Function at 0x4138a0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x454516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push str.win_system32_sghookapi.dll
push eax
call fcn.004083f0
add esp, 8
xor ebx, ebx
push 5
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x41390d
call edi
mov ecx, dword [esp + 0xc]
push eax
push ecx
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea edx, [esp + 0x10]
push 0x45921c
push edx
call fcn.004083f0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 5
push ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call esi
test eax, eax
jne 0x41396b
call edi
push eax
mov eax, dword [esp + 0x10]
push eax
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea ecx, [esp + 0x10]
push str.win_system32SgMsgHook.dll
push ecx
call fcn.004083f0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 5
push ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call esi
test eax, eax
jne 0x4139c9
call edi
mov edx, dword [esp + 0xc]
push eax
push edx
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea eax, [esp + 0x10]
push str.win_system32SgCipherDll.dll
push eax
call fcn.004083f0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 5
push ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call esi
test eax, eax
jne 0x413a27
call edi
mov ecx, dword [esp + 0xc]
push eax
push ecx
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea edx, [esp + 0x10]
push str.win_system32_sagestub.dll
push edx
call fcn.004083f0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 4
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 5
push ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call esi
test eax, eax
jne 0x413a85
call edi
push eax
mov eax, dword [esp + 0x10]
push eax
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea ecx, [esp + 0x10]
push str.win_system32InjDllProxy.dll
push ecx
call fcn.004083f0
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 5
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
push 5
push ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call esi
test eax, eax
jne 0x413ae3
call edi
mov edx, dword [esp + 0xc]
push eax
push edx
push str.MoveFileEx:_s_sgerrno:_d
push str.CSgReaderApp::DelayDelFile
call fcn.00405160
add esp, 0x10
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret