Function at 0x446d73
Capabilities:
Create directory
Move file

Disassembly:
push ebp
lea ebp, [esp - 0xda8]
sub esp, 0xe28
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0xda4], eax
push esi
mov esi, dword [ebp + 0xdb0]
push 0x21
push str.TWRDWrite_entry_order
push str.QWRDOrder_write_
push dword [esi + 0xc]
call dword [sym.imp.PPLIB32W.DLL__PMessageBox_16]
cmp eax, 1
je 0x446db9
mov eax, 0x4c7
jmp 0x447048
push ebx
push edi
lea eax, [esi + 0x584]
push eax
lea eax, [ebp + 0x444]
push eax
call dword [sym.imp.PPLIB32W.DLL__GetDriveName_8]
mov edi, dword [sym.imp.PPLIB32W.DLL__CatPath_12]
push str.PPXTMP
lea eax, [ebp + 0x444]
push eax
lea eax, [ebp + 0x8f4]
push eax
call edi
mov ebx, dword [sym.imp.PPLIB32W.DLL__GetUniqueEntryName_4]
lea eax, [ebp + 0x8f4]
push eax
call ebx
push 0
lea eax, [ebp + 0x8f4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x446e56
push str.PPXTMP
lea eax, [esi + 0x584]
push eax
lea eax, [ebp + 0x8f4]
push eax
call edi
lea eax, [ebp + 0x8f4]
push eax
call ebx
push 0
lea eax, [ebp + 0x8f4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x446e56
push str.TWRDWrite_entry_order
mov edx, 0x1fffffff
mov ecx, esi
call fcn.00427caa
push 5
pop eax
jmp 0x447046
push 0x3feb
push 8
xor ebx, ebx
push ebx
call dword [sym.imp.PPLIB32W.DLL__PPxCommonCommand_12]
lea ecx, [ebp - 0x80]
call fcn.00425cba
mov eax, dword [esi + 0x1d40]
mov ecx, dword [esi + 0x1d34]
mov dword [esi + 0x84], ebx
mov edx, dword [eax]
imul edx, edx, 0x278
test byte [edx + ecx + 0x24], 4
mov dword [ebp - 0x74], ebx
jne 0x446ea2
mov eax, dword [eax + 4]
imul eax, eax, 0x278
test byte [eax + ecx + 0x24], 4
je 0x446ea9
mov dword [ebp - 0x74], 2
mov eax, dword [ebp - 0x74]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x70], eax
jmp 0x446f4d
mov ecx, dword [ebp - 0x70]
mov eax, dword [esi + 0x1d40]
lea eax, [eax + ecx*4]
mov edx, dword [eax]
mov ecx, dword [esi + 0x1d34]
imul edx, edx, 0x278
cmp byte [edx + ecx + 0xe], 3
jbe 0x446f47
inc dword [ebp - 0x78]
mov eax, dword [eax]
imul eax, eax, 0x278
lea eax, [eax + ecx + 0x50]
push eax
lea eax, [esi + 0x584]
push eax
lea eax, [ebp + 0x444]
push eax
call edi
mov eax, dword [esi + 0x1d40]
mov ecx, dword [ebp - 0x70]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 0x1d34]
imul eax, eax, 0x278
lea eax, [eax + ecx + 0x50]
push eax
lea eax, [ebp + 0x8f4]
push eax
lea eax, [ebp - 0x6c]
push eax
call edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x444]
push eax
call ebx
lea eax, [ebp + 0x444]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.00428983
test eax, eax
jne 0x446f59
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp eax, dword [esi + 0x1d54]
jl 0x446eba
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x70], eax
jmp 0x446ff4
mov ecx, dword [ebp - 0x70]
mov eax, dword [esi + 0x1d40]
lea eax, [eax + ecx*4]
mov edx, dword [eax]
mov ecx, dword [esi + 0x1d34]
imul edx, edx, 0x278
cmp byte [edx + ecx + 0xe], 3
jbe 0x446fee
inc dword [ebp - 0x78]
mov eax, dword [eax]
imul eax, eax, 0x278
lea eax, [eax + ecx + 0x50]
push eax
lea eax, [ebp + 0x8f4]
push eax
lea eax, [ebp + 0x444]
push eax
call edi
mov eax, dword [esi + 0x1d40]
mov ecx, dword [ebp - 0x70]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 0x1d34]
imul eax, eax, 0x278
lea eax, [eax + ecx + 0x50]
push eax
lea eax, [esi + 0x584]
push eax
lea eax, [ebp - 0x6c]
push eax
call edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x444]
push eax
call ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.00428983
test eax, eax
jne 0x447000
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp eax, dword [esi + 0x1d54]
jl 0x446f64
lea eax, [ebp + 0x8f4]
push eax
call dword [sym.imp.PPLIB32W.DLL__RemoveDirectoryL_4]
test eax, eax
jne 0x447022
push str.EDTDTemporary_directory_delete_faulture
mov edx, 0x1fffffff
mov ecx, esi
call fcn.00427caa
push 8
push esi
call fcn.00418778
xor edi, edi
push edi
lea edx, [ebp - 0x80]
mov ecx, esi
call fcn.0042892c
push 0x3fec
push edi
push edi
call dword [sym.imp.PPLIB32W.DLL__PPxCommonCommand_12]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xda4]
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0xda8
leave
ret 4