Function at 0x403c90
Capabilities:
Move file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [esp + 0x80]
mov ecx, dword [0x424234]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x424230]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], 0
mov dword [esp + 0x80], ecx
call fcn.00403c80
mov ebx, dword [esp + 0x70]
mov edx, dword [0x424238]
mov ebp, dword [0x42423c]
add ebx, 0x23f
mov dword [esp + 0x7c], edx
mov dword [esp + 0x78], 0x20
jmp 0x403d04
mov esi, dword [esp + 0x70]
mov dword [esp + 0x14], 2
add dword [esp + 0x14], 3
mov eax, dword [0x47f97c]
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x7c]
cmp eax, 0xfa9
jne 0x403d32
mov dword [0x4773d4], 0xedeb2e40
jmp 0x403d43
cmp eax, 0x3eb
jne 0x403d43
mov dword [0x4563e8], 0
mov eax, dword [esp + 0x74]
shr eax, 5
mov dword [esp + 0x10], eax
add dword [esp + 0x10], ebp
mov dword [0x4773d0], 0xf4ea3dee
mov dword [esp + 0x50], 0x7e9a3efc
mov dword [esp + 0x38], 0x611a7d01
mov dword [esp + 0x58], 0x3e459d2b
mov dword [esp + 0x54], 0x4c53e387
mov dword [esp + 0x34], 0x5995c779
mov dword [esp + 0x24], 0x57a4efbd
mov dword [esp + 0x40], 0x2683dce3
mov dword [esp + 0x6c], 0x14d61179
mov dword [esp + 0x30], 0x7f1757b3
mov dword [esp + 0x44], 0x37129b13
mov dword [esp + 0x3c], 0x66402157
mov dword [esp + 0x64], 0xc102d04
mov dword [esp + 0x5c], 0x25207e95
mov dword [esp + 0x20], 0x61e0950b
mov dword [esp + 0x2c], 0x681407ce
mov dword [esp + 0x4c], 0x7b07095
mov dword [esp + 0x60], 0x194042db
mov dword [esp + 0x68], 0x3cf1732f
mov dword [esp + 0x28], 0x74caa916
mov dword [esp + 0x48], 0x5e691666
mov dword [esp + 0x1c], 0x225ab335
mov dword [esp + 0x18], 0x321ae96f
add dword [esp + 0x50], 0x68842107
add dword [esp + 0x50], 0x4668da2a
add dword [esp + 0x50], 0x6a92fe6a
add dword [esp + 0x50], 0x599ecdf0
add dword [esp + 0x58], 0x7c228860
sub dword [esp + 0x38], 0x18631b5f
add dword [esp + 0x58], 0x7d63a4ff
add dword [esp + 0x38], 0x2767d6d1
sub dword [esp + 0x50], 0x554c1f6e
sub dword [esp + 0x58], 0x7ca97ea
add dword [esp + 0x58], 0x7559638c
sub dword [esp + 0x38], 0x57ac5a17
sub dword [esp + 0x24], 0xb796f85
add dword [esp + 0x34], 0x4c2478ad
add dword [esp + 0x50], 0x7d1eba83
sub dword [esp + 0x24], 0x4806bd4
sub dword [esp + 0x58], 0x50ce968
add dword [esp + 0x40], 0x38a6b2af
add dword [esp + 0x58], 0x6221f4dd
sub dword [esp + 0x38], 0x5a3f0eca
add dword [esp + 0x24], 0x347ae9cd
add dword [esp + 0x34], 0x58b1dde9
sub dword [esp + 0x54], 0x9573267
add dword [esp + 0x38], 0x26967387
sub dword [esp + 0x24], 0x3249f041
add dword [esp + 0x40], 0x70576b43
sub dword [esp + 0x58], 0x10d21f3
sub dword [esp + 0x38], 0x4066475e
sub dword [esp + 0x58], 0x13de03b8
sub dword [esp + 0x38], 0x40245430
add dword [esp + 0x40], 0x6391d7c0
sub dword [esp + 0x50], 0x7bf0c481
sub dword [esp + 0x6c], 0x3bb45148
add dword [esp + 0x50], 0x4ef62dca
sub dword [esp + 0x6c], 0x3a36d0e4
sub dword [esp + 0x38], 0x1d2fd870
add dword [esp + 0x58], 0x5b0f0c0f
add dword [esp + 0x30], 0x1c9b5270
add dword [esp + 0x3c], 0x3f812a84
add dword [esp + 0x64], 0xd2444fc
sub dword [esp + 0x40], 0x729d9b31
add dword [esp + 0x50], 0x48ba665b
sub dword [esp + 0x54], 0x57a42cdc
add dword [esp + 0x44], 0x77722cfb
sub dword [esp + 0x5c], 0x77f0a486
add dword [esp + 0x50], 0x7f836024
add dword [esp + 0x60], 0x1be63520
sub dword [esp + 0x3c], 0x58fdca56
add dword [esp + 0x54], 0x6c6a3245
add dword [esp + 0x54], 0x2cddf599
add dword [esp + 0x44], 0x4438c245
add dword [esp + 0x54], 0x26fa94b8
sub dword [esp + 0x24], 0x3642ec6e
sub dword [esp + 0x20], 0x398b30d2
sub dword [esp + 0x3c], 0x6a8592f3
sub dword [esp + 0x40], 0x40a6f69f
add dword [esp + 0x1c], 0x4b590696
sub dword [esp + 0x28], 0x264241b1
add dword [esp + 0x54], 0x651f0aab
add dword [esp + 0x68], 0x73bdef6c
add dword [esp + 0x40], 0x7eab2570
add dword [esp + 0x2c], 0x4cc240a3
sub dword [esp + 0x30], 0x36e5b069
add dword [esp + 0x4c], 0x494d7bf1
add dword [esp + 0x1c], 0x60b1c470
sub dword [esp + 0x24], 0x4aa15609
sub dword [esp + 0x24], 0x2067dbe3
sub dword [esp + 0x40], 0x47fc05ca
add dword [esp + 0x50], 0x32c1bdc
add dword [esp + 0x20], 0x7eac9aa2
add dword [esp + 0x44], 0x37332d1a
sub dword [esp + 0x48], 0x245ad551
sub dword [esp + 0x18], 0x1688a598
sub dword [esp + 0x20], 0x50b07b1d
lea eax, [ebx + edi]
xor eax, dword [esp + 0x10]
xor eax, ecx
cmp dword [0x47f97c], 0xc
mov dword [esp + 0x10], eax
jne 0x40408e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub esi, eax
mov edx, esi
shr edx, cl
mov dword [esp + 0x70], esi
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x80]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
shl esi, 4
add esi, dword [esp + 0x84]
lea ecx, [ebx + eax]
xor esi, ecx
cmp dword [0x47f97c], 0x121
jne 0x4040d8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [esp + 0x10]
xor edx, esi
sub edi, edx
add ebx, 0x61c88647
dec dword [esp + 0x78]
mov dword [0x44fe40], 0
mov dword [esp + 0x74], edi
jne 0x403d00
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x70]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [eax + 4], ecx
pop ebx
add esp, 0x7c
ret 4