Function at 0x5c2044
Capabilities:
Move file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x19
push 0
push 0
dec ecx
jne 0x5c204c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c298a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.00454428
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00409adc
lea eax, [ebp - 0x28]
mov edx, 0x5c29a0
call fcn.00404198
mov eax, dword [ebp - 0x28]
call fcn.004097a4
test al, al
je 0x5c20db
lea edx, [ebp - 0x34]
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.00454428
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00409adc
lea eax, [ebp - 0x30]
mov edx, 0x5c29a0
call fcn.00404198
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004568c0
xor ecx, ecx
mov edx, 0x5c29b4
mov eax, dword [ebp - 8]
call fcn.00456a04
test al, al
jne 0x5c2173
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
xor edx, edx
call fcn.00413a78
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5c2158
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5c29ec
call fcn.00413a78
jmp 0x5c2173
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5c2a24
call fcn.00413a78
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00456ed8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5c257f
inc esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 8]
call fcn.00457068
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x14]
call fcn.00408f80
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2a80
call fcn.0040447c
test eax, eax
jle 0x5c2575
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.0059743c
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jg 0x5c2250
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
cmp dword [ebp - 0x44], 0
je 0x5c2250
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
mov eax, dword [ebp - 0x48]
mov edx, 0x5c2a90
call fcn.004042a0
je 0x5c2250
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2a9c
call fcn.0040447c
test eax, eax
jg 0x5c2250
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2ab8
call fcn.0040447c
test eax, eax
jg 0x5c2250
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2ad8
call fcn.0040447c
test eax, eax
jle 0x5c2575
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2af0
call fcn.0040447c
test eax, eax
jne 0x5c2575
mov byte [ebp - 0x15], 0
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2b00
call fcn.0040447c
test eax, eax
jle 0x5c228f
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2b18
call fcn.0040447c
test eax, eax
jle 0x5c228f
mov byte [ebp - 0x15], 1
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2b00
call fcn.0040447c
test eax, eax
jle 0x5c22cd
push 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2b00
mov eax, dword [0x65a238]
call fcn.0050af8c
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x14]
call fcn.00403fa8
cmp dword [ebp - 0x14], 0
jne 0x5c22cd
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xccc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5c2312
inc eax
mov dword [ebp - 0x24], eax
xor ebx, ebx
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xccc]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jle 0x5c230c
mov byte [ebp - 0x15], 1
inc ebx
dec dword [ebp - 0x24]
jne 0x5c22e6
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
call fcn.00409c00
push 0
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 0x5c2b2c
mov eax, dword [0x65a238]
call fcn.0050afe0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x20]
call fcn.00403fa8
push 0
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 0x5c2b38
mov eax, dword [0x65a238]
call fcn.0050afe0
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x20]
call fcn.00403fa8
push 0
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 0x5c2b44
mov eax, dword [0x65a238]
call fcn.0050afe0
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x20]
call fcn.00403fa8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xccc]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
je 0x5c239e
mov byte [ebp - 0x15], 1
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x14]
call fcn.00408fbc
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00409c00
mov edx, dword [ebp - 0x60]
mov eax, dword [0x644f70]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 0x208]
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
jle 0x5c23d6
mov byte [ebp - 0x15], 1
cmp byte [ebp - 0x15], 0
jne 0x5c2575
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5c2413
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2b50
call fcn.004041dc
mov edx, dword [ebp - 0x68]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x430]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
jne 0x5c2450
lea eax, [ebp - 0x6c]
mov ecx, 0x5c2b68
mov edx, dword [ebp - 0x14]
call fcn.004041dc
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x430]
call fcn.00413a78
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jne 0x5c2575
mov eax, dword [0x6450fc]
mov eax, dword [eax]
cmp byte [eax + 0x311], 0
jne 0x5c2492
mov eax, dword [0x6450fc]
mov eax, dword [eax]
cmp byte [eax + 0x312], 0
je 0x5c253c
push 0x1024
lea eax, [ebp - 0x74]
mov ecx, 0x5c2b7c
mov edx, dword [ebp - 0x14]
call fcn.004041dc
mov eax, dword [ebp - 0x74]
call fcn.00404354
mov edx, eax
mov ecx, 0x5c2b94
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.004540b8
cmp eax, 6
jne 0x5c24fd
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.00456d88
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5c2ba4
call fcn.00413a78
jmp 0x5c2575
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.00413a78
lea edx, [ebp - 0x80]
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.00454428
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00409adc
lea eax, [ebp - 0x7c]
mov edx, 0x5c29a0
call fcn.00404198
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x5c2575
push 0x5c2bbc
push dword [ebp - 0x14]
push 0x5c2bd0
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00404250
mov edx, dword [ebp - 0x84]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
inc dword [ebp - 0x10]
dec esi
jne 0x5c2199
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.004568c0
mov cl, 1
mov edx, 0x5c29b4
mov eax, dword [ebp - 8]
call fcn.00456a04
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00456ed8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5c274a
inc esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0x88]
mov eax, dword [ebp - 8]
call fcn.00457068
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x14]
call fcn.00408f80
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2a80
call fcn.0040447c
test eax, eax
jle 0x5c2740
lea edx, [ebp - 0x90]
xor eax, eax
call fcn.0059743c
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jg 0x5c266b
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
cmp dword [ebp - 0x94], 0
je 0x5c266b
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
mov eax, dword [ebp - 0x98]
mov edx, 0x5c2a90
call fcn.004042a0
jne 0x5c2740
mov byte [ebp - 0x15], 0
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x300]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jle 0x5c268b
mov byte [ebp - 0x15], 1
inc ebx
cmp ebx, 0x259
jne 0x5c2671
cmp byte [ebp - 0x15], 0
jne 0x5c2740
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5c26f2
lea eax, [ebp - 0x9c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2c00
call fcn.004041dc
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5c2ba4
call fcn.00413a78
lea eax, [ebp - 0xa0]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2c18
call fcn.004041dc
mov edx, dword [ebp - 0xa0]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
lea ecx, [ebp - 0xa4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 8]
call fcn.00456d88
inc dword [ebp - 0x10]
dec esi
jne 0x5c25c9
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004568c0
mov cl, 1
mov edx, 0x5c2c34
mov eax, dword [ebp - 8]
call fcn.00456a04
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00456ed8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5c294c
inc esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 8]
call fcn.00457068
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0x14]
call fcn.00408f80
mov edx, dword [ebp - 0x14]
mov eax, 0x5c2a80
call fcn.0040447c
test eax, eax
jle 0x5c2942
lea edx, [ebp - 0xb0]
xor eax, eax
call fcn.0059743c
mov eax, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jg 0x5c2836
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
cmp dword [ebp - 0xb4], 0
je 0x5c2836
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
call fcn.00409adc
mov eax, dword [ebp - 0xb8]
mov edx, 0x5c2a90
call fcn.004042a0
jne 0x5c2942
mov byte [ebp - 0x15], 0
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4 + 0x300]
mov edx, dword [ebp - 0x14]
call fcn.0040447c
test eax, eax
jle 0x5c2856
mov byte [ebp - 0x15], 1
inc ebx
cmp ebx, 0x259
jne 0x5c283c
cmp byte [ebp - 0x15], 0
jne 0x5c2942
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5c28bd
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2c74
call fcn.004041dc
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5c2ba4
call fcn.00413a78
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5c2c18
call fcn.004041dc
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
lea ecx, [ebp - 0xc4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 8]
call fcn.00456d88
mov eax, dword [ebp - 0x14]
call fcn.0059f86c
push 4
lea eax, [ebp - 0xc8]
mov ecx, 0x5c2c8c
mov edx, dword [ebp - 0x14]
call fcn.004041dc
mov eax, dword [ebp - 0xc8]
call fcn.00404354
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404354
push eax
call sub.kernel32.dll_MoveFileExA
inc dword [ebp - 0x10]
dec esi
jne 0x5c2794
mov eax, dword [ebp - 8]
call fcn.00403170
mov eax, dword [ebp - 0xc]
call fcn.00403170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c2991
lea eax, [ebp - 0xc8]
mov edx, 0x29
call fcn.00403f34
lea eax, [ebp - 0x20]
call fcn.00403f10
lea eax, [ebp - 0x14]
call fcn.00403f10
ret