Function at 0x429620
Capabilities:
Move file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x4db06c]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x4c], 0
or eax, 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0xdc0]
mov edx, dword [eax + 0x5c]
lea ecx, [eax + 0x30]
mov esi, dword [eax + 0x10]
mov ebx, ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x20], ecx
test dword [ebx + 0x30], 0x400
mov dword [esp + 0x30], ecx
mov ecx, dword [edi + 0x6a0]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], esi
je 0x4296aa
mov eax, ecx
mov byte [esp + 0x40], 1
and eax, 0x4000
or eax, 0
je 0x4296af
mov byte [esp + 0x40], 0
cmp esi, 0xd
mov eax, ecx
sete byte [esp + 0x41]
cmp esi, 9
sete byte [esp + 0x42]
and eax, 4
or eax, 0
jne 0x4296ef
mov eax, dword [esp + 0x24]
cmp eax, dword [edi + 0x884]
jl 0x4296ef
jg 0x4296e3
mov eax, dword [esp + 0x20]
cmp eax, dword [edi + 0x880]
jb 0x4296ef
cmp byte [esp + 0x40], 0
mov byte [esp + 0x43], 1
je 0x4296f4
mov byte [esp + 0x43], 0
test byte [ebx + 0x3c], 8
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x3c], eax
jne 0x42974f
mov eax, ecx
mov dword [esp + 0x28], 0x84000
and eax, 5
or eax, 0
jne 0x42971b
mov dword [esp + 0x28], 0x80000
mov eax, ecx
xor edx, edx
and eax, dword [esp + 0x28]
or eax, edx
jne 0x42974f
and ecx, 0x40000
or ecx, edx
je 0x429749
test dword [edi + 0x8d8], 0x800
je 0x429749
test dword [edi + 0x8dc], 0x800
jne 0x42974f
mov dword [esp + 0x28], edx
jmp 0x429757
mov dword [esp + 0x28], 1
cmp esi, 4
je 0x429774
cmp dword [esp + 0x24], 0
jl 0x429793
jg 0x429774
mov eax, dword [edi + 0xdc0]
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x14]
jbe 0x429793
mov esi, dword [esp + 0xc]
lea edi, [esp + 0x50]
mov ecx, 0x2e
lea ebx, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov ecx, edi
call fcn.0041ab10
cmp dword [esp + 0x28], 0
je 0x4297b8
mov edx, dword [edi + 0x7a0]
mov ecx, dword [edi + 0x844]
or edx, 0x100
call fcn.0045cf00
cmp byte [esp + 0x41], 0
je 0x4298c3
mov esi, dword [edi + 0xdc0]
mov edx, 0xc
mov ebx, dword [edi + 0x854]
add esi, 0xa8
mov edi, dword [edi + 0x84c]
push ecx
mov ecx, esi
call fcn.00465c80
mov ecx, dword [esp + 0x14]
add esp, 4
add ecx, 0x12ec
mov dword [esp + 0x2c], ecx
push eax
mov edx, dword [ecx]
push esi
call dword [edx + 0x1c]
mov esi, eax
lea ecx, [edi + ebx*2]
test esi, esi
jne 0x429830
mov edi, dword [esp + 0x10]
push 2
push ecx
push str.HardLinkInfo_is_gone_internal_error_
mov ecx, edi
call fcn.0041a620
mov ebx, dword [esp + 0x14]
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
jmp 0x42996f
mov edx, dword [esi + 0x10]
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x429833
dec dword [esi + 0x20]
cmp dword [esi + 0x20], 1
ja 0x42985f
mov ecx, dword [esp + 0x2c]
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edi, dword [esp + 0x10]
push 0
push dword [edi + 0x84c]
push dword [edi + 0x844]
call dword [sym.imp.KERNEL30.dll_CreateHardLinkW]
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
jne 0x42989e
mov ecx, dword [edi + 0x85c]
push eax
mov eax, dword [edi + 0x844]
lea eax, [eax + ecx*2]
mov ecx, edi
push eax
push str.CreateHardLink
call fcn.0041a620
mov ebx, dword [esp + 0x14]
or eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
jmp 0x42996f
cmp esi, 0xb
jne 0x4298d6
mov esi, 1
mov dword [esp + 0xc], esi
jmp 0x429a4a
lea eax, [esp + 0x30]
mov ecx, edi
push eax
push ebx
lea eax, [esp + 0x34]
push eax
call fcn.004292e0
mov esi, eax
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
mov dword [esp + 0xc], esi
setne cl
mov dword [esp + 0x18], eax
mov dword [esp + 0x4c], ecx
test esi, esi
jne 0x429957
mov esi, dword [esp + 0x10]
mov edi, dword [ebx]
add esi, 0xf44
mov ebx, dword [ebx + 4]
push esi
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
mov eax, dword [esp + 0x10]
push esi
mov dword [eax + 0xde0], edi
mov edi, eax
mov dword [edi + 0xde4], ebx
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
jmp 0x429967
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], edx
cmp ecx, 4
jne 0x429980
mov ecx, dword [ebp + 8]
push ecx
push eax
mov ecx, edi
call fcn.0042ab00
cmp byte [esp + 0x41], 0
jne 0x429a4a
cmp dword [esp + 0x1c], 0xb
je 0x429a4a
test dword [edi + 0x6a8], 0x800000
je 0x4299ab
cmp byte [esp + 0x40], 0
mov eax, edi
je 0x4299ad
mov eax, ebx
add eax, 0x20
mov dword [esp + 0x2c], eax
test esi, esi
je 0x4299d2
cmp byte [esp + 0x42], 0
jne 0x4299d2
push eax
lea eax, [ebx + 0x18]
push eax
lea eax, [ebx + 0x10]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL30.dll_SetFileTime]
cmp dword [esp + 0x4c], 0
je 0x429a4a
mov eax, dword [sym.imp.KERNEL30.dll_CloseHandle]
test esi, esi
jne 0x4299fe
push 0
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL30.dll_SetFilePointer]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL30.dll_SetEndOfFile]
jmp 0x429a3f
test byte [edi + 0x8dc], 0x40
je 0x429a44
push dword [esp + 0x18]
call eax
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push dword [edi + 0x844]
call dword [sym.imp.KERNEL30.dll_CreateFileW]
push dword [esp + 0x2c]
lea ecx, [ebx + 0x18]
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [ebx + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL30.dll_SetFileTime]
mov eax, dword [sym.imp.KERNEL30.dll_CloseHandle]
push dword [esp + 0x18]
call eax
test dword [edi + 0x6a8], 0x200
mov ecx, 2
je 0x429aa6
mov eax, dword [edi + 0x6a0]
and eax, 0x2000000
or eax, 0
jne 0x429aa6
cmp byte [esp + 0x42], al
jne 0x429aa6
cmp dword [edi + 0x100c], eax
jne 0x429aa6
test esi, esi
je 0x429a86
cmp byte [esp + 0x40], al
cmovne eax, ecx
jmp 0x429a8b
mov eax, 1
push eax
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.00429070
neg eax
mov ecx, 2
sbb eax, eax
and esi, eax
mov dword [esp + 0xc], esi
test dword [edi + 0x6a8], 0x300
je 0x429b3e
mov eax, dword [edi + 0x6a0]
and eax, 0x2000000
or eax, 0
mov al, byte [esp + 0x42]
jne 0x429b42
test al, al
jne 0x429b42
cmp dword [edi + 0x100c], 0
jne 0x429b42
test esi, esi
je 0x429ae6
xor eax, eax
cmp byte [esp + 0x40], al
cmovne eax, ecx
jmp 0x429aeb
mov eax, 1
mov ecx, dword [ebp + 8]
push eax
push ebx
push ecx
mov ecx, edi
call fcn.00428ee0
test eax, eax
jne 0x429b3e
mov dword [esp + 0xc], eax
cmp byte [esp + 0x42], 0
mov eax, dword [edi + 0xb60]
mov ecx, dword [esp + 0x20]
je 0x429c22
add dword [eax + 0x120], 1
adc dword [eax + 0x124], 0
mov eax, dword [edi + 0xb60]
add dword [eax + 0x118], ecx
mov ecx, dword [esp + 0x24]
adc dword [eax + 0x11c], ecx
jmp 0x429c46
mov al, byte [esp + 0x42]
test esi, esi
je 0x429b00
test al, al
jne 0x429b82
test byte [ebx + 0x3c], 2
je 0x429b6e
cmp dword [esp + 0x28], 0
jne 0x429b6e
cmp dword [edi + 0x874], 0
je 0x429b6e
mov eax, dword [edi + 0x844]
push eax
push eax
call dword [sym.imp.KERNEL30.dll_MoveFileW]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x429b82
push eax
push dword [edi + 0x844]
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
cmp byte [esp + 0x41], 0
mov ecx, dword [edi + 0xb60]
je 0x429b96
mov eax, 0x30
jmp 0x429ba8
cmp byte [esp + 0x42], 0
mov eax, 0x28
mov edx, 0x38
cmovne eax, edx
add dword [ecx + eax], 1
adc dword [ecx + eax + 4], 0
cmp byte [esp + 0x42], 0
je 0x429cac
mov esi, dword [esp + 0x14]
mov cl, byte [esp + 0x42]
cmp dword [edi + 0x874], 0
je 0x429bfa
cmp dword [edi + 0x864], 0
je 0x429d68
test dword [edi + 0x6a8], 0x300
je 0x429bfa
mov eax, dword [edi + 0x6a0]
and eax, 0x2000000
or eax, 0
je 0x429d68
mov ebx, dword [esp + 0xc]
test cl, cl
jne 0x429d6c
test ebx, ebx
je 0x429d95
cmp byte [esp + 0x41], cl
je 0x429d03
mov ecx, 4
jmp 0x429d15
add dword [eax + 0xe0], 1
adc dword [eax + 0xe4], 0
mov eax, dword [edi + 0xb60]
add dword [eax + 0xe8], ecx
mov ecx, dword [esp + 0x24]
adc dword [eax + 0xec], ecx
mov esi, dword [esp + 0x10]
mov edi, dword [ebx]
add esi, 0xf44
mov ebx, dword [ebx + 4]
push esi
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
mov eax, dword [esp + 0x10]
push esi
mov dword [eax + 0xde0], edi
mov edi, eax
mov dword [edi + 0xde4], ebx
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
mov cl, byte [esp + 0x42]
test cl, cl
jne 0x429cfa
cmp dword [esp + 0x4c], 0
jne 0x429c91
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 0x5aa
jne 0x429ca8
mov edx, dword [edi + 0x7a0]
mov ecx, dword [edi + 0x844]
or edx, 0x100
call fcn.0045cf00
mov esi, dword [esp + 0xc]
cmp dword [edi + 0x694], 5
jne 0x429cf6
test dword [edi + 0x6a8], 0x300
jne 0x429bbc
cmp dword [edi + 0x100c], 0
jne 0x429bbc
xor eax, eax
mov ecx, edi
test esi, esi
mov esi, dword [esp + 0x14]
sete al
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push dword [esi]
call fcn.0041ad10
jmp 0x429bc0
mov cl, byte [esp + 0x42]
mov esi, dword [esp + 0x14]
jmp 0x429bc4
cmp byte [esp + 0x40], 0
mov ecx, 1
mov eax, 8
cmovne ecx, eax
xor edx, edx
test cl, 1
je 0x429d40
test dword [edi + 0x6a8], 0x400
je 0x429d40
mov eax, dword [edi + 0x6a0]
and eax, 0x2000000
or eax, edx
jne 0x429d40
or ecx, 0x100000
lea edx, [esi + 0x78]
mov eax, dword [edi + 0x844]
push edx
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push ecx
push ecx
mov ecx, dword [edi + 0x85c]
lea eax, [eax + ecx*2]
mov ecx, edi
push eax
call fcn.00417da0
jmp 0x429d6c
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x429d95
cmp dword [edi + 0x100c], 0
jne 0x429d95
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x114]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret 8