Function at 0x484d30
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7c]
sub esp, 0x7c
push 0xffffffffffffffff
push 0x4d7fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp + 0x78], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0xe4], 0
je 0x484d75
xor al, al
jmp 0x484ff0
lea esi, [ebx + 0x40]
push esi
mov dword [ebp - 0x18], esi
call fcn.00407bf0
add esp, 4
test al, al
je 0x484d6e
lea edi, [ebx + 0x58]
push edi
call fcn.00407bf0
add esp, 4
test al, al
je 0x484d6e
mov ecx, esi
call fcn.00405b00
mov esi, eax
call fcn.00406940
push ecx
push esi
mov ecx, eax
call fcn.00406a40
test al, al
je 0x484d6e
mov ecx, edi
call fcn.00405b00
mov esi, eax
call fcn.00406940
push ecx
push esi
mov ecx, eax
call fcn.00406a40
test al, al
je 0x484d6e
push str..tmp
lea edi, [ebx + 0x70]
lea eax, [ebp + 0x48]
push edi
push eax
call fcn.00408bf0
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp]
call fcn.00402750
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x10]
call fcn.00405b00
push eax
lea ecx, [ebp + 0x48]
call fcn.00405b00
push eax
lea ecx, [ebx + 0x58]
call fcn.00405b00
push eax
lea eax, [ebp]
push str._m___s___s___s___h__s
push eax
call fcn.004129d0
mov eax, dword [ebx + 0xf0]
lea edx, [ebp]
add esp, 0x14
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x14], esi
xor bl, bl
mov dword [ebp - 0x10], esi
push eax
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00416500
add esp, 8
test al, al
je 0x484e6c
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov ecx, esi
mov bl, 1
call fcn.00416950
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xe8], esi
test bl, bl
je 0x484fd3
cmp esi, 0x2710
sete bl
jne 0x484fd3
push edi
mov dword [eax + 0xe8], 0
call fcn.00407bf0
add esp, 4
test al, al
je 0x484eb4
push edi
lea eax, [ebp + 0x48]
push eax
call fcn.0047d8a0
mov bl, al
jmp 0x484fd3
push 0xb
mov ecx, edi
call fcn.00405b00
push eax
lea ecx, [ebp + 0x48]
call fcn.00405b00
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
test eax, eax
jne 0x484fa2
lea ecx, [ebp + 0x18]
xor bl, bl
call fcn.00402750
mov byte [ebp - 4], 2
lea edx, [ebp + 0x18]
lea ecx, [ebp + 0x48]
call fcn.00414cb0
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp + 0x30]
call fcn.00402750
mov byte [ebp - 4], 3
lea edx, [ebp + 0x30]
mov ecx, edi
call fcn.00414cb0
test al, al
jne 0x484f1b
test bl, bl
je 0x484f35
push 0xb
lea ecx, [ebp + 0x30]
call fcn.00405b00
push eax
lea ecx, [ebp + 0x18]
call fcn.00405b00
push eax
call esi
test eax, eax
jne 0x484f8a
mov ecx, edi
call fcn.004144e0
cmp eax, 0xffffffff
je 0x484fb9
push edi
lea ecx, [ebp + 0x60]
call fcn.00402770
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x60]
call fcn.00414a00
test al, al
je 0x484fad
lea edx, [ebp + 0x60]
mov ecx, edi
call fcn.00414580
test al, al
je 0x484fad
mov edx, edi
lea ecx, [ebp + 0x48]
call fcn.00414580
lea ecx, [ebp + 0x60]
test al, al
je 0x484fa6
call fcn.004147f0
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.00402290
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00402290
mov bl, 1
jmp 0x484fd3
mov edx, edi
call fcn.00414580
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x60]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
call fcn.00402290
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00402290
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00402290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x48]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x78]
xor ecx, ebp
call fcn.004a100a
lea esp, [ebp + 0x7c]
pop ebp
ret