Function at 0x100dda8e
Capabilities:
Move file

Disassembly:
push 0x5c
mov eax, 0x10045d28
call fcn.10041ac9
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push 4
push eax
mov dword [ebp - 0x5c], eax
call fcn.100507f5
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.10050839
test eax, eax
jne 0x100ddad0
mov esi, 0x80030103
jmp 0x100ddcd4
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
push eax
push 0x3c
lea ebx, [ebp - 0x4c]
mov edi, esi
mov eax, ebx
mov dword [ebp - 0x50], edi
push eax
push 4
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
mov ecx, dword [ebp - 0x58]
cmp ecx, 0x3c
jbe 0x100ddb55
test ecx, ecx
je 0x100ddb55
test edi, edi
je 0x100ddb19
test ebx, ebx
je 0x100ddb15
push ebx
push dword [0x100e4034]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x58]
mov edi, esi
jmp 0x100ddb1c
mov edi, dword [ebp - 0x50]
push ecx
push 0xa00000
push dword [0x100e4034]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100ddbb4
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
push edi
push ebx
push 4
push dword [ebp - 0x5c]
mov dword [ebp - 0x50], edi
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
mov ecx, dword [ebp - 0x58]
cmp edi, ecx
jb 0x100ddafb
test eax, eax
jne 0x100ddc3c
test byte [0x100e4068], 2
mov edi, 0x80070005
mov esi, edi
je 0x100ddcba
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.10050714
push 0xbc
push edi
cmp eax, 0xffffffff
je 0x100ddc22
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.10050714
push eax
push 0x10037290
push 0x2f009
push dword [0x100e7128]
call fcn.100d931d
add esp, 0x18
jmp 0x100ddcba
test byte [0x100e4068], 2
mov esi, 0x8007000e
je 0x100ddcbd
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.10050714
push 0xaf
push esi
cmp eax, 0xffffffff
je 0x100ddc05
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.10050714
push eax
push 0x10037290
push 0x2bc09
push dword [0x100e7128]
call fcn.100d931d
add esp, 0x18
jmp 0x100ddcbd
push 0x10037308
push 0x2bc09
push dword [0x100e7128]
call fcn.100d931d
add esp, 0x14
jmp 0x100ddcbd
push 0x10037308
push 0x2f009
push dword [0x100e7128]
call fcn.100d931d
add esp, 0x14
jmp 0x100ddcba
push ebx
push 4
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x100ddc99
test byte [0x100e4068], 2
mov edi, 0x80070005
mov esi, edi
je 0x100ddcba
mov ecx, dword [ebp - 0x54]
add ecx, 0xc
call fcn.10050714
push 0xc0
push edi
cmp eax, 0xffffffff
je 0x100ddc8d
mov ecx, dword [ebp - 0x54]
lea ecx, [ecx + 0xc]
call fcn.10050714
push eax
push 0x10037290
push 0x30009
jmp 0x100ddba1
push 0x10037308
push 0x30009
jmp 0x100ddc2c
mov edi, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x54]
push edi
call fcn.100dd94d
push edi
push dword [ebp - 0x60]
call dword [sym.imp.msvcrt.dll__wrename]
pop ecx
pop ecx
test eax, eax
je 0x100ddcba
mov esi, 0x80030103
mov edi, dword [ebp - 0x50]
test edi, edi
je 0x100ddcd4
test ebx, ebx
je 0x100ddcd4
push ebx
push dword [0x100e4034]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
test byte [ebp - 0x64], 2
je 0x100ddce3
push dword [ebp - 0x68]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.10041a78
ret 8