Function at 0x11d11950
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x11fa5303
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebx
push ebp
push esi
mov dword [esp + 0x24], ecx
push edi
push 2
lea ecx, [esp + 0x34]
call fcn.11e15fa0
xor ebp, ebp
push str.SafeDiskMoveFile
lea ecx, [esp + 0x14]
mov dword [esp + 0x250], ebp
mov dword [esp + 0x30], ebp
call fcn.11e7eae0
mov esi, dword [esp + 0x254]
mov byte [esp + 0x24c], 1
cmp esi, ebp
je 0x11d123e2
mov ebx, dword [esp + 0x258]
cmp ebx, ebp
je 0x11d123e2
push esi
call fcn.11e67d05
add esp, 4
test eax, eax
je 0x11d123e2
push ebx
call fcn.11e67d05
add esp, 4
test eax, eax
je 0x11d123e2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x11fd6250]
mov dword [esp + 0x14], eax
push ebx
mov ecx, 0x1212b5c0
mov byte [esp + 0x250], 2
call fcn.11d8bbb0
test eax, eax
je 0x11d11a76
push 0x5c
push ebx
call fcn.11e67430
mov edi, eax
add esp, 8
cmp edi, ebp
je 0x11d11a76
call fcn.11dc2dd0
push eax
lea ecx, [esp + 0x1c]
call fcn.11e7eae0
push 0x5c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x250], 3
call fcn.11e82ba0
mov ecx, dword [esp + 0x18]
add edi, 2
push edi
push ecx
lea edx, [esp + 0x1c]
push 0x12025c58
push edx
call fcn.11e82200
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 2
call fcn.11e7f280
jmp 0x11d11a80
push ebx
lea ecx, [esp + 0x18]
call fcn.11e7f500
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
push 0x12052ea0
push ecx
call fcn.11ce3650
add esp, 0xc
test eax, eax
mov eax, dword [0x12133f80]
je 0x11d120bb
mov ebp, dword [esp + 0x260]
mov edi, dword [esp + 0x25c]
test eax, eax
je 0x11d11ad8
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push edx
push ebp
push edi
push ebx
push esi
push 0x56b7
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Src__s__Dst__s__bMoveIn__d__bDeleteSrc__d__Tmp__s_
push eax
push 4
call fcn.11ca5810
add esp, 0x24
push ebx
mov ecx, 0x1212b5c0
call fcn.11d7dfe0
test eax, eax
jne 0x11d120df
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
cmp edi, ebp
push ebp
push esi
je 0x11d11d2c
call fcn.11ee1fb0
add esp, 0x28
cmp eax, 3
mov eax, dword [0x12133f80]
je 0x11d11b49
cmp eax, ebp
je 0x11d11b2f
mov ecx, dword [esp + 0x10]
push esi
push 0x56dc
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Src_File__s__is_not_encrypted.
push ecx
push 4
call fcn.11ca5810
add esp, 0x14
lea edx, [esp + 0x3c]
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x11d12156
jmp 0x11d1200d
cmp eax, ebp
je 0x11d11b6c
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push eax
push esi
push 0x56f1
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Decrypt_File__s__to_Tmp__s_
push ecx
push 4
call fcn.11ca5810
add esp, 0x18
push ebp
push ebp
push 3
push ebp
push 7
push bind
push esi
mov dword [esp + 0x40], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d12186
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
call fcn.11e923e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 4
call fcn.11e923e0
lea edx, [esp + 0x1c]
push 1
push edx
lea eax, [esp + 0x20]
push ebp
push eax
lea ecx, [esp + 0x34]
push ebp
push ecx
push esi
push edi
mov ecx, 0x1212b028
mov byte [esp + 0x26c], 5
call fcn.11d0bc10
test eax, eax
je 0x11d121c4
lea ecx, [esp + 0x18]
call fcn.11e925e0
test eax, eax
jbe 0x11d11bf9
lea ecx, [esp + 0x18]
call fcn.11e92ce0
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
call fcn.11e925e0
test eax, eax
jbe 0x11d11c13
lea ecx, [esp + 0x1c]
call fcn.11e92ce0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
cmp eax, ebp
jne 0x11d12203
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1212b5c0
call fcn.11d9cd60
mov edi, eax
push edi
call fcn.11ee1bf0
mov ecx, dword [0x12133f80]
add esp, 4
cmp ecx, ebp
je 0x11d11c61
shr eax, 0xa
shr edi, 0xa
push eax
push edi
push str.CSafeDoc::SafeDiskMoveFile_Decrypt_Block_Size__dKb__SizeReal__dKb_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x14
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov edi, eax
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d11c8f
lea edx, [esp + 0x3c]
push edx
push esi
push edi
push str.CSafeDoc::SafeDiskMoveFile_Decrypt_Beg___d____s___s_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x18
push 2
lea eax, [esp + 0x40]
push 0
push eax
push esi
call fcn.11edfab0
add esp, 0x10
test eax, eax
jne 0x11d12252
push ebx
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11d11ccf
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
push ecx
push edx
push 0
push ebx
push 0x1a
mov ecx, 0x1212b560
call fcn.11dedd70
call ebp
mov ecx, dword [0x12133f80]
test ecx, ecx
je 0x11d11cfb
lea ecx, [esp + 0x3c]
mov edx, eax
push ecx
sub edx, edi
push esi
push edx
push eax
push str.CSafeDoc::SafeDiskMoveFile_Decrypt_End___d___d____s___s_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x1c
push 0
call fcn.11ee1bf0
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 4
call fcn.11e92540
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 2
call fcn.11e92540
jmp 0x11d1200d
call fcn.11ee1fb0
add esp, 0x28
cmp eax, 3
je 0x11d11fd1
push 0x1205d918
push esi
call fcn.11ea3350
add esp, 8
test eax, eax
je 0x11d11d6b
push esi
mov ecx, 0x1212b5c0
call fcn.11d7be40
test eax, eax
jne 0x11d11d85
push esi
call fcn.11cbc650
add esp, 4
test eax, eax
jne 0x11d11d85
push esi
call fcn.11dfb2c0
add esp, 4
test eax, eax
jne 0x11d11d85
push esi
call fcn.11cbbef0
add esp, 4
test eax, eax
je 0x11d11dc1
cmp dword [0x12133f80], ebp
je 0x11d11da7
mov eax, dword [esp + 0x10]
push esi
push 0x5781
push str._CSafeDoc::SafeDiskMoveFile__Line:_d__File__s__is_PE__not_decrypt.
push eax
push 4
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x3c]
push ebp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x11d122f0
jmp 0x11d1200d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.11e923e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 6
call fcn.11e923e0
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x18]
push ebp
lea eax, [esp + 0x20]
push edx
push eax
push ebx
mov byte [esp + 0x25c], 7
call fcn.11d18db0
test eax, eax
je 0x11d11e38
lea ecx, [esp + 0x1c]
call fcn.11e925e0
test eax, eax
jbe 0x11d11e1e
lea ecx, [esp + 0x1c]
call fcn.11e92ce0
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x18]
call fcn.11e925e0
test eax, eax
jbe 0x11d11e38
lea ecx, [esp + 0x18]
call fcn.11e92ce0
mov dword [esp + 0x20], eax
cmp dword [0x12133f80], ebp
je 0x11d11e5f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
push ecx
push esi
push 0x57a3
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Encrypt_File__s__to_Tmp__s_
push edx
push 4
call fcn.11ca5810
add esp, 0x18
push 0xffff4502
mov dword [esp + 0x2c], 0x11fcadb8
call fcn.11ee5c40
add esp, 4
mov ecx, 0x1212b5c0
mov byte [esp + 0x24c], 8
call fcn.11d9cd60
mov edi, eax
push edi
call fcn.11ee1bf0
mov ecx, dword [0x12133f80]
add esp, 4
cmp ecx, ebp
je 0x11d11eb7
shr eax, 0xa
shr edi, 0xa
push eax
push edi
push str.CSafeDoc::SafeDiskMoveFile_Encrypt_Block_Size__dKb__SizeReal__dKb_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x14
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ebx, eax
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d11ee5
lea eax, [esp + 0x3c]
push eax
push esi
push ebx
push str.CSafeDoc::SafeDiskMoveFile_Encrypt_Beg___d____s___s_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x18
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push ecx
push 0
push 2
push 0
push edx
lea eax, [esp + 0x50]
push 1
push eax
push esi
call fcn.11edeeb0
add esp, 0x20
mov edi, eax
call ebp
mov ecx, dword [0x12133f80]
test ecx, ecx
je 0x11d11f34
lea ecx, [esp + 0x3c]
mov edx, eax
push edi
push ecx
sub edx, ebx
push esi
push edx
push eax
push str.CSafeDoc::SafeDiskMoveFile_Encrypt_End___d___d____s___s____lu_
push str.IPG_17002
push 1
call fcn.11ca5810
add esp, 0x20
push 0
call fcn.11ee1bf0
mov eax, dword [0x12133f80]
add esp, 4
test eax, eax
je 0x11d11f67
lea eax, [esp + 0x3c]
push edi
push eax
push esi
push 0x57c7
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Encrypt_File__s__to_Tmp__s____lu_
push str.TestEncryptFile
push 4
call fcn.11ca5810
add esp, 0x1c
push 0
mov byte [esp + 0x250], 7
call fcn.11ee5c40
add esp, 4
test edi, edi
jne 0x11d1230d
push esi
call fcn.11cbc4e0
add esp, 4
test eax, eax
je 0x11d11fad
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x258]
push ecx
push edx
push edi
push eax
push 0x13
mov ecx, 0x1212b560
call fcn.11dedd70
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 6
call fcn.11e92540
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 2
call fcn.11e92540
jmp 0x11d1200d
cmp dword [0x12133f80], ebp
je 0x11d11ff8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
push ecx
push esi
push 0x57e4
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_CopyFile__s___s_
push edx
push 4
call fcn.11ca5810
add esp, 0x18
lea eax, [esp + 0x3c]
push ebp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x11d1234c
mov edi, dword [esp + 0x258]
push edi
call fcn.11dda060
add esp, 4
lea ecx, [esp + 0x3c]
push 3
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [0x12133f80]
je 0x11d12369
test eax, eax
je 0x11d1205b
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push edi
push edx
push 0x580b
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_MoveFileEx__s___s_
push eax
push 4
call fcn.11ca5810
add esp, 0x18
mov eax, dword [esp + 0x260]
test eax, eax
je 0x11d1209d
push esi
call fcn.11dda060
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x11d1209d
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d1209d
mov ecx, dword [esp + 0x10]
push esi
push 0x5817
push str._CSafeDoc::SafeDiskMoveFile__Line:_d__Del_Src__s__Fail.
push ecx
push 4
call fcn.11ca5810
add esp, 0x14
mov dword [esp + 0x2c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24c], 1
call fcn.11e7f280
jmp 0x11d12403
cmp eax, ebp
je 0x11d120a5
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push 0x56b1
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_Fail_to_get_temp_name_for_File__s_
push eax
push 4
call fcn.11ca5810
add esp, 0x14
jmp 0x11d120a5
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d12102
mov ecx, dword [esp + 0x10]
push ebx
push 0x56bc
push str._CSafeDoc::SafeDiskMoveFile__Line:_d__File__s__is_INFO2
push ecx
push 4
call fcn.11ca5810
add esp, 0x14
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x11d12129
test ebp, ebp
je 0x11d1209d
push esi
call fcn.11dda060
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11d1209d
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d120a5
mov edx, dword [esp + 0x10]
push ebx
push esi
push 0x56c3
push str._CSafeDoc::SafeDiskMoveFile__Line:_d__Copy__s___s__Fail.
push edx
push 4
call fcn.11ca5810
add esp, 0x18
jmp 0x11d120a5
mov esi, dword [esp + 0x264]
cmp esi, ebp
je 0x11d12169
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
lea eax, [esp + 0x3c]
push eax
call fcn.11dda060
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11d120a5
cmp dword [0x12133f80], ebp
je 0x11d121a8
mov edx, dword [esp + 0x10]
push esi
push 0x5703
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_CreateFile__s__Fail.
push edx
push 4
call fcn.11ca5810
add esp, 0x14
mov esi, dword [esp + 0x264]
cmp esi, ebp
je 0x11d120a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x11d120a5
cmp dword [0x12133f80], ebp
je 0x11d121e6
mov eax, dword [esp + 0x10]
push esi
push 0x5714
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_CheckAccessRight__s__Fail.
push eax
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x264]
cmp eax, ebp
je 0x11d121f7
mov dword [eax], 5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x11d122c9
cmp dword [0x12133f80], ebp
je 0x11d12229
mov ecx, dword [esp + 0x10]
push eax
push 0x5727
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_No_Access_Right._Result:_lu
push ecx
push 4
call fcn.11ca5810
mov eax, dword [esp + 0x38]
add esp, 0x14
push ebp
push 2
push eax
push esi
mov ecx, 0x1212b158
call fcn.11dbfe50
mov eax, dword [esp + 0x264]
cmp eax, ebp
je 0x11d12249
mov dword [eax], 5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x11d122c9
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x28], 0
call fcn.11ee1ad0
mov esi, eax
mov eax, dword [0x12133f80]
add esp, 8
test eax, eax
je 0x11d12293
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push eax
push esi
push 0x5749
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_NtDecryptFileEx_Failed._Error:_lu_GetLastError:_lu
push ecx
push 4
call fcn.11ca5810
add esp, 0x18
mov eax, dword [esp + 0x264]
test eax, eax
je 0x11d122b1
cmp esi, 4
jne 0x11d122b1
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x11d122b1
mov dword [eax], 5
lea edx, [esp + 0x3c]
push edx
call fcn.11dda060
add esp, 4
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 4
call fcn.11e92540
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 2
call fcn.11e92540
jmp 0x11d120a5
lea ecx, [esp + 0x3c]
push ecx
call fcn.11dda060
add esp, 4
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11d120a5
lea eax, [esp + 0x3c]
push eax
call fcn.11dda060
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 6
call fcn.11e92540
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 2
call fcn.11e92540
jmp 0x11d120a5
lea edx, [esp + 0x3c]
push edx
call fcn.11dda060
add esp, 4
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11d120a5
test eax, eax
je 0x11d1238c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
push edi
push ecx
push 0x57fa
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_MoveFileEx__s___s__Fail.
push edx
push 4
call fcn.11ca5810
add esp, 0x18
lea eax, [esp + 0x3c]
push eax
call fcn.11dda060
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x11d123cf
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d123cf
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push edx
push 0x5805
push str._CSafeDoc::SafeDiskMoveFile__Line:_d_DeleteFileW__s__r_n
push eax
push 4
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x24c], 1
call fcn.11e7f280
jmp 0x11d12403
cmp dword [0x12133f80], ebp
je 0x11d12403
mov ecx, dword [esp + 0x10]
push 0x5698
push str._CSafeDoc::SafeDiskMoveFile__Line:_d__Path_is_null
push ecx
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x24c], 0
call fcn.11e7f280
lea ecx, [esp + 0x30]
mov dword [esp + 0x24c], 0xffffffff
call fcn.11e15fd0
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x240
ret 0x14