Function at 0x503c61
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x69ee5e
call fcn.006375a8
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 0x18]
test bl, bl
push esi
push edi
sete al
movzx eax, al
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push dword [ebp + 0x10]
push eax
call fcn.0045e68f
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push ebx
push dword [ebp + 8]
push dword [ebp + 0x14]
push eax
call fcn.0045e68f
xor edi, edi
mov dword [ebp - 0x10], 7
and dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp + 0x18], edi
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x3c]
xor esi, esi
inc esi
mov byte [ebp - 4], 2
cmp dword [ebp - 0x28], 8
mov dword [ebp + 0x14], esi
jae 0x503ccb
lea eax, [ebp - 0x3c]
push eax
call fcn.0045f4bc
test al, al
jne 0x503d28
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
push dword [ebp + 0x10]
push eax
call fcn.0045e68f
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042623d
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.004267c2
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00437447
test eax, eax
je 0x503de7
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x503d1a
lea eax, [ebp - 0x3c]
push eax
call fcn.0045f4bc
test al, al
je 0x503de7
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x503d37
lea eax, [ebp - 0x3c]
push esi
push eax
lea eax, [ebp - 0x6c]
push str._s._d
push eax
call fcn.004638e7
add esp, 0x10
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0042680e
push 0
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.004267c2
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503d77
lea eax, [ebp - 0x24]
push eax
call fcn.0045f4bc
test al, al
jne 0x503db7
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503d8d
lea eax, [ebp - 0x24]
cmp dword [edi + 0x14], 8
jb 0x503d97
mov ebx, dword [edi]
jmp 0x503d99
mov ebx, edi
push eax
call fcn.0045e8e7
push ebx
mov esi, eax
call fcn.0045e8e7
push esi
push eax
call fcn.0065cdeb
pop ecx
pop ecx
test eax, eax
jne 0x503dc0
mov esi, dword [ebp + 0x14]
inc esi
mov dword [ebp + 0x14], esi
jmp 0x503d2b
mov ecx, dword [ebp - 0x24]
push 8
pop esi
cmp dword [ebp - 0x10], esi
jae 0x503dce
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], esi
jae 0x503dd9
lea eax, [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
push ecx
push eax
call ebx
test eax, eax
jne 0x503dee
xor edi, edi
jmp 0x503f38
cmp byte [ebp + 0x1c], 0
je 0x503e46
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x40], esi
jae 0x503dff
lea eax, [ebp - 0x54]
push eax
call fcn.0045f4bc
test al, al
je 0x503e46
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x40], esi
jae 0x503e14
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x503e46
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], esi
jae 0x503e2a
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], esi
jae 0x503e35
lea eax, [ebp - 0x24]
push ecx
push eax
call ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x503f38
mov ebx, dword [ebp - 0x54]
mov eax, ebx
cmp dword [ebp - 0x40], esi
jae 0x503e53
lea eax, [ebp - 0x54]
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov edx, ecx
cmp esi, 8
jae 0x503e63
lea edx, [ebp - 0x3c]
mov di, word [edx]
cmp di, word [eax]
mov edi, dword [ebp + 0x18]
jne 0x503e94
cmp word [edx], di
je 0x503e90
mov di, word [edx + 2]
cmp di, word [eax + 2]
mov word [ebp + 0x1e], di
mov edi, dword [ebp + 0x18]
jne 0x503e94
add edx, 4
add eax, 4
cmp word [ebp + 0x1e], di
jne 0x503e63
xor eax, eax
jmp 0x503e99
sbb eax, eax
or eax, 1
test eax, eax
je 0x503f1c
cmp dword [ebp - 0x40], 8
jae 0x503ea6
lea ebx, [ebp - 0x54]
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503eb2
lea eax, [ebp - 0x24]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x503f38
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
mov edi, eax
cmp edi, 3
je 0x503ed2
cmp edi, 2
jne 0x503f12
mov eax, dword [ebp - 0x54]
xor edi, edi
cmp dword [ebp - 0x40], 8
jae 0x503ee0
lea eax, [ebp - 0x54]
push eax
call fcn.00460273
test al, al
je 0x503f0e
cmp dword [ebp - 0x40], 8
mov ecx, dword [ebp - 0x54]
jae 0x503ef6
lea ecx, [ebp - 0x54]
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503f02
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x503f38
call esi
mov edi, eax
test edi, edi
je 0x503f38
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
cmp esi, 8
jae 0x503f24
lea ecx, [ebp - 0x3c]
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503f30
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
xor ebx, ebx
lea ecx, [ebp - 0x24]
push ebx
push 1
call fcn.004267c2
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004267c2
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18