Function at 0x60111010
Capabilities:
Check if file exists
Get disk information
Move file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x60148f9a
push eax
mov eax, dword [sym.scnkrnl.dll_class_CAVLog__g_pLog]
mov dword fs:[0], esp
sub esp, 0x18
test eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
je 0x6011104c
push str.CAVQuarantine::DoQuarantine_started
push 1
push 0x80
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CAVLog::AddLogEntry_unsigned_long_int__unsigned_int__char_const__
add esp, 0x10
mov ebp, dword [esp + 0x38]
push ebp
lea ecx, [esp + 0x14]
call fcn.601045b0
mov eax, dword [esp + 0x10]
push 0x5c
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
or ebx, 0xffffffff
test eax, eax
je 0x60111085
mov ecx, dword [esp + 0x10]
sub eax, ecx
mov esi, eax
cmp esi, ebx
jne 0x601110e8
mov ecx, dword [str.File_not_found]
push ecx
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push 0x686
lea ecx, [esp + 0x64]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x14
mov dword [esp + 0x30], ebx
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x601110ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov eax, SysStringLen
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov al, byte [esp + 0x50]
test al, al
jne 0x601111b6
mov eax, dword [edi + 0x54]
mov al, byte [eax]
mov byte [esp + 0x1c], al
mov eax, dword [0x6015b6f8]
mov ecx, 0x6015b6f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
push 1
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x3c], 1
call dword [edx + 0x40]
test al, al
jne 0x60111250
mov edx, dword [str.Create_directory_operation_failed]
push edx
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push 0x6a4
lea ecx, [esp + 0x64]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6011117d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x6011119c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov eax, 0x80000008
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x601111c7
push 0x80070057
call fcn.601040a0
mov cl, byte [ecx]
mov dword [esp + 0x20], 0x5c3a78
mov byte [esp + 0x1c], cl
mov byte [esp + 0x20], cl
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x601110fd
mov edx, dword [str.Quarantine_operation_is_not_supported_for_this_drive]
push edx
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push 0x695
lea ecx, [esp + 0x64]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x14
mov dword [esp + 0x30], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x60111236
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov eax, 0x80000009
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov edx, dword [esp + 0x14]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jne 0x601112e3
mov eax, dword [sym.scnkrnl.dll_class_CAVLog__g_pLog]
test eax, eax
je 0x60111288
mov ecx, dword [str.Operation_failed]
push ecx
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CAVLog::AddLogEntry_unsigned_long_int__unsigned_int__char_const__
mov edx, dword [esp + 0x28]
add esp, 0x14
lea eax, [edx - 0x10]
mov byte [esp + 0x30], 0
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x601112a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x6011167c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
lea eax, [ecx - 1]
test eax, eax
jl 0x601111bd
cmp eax, ecx
jg 0x601111bd
cmp byte [eax + edx], 0x5c
je 0x60111307
push 0x5c
lea ecx, [esp + 0x18]
call fcn.6010a1e0
mov eax, dword [0x6015b6f8]
mov ecx, 0x6015b6f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov edx, dword [0x6015b6f8]
mov ecx, 0x6015b6f8
mov byte [esp + 0x30], 2
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
inc esi
push esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 3
call fcn.60109ff0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x40], 4
call fcn.6010f8a0
mov al, byte [esp + 0x58]
add esp, 0x10
test al, al
je 0x60111507
mov eax, dword [edi + 0x74]
test eax, eax
mov ebx, dword [esp + 0x18]
je 0x601113fc
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x28]
call fcn.60113f70
mov esi, eax
push ebx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x34], 5
call fcn.60113f70
mov esi, dword [esi]
mov eax, dword [eax]
mov ecx, dword [edi + 0x74]
push esi
push eax
mov byte [esp + 0x38], 6
call fcn.601265a0
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
mov eax, dword [esp + 0x48]
push eax
call ebp
mov ecx, dword [esp + 0x24]
push ecx
mov byte [esp + 0x34], 4
call ebp
test esi, esi
je 0x601113fc
mov eax, dword [sym.scnkrnl.dll_class_CAVLog__g_pLog]
test eax, eax
je 0x60111486
mov edx, dword [esp + 0x10]
push esi
push ebx
push edx
push str.CAVQuarantine::DoQuarantine_Stiff_eraser_failed_to_move_file__s_to__s._Error__d
push 4
push 0x80
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CAVLog::AddLogEntry_unsigned_long_int__unsigned_int__char_const__
add esp, 0x1c
mov eax, dword [esp + 0x10]
push ebx
push eax
call sym.scnkrnl.dll_public:_static_bool___cdecl_CAVQuarantine::EnsureMoveFile_char_const___char_const__
add esp, 8
test al, al
jne 0x60111486
push reloc.OLEAUT32.dll_SysStringLen
call sym.scnkrnl.dll_public:_static_char_const____cdecl_CAVQuarantine::GetErrorDescription_int_
add esp, 4
push eax
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push 0x6d2
lea ecx, [esp + 0x64]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
add esp, 0x14
lea ecx, [esp + 0x20]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x14]
call fcn.601042d0
lea ecx, [esp + 0x10]
call fcn.601042d0
pop edi
pop esi
pop ebp
mov eax, reloc.OLEAUT32.dll_SysStringLen
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
or eax, 0x200000
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x4c]
mov ebx, eax
inc eax
mov dword [edi + 0x4c], eax
lea eax, [esp + 0x48]
lea esi, [edi + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x4c], ebx
call fcn.60116ac0
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.60114540
mov esi, dword [esp + 0x38]
cmp esi, dword [edi + 0x40]
jne 0x601115ab
push SysStringLen
call sym.scnkrnl.dll_public:_static_char_const____cdecl_CAVQuarantine::GetErrorDescription_int_
add esp, 4
push eax
push str.CAVQuarantine::DoQuarantine__s
push 2
push 0x80
push 0x6ec
lea ecx, [esp + 0x64]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
add esp, 0x14
jmp 0x6011164f
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x60111497
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x60111534
cmp eax, 3
mov esi, reloc.OLEAUT32.dll_SysStringLen
jne 0x60111539
mov esi, SysStringLen
push eax
push esi
call sym.scnkrnl.dll_public:_static_char_const____cdecl_CAVQuarantine::GetErrorDescription_int_
add esp, 4
push eax
push str.CAVQuarantine::DoQuarantine__s._Error__u
push 2
push 0x80
push 0x6e0
lea ecx, [esp + 0x68]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x14]
call fcn.601042d0
lea ecx, [esp + 0x10]
call fcn.601042d0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov al, byte [esp + 0x50]
add esi, 0x10
test al, al
mov ecx, esi
push ebp
je 0x601115c0
call fcn.60104570
jmp 0x601115d9
call fcn.60104570
push 0x5c
mov ecx, esi
call fcn.60109040
inc eax
push eax
push 0
mov ecx, esi
call fcn.60114440
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 4]
call fcn.6010a570
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esi + 8]
call fcn.60104570
push 0
call dword [sym.imp.MSVCR71.dll_time]
cdq
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x48]
add esp, 4
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x1c], eax
push 1
lea eax, [esp + 0x18]
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], 1
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x60]
test al, al
jne 0x60111696
push str.CAVQuarantine::DoQuarantine_Index_store_failed
push 2
push 0x80
push 0x712
lea ecx, [esp + 0x60]
call sym.scnkrnl.dll_public:_void___thiscall_CDevLog::constructor_int_
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CDevLog::operator___unsigned_long_int__unsigned_int__char_const__const
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x14]
call fcn.601042d0
lea ecx, [esp + 0x10]
call fcn.601042d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x601116a0
mov dword [eax], ebx
mov eax, dword [sym.scnkrnl.dll_class_CAVLog__g_pLog]
test eax, eax
je 0x601116be
push str.CAVQuarantine::DoQuarantine_finished
push 1
push 0x80
push eax
call sym.scnkrnl.dll_public:_void___cdecl_CAVLog::AddLogEntry_unsigned_long_int__unsigned_int__char_const__
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x14]
call fcn.601042d0
lea ecx, [esp + 0x10]
call fcn.601042d0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x1c