Function at 0x6570b4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41c5fc]
call fcn.0040b56c
xor eax, eax
push ebp
push 0x657355
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x28c]
mov ecx, 0x657370
call fcn.0040b0cc
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x270]
mov edx, 0x10
call fcn.00425a5c
mov ebx, eax
test ebx, ebx
jne 0x657295
xor eax, eax
push ebp
push 0x65728e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x657275
mov eax, dword [ebp - 0x25c]
mov edx, 0x657384
call fcn.0040b204
je 0x657260
mov eax, dword [ebp - 0x25c]
mov edx, 0x657394
call fcn.0040b204
je 0x657260
test byte [ebp - 0x260], 0x10
je 0x657260
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x274], eax
mov esi, dword [ebp - 0x274]
test esi, esi
je 0x657193
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0x290]
mov ecx, 0x6573a8
mov edx, dword [ebp - 0x25c]
call fcn.0040b0cc
mov eax, dword [ebp - 0x290]
lea ecx, [esi + 1]
mov edx, dword [ebp + 8]
add edx, 0xfffffffc
call fcn.0040b2e0
mov eax, dword [ebp + 8]
push eax
call fcn.006570b4
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x278], eax
mov edi, dword [ebp - 0x278]
test edi, edi
je 0x6571e2
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x657214
mov eax, dword [ebp - 0x280]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
je 0x657246
mov eax, dword [ebp - 0x288]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x288], eax
mov edx, edi
sub edx, dword [ebp - 0x280]
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov ecx, dword [ebp - 0x288]
call fcn.0040b284
lea eax, [ebp - 0x270]
call fcn.00425aac
mov ebx, eax
test ebx, ebx
je 0x65713f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657295
lea eax, [ebp - 0x270]
call fcn.00425ad0
ret
lea edx, [ebp - 0x294]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c7a0
mov edx, dword [ebp - 0x294]
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.0040a7e4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 1
xor edx, edx
call fcn.004258e0
mov eax, dword [0x67057c]
movzx eax, byte [eax + 0x230b]
sub al, 1
jb 0x6572da
je 0x657300
jmp 0x657315
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00426110
test al, al
jne 0x657315
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040ae60
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x657315
push 4
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040ae60
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65735c
lea eax, [ebp - 0x294]
call fcn.0040a3bc
lea eax, [ebp - 0x290]
call fcn.0040a3bc
lea eax, [ebp - 0x28c]
call fcn.0040a3bc
lea eax, [ebp - 0x270]
mov edx, dword [0x41c5fc]
call fcn.0040b648
ret