Function at 0x4307b0
Capabilities:
Access peb ldr_data
Move file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3a8
mov dword [esp + 8], edx
mov ebx, ecx
mov ebp, dword [esp + 0x3bc]
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x3a4], eax
lea eax, [esp + 0x2a4]
mov dword [esp + 0x298], eax
mov dword [esp + 0x29c], 0
mov dword [esp + 0x2a0], 0x80
lea eax, [esp + 0x298]
push 0x104
push eax
push ebp
push ecx
call fcn.0042f8a0
add esp, 0x10
cmp dword [ebx], 0
je 0x43084c
mov eax, dword [esp + 0x298]
lea ecx, [esp + 0x2a4]
cmp eax, ecx
je 0x430831
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0x3a4]
xor ecx, esp
call fcn.00533ace
mov eax, ebx
add esp, 0x3a8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [esp + 0x10], ebx
jmp 0x43087b
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp]
add eax, 1
cmp eax, 0xc8
je 0x430ff4
mov dword [esp], eax
lea ecx, [esp + 0x30]
mov edx, dword [esp + 8]
push 1
push ebp
call fcn.00433430
add esp, 8
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430e84
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 4]
cmp ecx, dword [0x56739c]
jne 0x4308ce
cmp eax, 0x78
je 0x430f3e
test eax, eax
je 0x430f2f
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430ebd
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 4]
cmp eax, dword [0x5673a4]
jne 0x430f2f
cmp dword [esp + 0x30], 0xd
jne 0x430f2f
mov eax, dword [esp + 0x298]
sub esp, 0x1c
movaps xmm0, xmmword [0x5385a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000080
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430e30
mov esi, eax
lea eax, [esp + 0x84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x430fcf
mov dword [esp + 4], esi
xor ecx, ecx
nop dword [eax]
test ecx, ecx
mov dword [esp + 0x14], ecx
je 0x430a00
mov dword [esp + 0xc], 0
lea edi, [esp + 0x81]
mov ebp, ecx
xor ebx, ebx
nop
push 0
push 0xa
push ebx
push ebp
call fcn.005341d0
mov ecx, eax
add ecx, eax
lea esi, [ecx + ecx*4]
mov ecx, ebp
sub ecx, esi
mov esi, 9
or cl, 0x30
mov byte [edi - 1], cl
add edi, 0xffffffff
add dword [esp + 0xc], 1
cmp esi, ebp
mov ecx, 0
sbb ecx, ebx
mov ebp, eax
mov ebx, edx
jb 0x430990
mov eax, 0xf
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
cmp dword [esp + 0xc], 0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x3bc]
mov ecx, edi
jne 0x430a25
jmp 0x430a68
mov byte [esp + 0x80], 0x30
mov eax, 0xf
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x80]
lea edi, [esp + 0x81]
sub edi, ecx
cmp edi, 0xf
jbe 0x430a50
sub esp, 0xc
mov al, byte [esp + 0x30]
mov byte [esp + 4], al
mov dword [esp + 8], ecx
mov dword [esp], edi
lea ecx, [esp + 0x44]
call fcn.00404140
jmp 0x430a68
mov dword [esp + 0x48], edi
push edi
push ecx
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esp + edi + 0x38], 0
mov al, byte [ebp + 8]
cmp al, 1
lea edi, [esp + 0x6c]
je 0x430a90
test al, al
jne 0x430ab0
mov word [esp + 0x20], 0x100
mov cl, 1
xor eax, eax
jmp 0x430aef
mov dword [esp + 0x18], str..tmp
mov esi, str..tmp
mov dl, 1
mov cl, 3
mov al, 3
jmp 0x430ad9
cmp byte [ebp + 9], 1
mov edx, dword [ebp]
cmovne edx, ebp
movzx ecx, al
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], str..tmp
mov al, 2
mov dl, 3
lea esi, [esp + 0x18]
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], dl
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], ecx
mov cl, 4
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], cl
lea ecx, [esp + 0x24]
push edi
call fcn.004382d0
mov eax, dword [esp + 0x4c]
cmp eax, 0x10
jb 0x430b3b
mov ecx, dword [esp + 0x38]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x430b31
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43105e
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
mov word [esp + 0x40], 0x104
mov dword [esp + 0x38], edi
lea ecx, [esp + 0x24]
mov edx, dword [esp + 4]
push 0
lea eax, [esp + 0x3c]
push eax
call fcn.00433430
add esp, 8
cmp dword [esp + 0x24], 0
je 0x430c70
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430d54
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
cmp eax, dword [0x5673a4]
jne 0x430b9f
cmp dword [esp + 0x24], 0x11
je 0x430bde
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430d8d
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
cmp eax, dword [0x5673a4]
jne 0x430cc9
cmp dword [esp + 0x24], 0xd
jne 0x430cc9
mov eax, dword [esp + 0x298]
sub esp, 0x1c
movaps xmm0, xmmword [0x538560]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x430c77
mov esi, eax
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x430cda
mov eax, dword [esp + 0xb0]
mov edi, 5
cmp eax, dword [esp + 0x64]
jne 0x430cef
mov eax, dword [esp + 0xb4]
cmp eax, dword [esp + 0x68]
jne 0x430cef
mov eax, dword [esp + 0xa0]
xor ecx, ecx
cmp eax, dword [esp + 0x54]
sete cl
lea edi, [ecx + ecx]
add edi, 5
jmp 0x430cef
mov edi, 5
jmp 0x430cf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.004295f0
add esp, 8
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430dc6
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx + 4]
xor ecx, dword [0x5673a4]
xor eax, 2
xor edx, edx
or eax, ecx
sete dl
lea edi, [edx*4 + 1]
jmp 0x430cf6
movsd xmm0, qword [esp + 0x24]
movsd qword [ebx], xmm0
mov edi, 1
jmp 0x430cf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.004295f0
add esp, 8
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x80]
cmp eax, 0x10
jb 0x430d33
mov ecx, dword [esp + 0x6c]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x430d29
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43105e
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
cmp edi, 7
mov ecx, dword [esp + 0x14]
jne 0x430e00
add ecx, 1
cmp ecx, 0xc8
jne 0x430970
jmp 0x430860
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x430b89
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x430b89
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x430bc0
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x430bc0
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x430ca8
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x430ca8
cmp edi, 5
je 0x430860
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 4
mov eax, dword [esp]
je 0x43086d
jmp 0x430feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.004295f0
add esp, 8
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x430ef6
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
cmp eax, dword [0x5673a4]
mov eax, dword [esp]
jne 0x430815
cmp dword [ebx], 2
je 0x43086d
jmp 0x430815
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x4308b2
push 0x433930
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x4308b2
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x4308f7
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x4308f7
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x430e61
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x430e61
movsd xmm0, qword [esp + 0x30]
movsd qword [ebx], xmm0
jmp 0x430815
lea esi, [esp + 0x90]
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0x104
mov ecx, ebx
mov edx, dword [esp + 8]
lea eax, [esp + 0x84]
push eax
call fcn.00430550
add esp, 4
cmp dword [ebx], 0
jne 0x431040
push 1
push dword [esp + 0x29c]
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x431030
mov dword [ebx], 0
mov eax, dword [0x568c58]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x431096
mov dword [ebx + 4], 0x567398
jmp 0x431040
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.004295f0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x430815
cmp edi, 2
jne 0x430815
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, dword [0x5690e4]
mov ecx, dword [0x5698e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x431064
mov dword [ebx], 0xd
mov dword [ebx + 4], 0x5673a0
jmp 0x430815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
call fcn.004295f0
add esp, 8
mov eax, dword [esp + 0x84]
cmp eax, esi
je 0x430815
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x430815
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0x5690e4
call fcn.00533bee
add esp, 4
cmp dword [0x5690e4], 0xffffffff
jne 0x43101e
push 0x433420
call fcn.00533f00
add esp, 4
push 0x5690e4
call fcn.00533ba4
add esp, 4
jmp 0x43101e
push 0x568c58
call fcn.00533bee
add esp, 4
cmp dword [0x568c58], 0xffffffff
jne 0x430fc6
push 0x433930
call fcn.00533f00
add esp, 4
push 0x568c58
call fcn.00533ba4
add esp, 4
jmp 0x430fc6