Function at 0x402440
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x412cfb
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str..ACP
push ebp
call fcn.004080c4
mov eax, dword [esp + 0x260]
mov ebx, dword [esp + 0x264]
mov esi, 1
add esp, 8
cmp eax, esi
jle 0x4024ac
lea edi, [ebx + 4]
mov eax, dword [edi]
push 0x41a2fc
push eax
call fcn.0040808f
add esp, 8
test eax, eax
je 0x4024b6
mov eax, dword [esp + 0x258]
inc esi
add edi, 4
cmp esi, eax
jl 0x402489
cmp dword [esp + 0x258], 1
jne 0x4024c0
call fcn.004023d0
jmp 0x4028ba
push 0x41de38
push 0x100
push str.xiaobaohappyxiaohaohappyxiaobaoh
call fcn.00401430
mov eax, dword [esp + 0x264]
add esp, 0xc
cmp eax, 1
jle 0x40281f
add ebx, 4
dec eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov esi, dword [ebx]
push str._...
push esi
push str.Process
push 0x41e130
call fcn.004035c0
add esp, 8
push eax
call fcn.004035c0
add esp, 8
push eax
call fcn.004035c0
add esp, 8
mov edi, eax
mov ecx, edi
push 0xa
call fcn.00402fe0
mov ecx, edi
call fcn.00403150
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402552
push str.File_not_found_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
jmp 0x402560
test al, 0x10
je 0x40257f
push str.Directory_skipped_
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, esi
call fcn.00403150
jmp 0x402805
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bp
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x30]
push esi
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push str._tmp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x402624
push str.Failed_to_rename_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x402611
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402611
mov edi, 4
mov eax, dword [esi]
push ebp
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
jmp 0x402805
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x2c]
push ecx
call fcn.00401f70
add esp, 4
lea edx, [esp + 0x2c]
mov bl, al
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x40268c
push str.Completed_
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x4026d9
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4026d9
jmp 0x4026d4
push str.Failed_to_restore_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test cl, 6
lea eax, [edx + esi]
jne 0x4026d9
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4026d9
mov edi, 4
mov eax, dword [esi]
push ebp
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x258], 2
jle 0x402805
mov cl, byte [esp + 0x13]
push ebp
mov byte [esp + 0x20], cl
lea ecx, [esp + 0x20]
call fcn.004032b0
mov eax, dword [0x416974]
mov esi, 0x4b
cmp eax, esi
jne 0x402722
call fcn.00407689
push 1
push esi
lea ecx, [esp + 0x24]
call fcn.00403380
test al, al
je 0x402751
mov edx, dword [esp + 0x20]
push esi
push 0x3d
push edx
call fcn.004028e0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], esi
add esp, 0xc
mov word [eax + 0x96], bp
mov eax, dword [esp + 0x20]
mov dword [esp + 0x250], ebp
cmp eax, ebp
jne 0x402765
mov eax, 0x416970
push eax
push 0x41e130
call fcn.004035c0
add esp, 8
mov ecx, 0x41e130
push 0xa
call fcn.00402fe0
mov ecx, dword [0x41e130]
xor esi, esi
mov eax, dword [ecx + 4]
test byte [eax + 0x41e134], 6
jne 0x4027aa
mov eax, dword [eax + 0x41e158]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4027aa
mov esi, 4
mov eax, dword [0x41e130]
mov ecx, dword [eax + 4]
add ecx, 0x41e130
cmp esi, ebp
je 0x4027c8
mov eax, dword [ecx + 4]
push ebp
or eax, esi
push eax
call fcn.00403290
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x250], 0xffffffff
cmp ecx, ebp
je 0x4027f9
mov al, byte [ecx - 1]
test al, al
je 0x4027ed
cmp al, 0xff
je 0x4027ed
dec al
mov byte [ecx - 1], al
jmp 0x4027f9
add ecx, 0xfffffffe
push ecx
call fcn.0040767e
add esp, 4
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
jne 0x4024f3
push 0xa
mov ecx, 0x41e0f8
call fcn.00402920
mov ecx, dword [0x41e0f8]
xor esi, esi
mov eax, dword [ecx + 4]
test byte [eax + 0x41e0fc], 6
jne 0x402856
mov eax, dword [eax + 0x41e120]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402856
mov esi, 4
mov eax, dword [0x41e0f8]
mov ecx, dword [eax + 4]
add ecx, 0x41e0f8
cmp esi, ebp
je 0x40287d
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebp
jne 0x402876
or al, 4
push ebp
push eax
call fcn.00407205
mov esi, 3
push str._seconds_...
push esi
push str._rExit_in
push 0x41e130
call fcn.004035c0
add esp, 8
mov ecx, eax
call fcn.00402a90
push eax
call fcn.004035c0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
cmp esi, ebp
jg 0x402882
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x244
ret