Function at 0x4369d0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 8
call fcn.004403c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4369e5
mov edi, dword [esp + 0x20]
sub esi, ecx
lea ebp, [esi + 1]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4369f8
sub edi, ecx
lea eax, [ebp + 1]
add eax, edi
mov dword [esp + 0x14], edi
add eax, eax
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x436c23
lea eax, [esi + 1]
push eax
push ebx
push eax
push dword [esp + 0x28]
lea ebp, [ebx + ebp*2]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x436af2
lea edx, [esi + 1]
xor ecx, ecx
test edx, edx
je 0x436af2
cmp edx, 0x20
jb 0x436ad7
lea eax, [ebx + esi*2]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
add eax, esi
cmp ebx, eax
mov eax, dword [esp + 0x1c]
ja 0x436a70
cmp dword [esp + 0x10], eax
jae 0x436ad7
mov esi, edx
and esi, 0xffffffe0
mov dword [esp + 0x10], esi
lea esi, [ebx + 0x20]
nop dword [eax]
movq xmm0, qword [eax + ecx]
lea esi, [esi + 0x40]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esi - 0x60], xmm0
movq xmm0, qword [eax + ecx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esi - 0x50], xmm0
movq xmm0, qword [eax + ecx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esi - 0x40], xmm0
movq xmm0, qword [eax + ecx + 0x18]
add ecx, 0x20
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esi - 0x30], xmm0
cmp ecx, dword [esp + 0x10]
jb 0x436a80
cmp ecx, edx
jae 0x436af2
mov edi, dword [esp + 0x1c]
nop
movsx ax, byte [ecx + edi]
mov word [ebx + ecx*2], ax
inc ecx
cmp ecx, edx
jb 0x436ae0
mov edi, dword [esp + 0x14]
lea esi, [edi + 1]
push esi
push ebp
push esi
push dword [esp + 0x2c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x436baf
test esi, esi
je 0x436baf
mov edx, dword [esp + 0x20]
cmp esi, 0x20
jb 0x436b95
lea ecx, [edi + edx]
cmp ebp, ecx
ja 0x436b33
lea ecx, [edi*2]
add ecx, ebp
cmp ecx, edx
jae 0x436b95
mov edi, esi
lea ecx, [ebp + 0x20]
and edi, 0xffffffe0
nop dword [eax + eax]
movq xmm0, qword [edx + eax]
lea ecx, [ecx + 0x40]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ecx - 0x60], xmm0
movq xmm0, qword [edx + eax + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ecx - 0x50], xmm0
movq xmm0, qword [edx + eax + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ecx - 0x40], xmm0
movq xmm0, qword [edx + eax + 0x18]
add eax, 0x20
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [ecx - 0x30], xmm0
cmp eax, edi
jb 0x436b40
cmp eax, esi
jae 0x436baf
nop dword [eax]
movsx cx, byte [eax + edx]
mov word [ebp + eax*2], cx
inc eax
cmp eax, esi
jb 0x436ba0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebp
push ebx
call esi
test eax, eax
jne 0x436c28
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x436bd1
cmp eax, 0x50
jne 0x436be6
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x436be4
push ebp
push ebx
call esi
test eax, eax
jne 0x436c28
call edi
cmp eax, 2
je 0x436c17
cmp eax, 3
je 0x436c17
cmp eax, 5
jne 0x436c06
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
or ebp, 0xffffffff
mov dword [eax], 0xd
jmp 0x436c2a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
or ebp, 0xffffffff
mov dword [eax], 0x16
jmp 0x436c2a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 2
or ebp, 0xffffffff
jmp 0x436c2a
xor ebp, ebp
test ebx, ebx
je 0x436c3e
cmp ebx, dword [esp + 0x1c]
je 0x436c3e
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret