [esp + 4], 0x1000
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__wgetcwd]
test eax, eax
je 0x44a360
mov dword [esp], eax
mov ecx, 0x8554b8
call fcn.0043fcd0
sub esp, 4
mov dword [ebp - 0x41c4], eax
lea eax, [ebp - 0x4018]
mov ecx, 0x8554b8
mov dword [esp], eax
call fcn.0043fcd0
sub esp, 4
mov esi, eax
cmp eax, 0xffffffff
cmove esi, dword [ebp - 0x41c4]
lea edx, [ebp - 0x4018]
mov dword [esp + 4], str.Src:__d__S_n
mov dword [esp], 0x835180
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
call fcn.0041eed0
lea edx, [ebp - 0x2018]
mov ecx, 0x8554b8
mov dword [esp], edx
call fcn.0043fcd0
lea ecx, [ebp - 0x2018]
sub esp, 4
mov dword [ebp - 0x41bc], eax
mov dword [esp + 4], 0x731740
mov dword [esp], ecx
call sub.msvcrt.dll_wcscspn
mov edx, dword [ebp - 0x41bc]
cmp edx, 0xffffffff
jne 0x44a208
test eax, eax
mov eax, dword [ebp - 0x41c4]
cmove eax, edx
mov dword [ebp - 0x41bc], eax
lea eax, [ebp - 0x2018]
mov dword [esp + 4], str.Dst:__d__S_n
mov dword [esp], 0x835180
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x41bc]
mov dword [esp + 8], eax
call fcn.0041eed0
cmp esi, dword [ebp - 0x41bc]
lea eax, [ebp - 0x2018]
mov dword [esp + 8], eax
je 0x44a300
mov dword [esp + 4], str.Copy_new_file:__S_n
mov dword [esp], 0x835180
call fcn.0041eed0
lea eax, [ebp - 0x2018]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x4018]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
sub esp, 0x18
test eax, eax
jne 0x44a2c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.CopyFileExW__
mov dword [esp], eax
mov ecx, 0x835180
call fcn.0041f1f0
sub esp, 8
jmp 0x449df3
lea eax, [ebp - 0x2018]
mov ecx, 0x8554b8
mov dword [esp], eax
call fcn.0043f2f0
sub esp, 4
test al, al
je 0x449df3
lea eax, [ebp - 0x4018]
mov ecx, 0x8554b8
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileW
sub esp, 4
jmp 0x449df3
mov dword [esp + 4], str.Move_new_file:__S_n
mov dword [esp], 0x835180
call fcn.0041eed0
lea eax, [ebp - 0x2018]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [ebp - 0x4018]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
jne 0x449df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.MoveFileEx__
mov dword [esp], eax
mov ecx, 0x835180
call fcn.0041f1f0
jmp 0x44a2b5
mov dword [esp + 4], str._wgetcwd_error
mov dword [esp], 0x835180
call fcn.0041eed0
mov dword [ebp - 0x41c4], 0xffffffff
jmp 0x44a176
xor eax, eax
mov word [esi - 2], ax
mov eax, dword [ebp - 0x4124]
mov dword [esp], eax
call fcn.0043ff20
jmp 0x44a127
mov edi, dword [ebp - 0x41c0]
mov ecx, edi
call fcn.005524a0
mov dword [esp], edi
call fcn.006eb330
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jne 0x449c72
jmp 0x449e22