Function at 0x6987a8
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41d900]
call fcn.0040b0fc
xor eax, eax
push ebp
push 0x698a4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x28c]
mov ecx, 0x698a68
call fcn.0040ad10
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x270]
mov edx, 0x10
call fcn.00426ffc
mov ebx, eax
test ebx, ebx
jne 0x69898b
xor eax, eax
push ebp
push 0x698984
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x698969
mov eax, dword [ebp - 0x25c]
mov edx, 0x698a7c
call fcn.0040ae48
je 0x698954
mov eax, dword [ebp - 0x25c]
mov edx, 0x698a8c
call fcn.0040ae48
je 0x698954
test byte [ebp - 0x260], 0x10
je 0x698954
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x274], eax
mov esi, dword [ebp - 0x274]
test esi, esi
je 0x698887
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x290]
mov ecx, 0x698aa0
mov edx, dword [ebp - 0x25c]
call fcn.0040ad10
mov eax, dword [ebp - 0x290]
lea ecx, [esi + 1]
mov edx, dword [ebp + 8]
add edx, 0xfffffffc
call fcn.0040af24
mov eax, dword [ebp + 8]
push eax
call fcn.006987a8
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x278], eax
mov edi, dword [ebp - 0x278]
test edi, edi
je 0x6988d6
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x698908
mov eax, dword [ebp - 0x280]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
je 0x69893a
mov eax, dword [ebp - 0x288]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x288], eax
mov edx, edi
sub edx, dword [ebp - 0x280]
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov ecx, dword [ebp - 0x288]
call fcn.0040aec8
lea eax, [ebp - 0x270]
call fcn.0042704c
mov ebx, eax
test ebx, ebx
je 0x698833
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69898b
lea eax, [ebp - 0x270]
call fcn.00427070
pop eax
jmp eax
lea edx, [ebp - 0x294]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042e06c
mov edx, dword [ebp - 0x294]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.0040a4d4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 1
xor edx, edx
call fcn.00426e78
mov eax, dword [0x6b276c]
movzx eax, byte [eax + 0x21101]
sub al, 1
jb 0x6989d0
je 0x6989f6
jmp 0x698a0b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00427718
test al, al
jne 0x698a0b
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040aaa8
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x698a0b
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040aaa8
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x698a54
lea eax, [ebp - 0x294]
call fcn.0040a0ac
lea eax, [ebp - 0x290]
call fcn.0040a0ac
lea eax, [ebp - 0x28c]
call fcn.0040a0ac
lea eax, [ebp - 0x270]
mov edx, dword [0x41d900]
call fcn.0040b4b0
pop eax
jmp eax