Function at 0x4d1f50
Capabilities:
Access peb ldr_data
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x604220
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x394]
lea edi, [ecx + 0x394]
cmp esi, edi
je 0x4d225f
test esi, esi
je 0x4d225f
test edx, edx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xf0]
mov dword [esp + 0x10], eax
je 0x4d1fb4
push 0
push edx
jmp 0x4d2258
lea edx, [eax - 0xc8]
cmp edx, 0xcc
ja case.0x4d1fcd.201
movzx edx, byte [edx + 0x4d2284]
jmp dword [edx*4 + 0x4d2274]
lea ecx, [esp + 0x10]
call fcn.00403890
push str.Last_Modified
add ebx, 0xc4
mov dword [esp + 0x24], 0
call fcn.00478c60
test eax, eax
je 0x4d2005
mov ebx, dword [eax + 4]
lea eax, [esp + 0x10]
call fcn.004173d0
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
jle 0x4d2020
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
push ecx
push eax
add edx, 0x388
push edx
jmp 0x4d205c
mov eax, dword [esi + 0x24]
test eax, eax
jbe 0x4d2044
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push edx
mov edx, dword [ebp + 8]
add edx, 0x388
call fcn.004cfc20
jmp 0x4d2064
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x194]
push eax
mov eax, dword [ebp + 8]
push edx
add eax, 0x388
push eax
mov ecx, dword [esi + 0xc]
call fcn.004cf810
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
mov eax, esi
call fcn.004ce8f0
test eax, eax
mov ecx, dword [esi + 8]
push 0xc8
push 0
je 0x4d208f
mov edx, dword [ecx]
mov eax, dword [esi + 0xc]
mov edx, dword [edx + 0x34]
push eax
call edx
jmp 0x4d20b4
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 0x194]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
push edx
mov edx, dword [esi + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x194]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.004c5e50
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
call fcn.004d17f0
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov dword [eax + 0x3b0], 0
call fcn.00403870
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x10]
cmp dword [edx - 0xc], 0
jg 0x4d225f
cmp dword [esi + 0x24], 0
ja 0x4d225f
mov eax, dword [esi + 0xc]
push eax
add ecx, 0x388
push ecx
call fcn.004d0050
mov eax, dword [ebx + 0x194]
sub eax, 0x10
call fcn.0040a210
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
push ebx
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x14]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4d214e
xor eax, eax
jmp 0x4d215b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4d215b
or eax, 0xffffffff
mov ecx, dword [edi]
mov ecx, dword [ecx]
mov dword [edi], ecx
mov dword [ecx + 4], edi
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
mov edx, eax
neg edx
sbb edx, edx
not edx
and edx, ebx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff38
add ecx, 0xc8
push ecx
mov ecx, dword [esi + 8]
push eax
mov eax, dword [edi + 0x30]
push edx
mov edx, dword [esi + 0xc]
push edx
call eax
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.004c5e50
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
call fcn.004d17f0
lea ecx, [esp + 0x10]
mov dword [edi + 0x3b0], 0
call fcn.00403870
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
mov eax, esi
call fcn.004ce8f0
test eax, eax
je 0x4d2200
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
push eax
mov eax, dword [esi + 0xc]
push 0
push eax
call edx
jmp 0x4d2224
mov eax, dword [ebx + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
push eax
mov eax, dword [esi + 0xc]
push 0
push 0
push eax
call edx
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
call fcn.004d17f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x3b0], 0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
push 0xffffffffffffffff
mov edi, ecx
call fcn.004d1bb0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8