Function at 0x100fe55
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x984
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x940], eax
push esi
push edi
lea eax, [ebx + 0x44]
mov dword [ebp - 0x91c], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x93c], esi
lea edi, [ebp - 0x938]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x92c], esi
lea edi, [ebp - 0x928]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x980]
push esi
push eax
mov dword [ebp - 0x920], ecx
mov dword [ebp - 0x984], esi
call sub.msvcrt.dll_memset
push 0x158
call fcn.0101b56a
add esp, 0x10
cmp eax, esi
je 0x100feef
push dword [ebp - 0x918]
mov ecx, eax
push dword [ebp - 0x91c]
call fcn.0100b741
mov esi, eax
test esi, esi
jne 0x100fefd
mov edi, 0x8007000e
jmp 0x1010520
mov ecx, dword [ebp - 0x920]
push esi
mov dword [esi], ebx
call fcn.0100fbe3
mov edi, eax
test edi, edi
jge 0x100ff46
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
movzx ecx, di
push ecx
push 0x10022b4
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010062be
jmp 0x1010517
cmp dword [ebx + 0x14], 0
je 0x101004a
mov ecx, dword [ebp - 0x920]
push 0x1002b30
push 0x1001bc4
push dword [ebp - 0x91c]
push dword [ebp - 0x918]
call fcn.0100b945
mov edi, eax
test edi, edi
jge 0x100ff9e
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
movzx ecx, di
push ecx
push 0x10022b4
push 0xb
jmp 0x100ff36
cmp edi, 1
jne 0x1010515
push 0x100
lea eax, [ebp - 0x914]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x100ffee
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0xc
jmp 0x100ff36
mov ecx, dword [ebp - 0x920]
lea eax, [ebp - 0x914]
push eax
push 0x1001bac
push dword [ebp - 0x91c]
push dword [ebp - 0x918]
call fcn.0100b945
mov edi, eax
test edi, edi
jge 0x1010041
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
movzx ecx, di
push ecx
push 0x10022b4
push 0xd
jmp 0x100ff36
cmp edi, 1
jne 0x1010515
xor eax, eax
cmp dword [ebx + 0x20], eax
jne 0x101005a
cmp dword [ebx + 0x14], eax
je 0x1010157
mov dword [ebp - 0x984], 0x1002ba8
mov ecx, dword [esi + 0x44]
mov dword [ebp - 0x978], ecx
mov ecx, dword [esi + 0x4c]
mov dword [ebp - 0x974], ecx
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x970], ecx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x94c], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x948], ecx
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x97c], ecx
mov ecx, dword [esi + 0x34]
push eax
mov dword [ebp - 0x980], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], 0x1002b30
mov eax, dword [esi + 8]
mov dword [ebp - 0x95c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x958], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x954], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x950], eax
xor eax, eax
cmp dword [ebx + 0x1c], eax
sete al
cmp dword [ebx + 4], 0
mov dword [ebp - 0x960], eax
je 0x1010112
push dword [esi + 0x44]
call fcn.01011f68
test eax, eax
jne 0x1010112
mov dword [ebp - 0x944], 1
mov dword [ebp - 0x96c], fcn.01011e58
lea eax, [ebp - 0x984]
push eax
call fcn.0102252f
test eax, eax
je 0x1010157
jle 0x101012e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0xe
jmp 0x100ff36
cmp dword [ebx + 0x14], 0
je 0x10101b7
mov ecx, dword [ebp - 0x920]
push 0x1002b90
push 0x1001bb8
push dword [ebp - 0x91c]
push dword [ebp - 0x918]
call fcn.0100b945
mov edi, eax
test edi, edi
jge 0x10101ae
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
movzx ecx, di
push ecx
push 0x10022b4
push 0xf
jmp 0x100ff36
cmp edi, 1
jne 0x1010515
push dword [ebp - 0x91c]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010066e4
mov edi, eax
test edi, edi
jge 0x10101fb
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0x10
jmp 0x100ff36
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, 0x1001ba0
test eax, eax
je 0x101021f
push edi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101026c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
test eax, eax
jne 0x101026c
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010262
test byte [eax + 0x1c], 1
je 0x1010262
push 0x10022b4
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
mov edi, 0x80004005
jmp 0x1010517
xor eax, eax
lea edi, [ebp - 0x93c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or dword [ebp - 0x930], 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and dword [ebp - 0x918], 0
mov dword [ebp - 0x93c], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x934], eax
xor eax, eax
cmp dword [ebx + 0x20], 0
lea edi, [ebp - 0x92c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x938], 0x1002b80
stosd dword es:[edi], eax
je 0x101031b
mov eax, dword [esi + 0x34]
push 0x100
lea ecx, [ebp - 0x30c]
push ecx
push eax
push eax
push 0x1002ba8
push 0x1002b90
call fcn.0100d45a
mov edi, eax
test edi, edi
jge 0x1010305
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0x12
jmp 0x100ff36
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x918], 1
cmp dword [ebx + 0x18], 0
je 0x1010386
mov eax, dword [esi + 0x34]
push 0x100
lea ecx, [ebp - 0x50c]
push ecx
push eax
push eax
lea eax, [esi + 0x54]
push eax
push 0x1002b60
call fcn.0100d45a
mov edi, eax
test edi, edi
jge 0x101036d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0x13
jmp 0x100ff36
mov ecx, dword [ebp - 0x918]
inc dword [ebp - 0x918]
lea eax, [ebp - 0x50c]
mov dword [ebp + ecx*4 - 0x92c], eax
cmp dword [ebx + 0x1c], 0
je 0x10103f2
mov eax, dword [esi + 0x34]
push 0x100
lea ecx, [ebp - 0x40c]
push ecx
push eax
push eax
push 0x1002b50
push 0x1002b30
call fcn.0100d45a
mov edi, eax
test edi, edi
jge 0x10103d9
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010517
test byte [eax + 0x1c], 1
je 0x1010517
push edi
push 0x10022b4
push 0x14
jmp 0x100ff36
mov ecx, dword [ebp - 0x918]
inc dword [ebp - 0x918]
lea eax, [ebp - 0x40c]
mov dword [ebp + ecx*4 - 0x92c], eax
cmp dword [ebx + 4], 0
je 0x1010405
mov eax, dword [esi + 0x44]
push eax
add eax, 2
push eax
call fcn.01011e58
push dword [ebp - 0x918]
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x93c]
push eax
call fcn.01022c12
mov edi, eax
test edi, edi
je 0x1010462
mov eax, dword [section..data]
cmp eax, section..data
je 0x1010449
test byte [eax + 0x1c], 1
je 0x1010449
push edi
push 0x10022b4
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010062be
test edi, edi
jle 0x1010517
and edi, 0xffff
or edi, 0x80070000
jmp 0x1010517
push 0x1002b80
push dword [esi + 0x34]
lea eax, [ebp - 0x714]
push 0x100257c
push 0x208
push eax
call fcn.010067aa
mov edi, eax
add esp, 0x14
test edi, edi
jl 0x1010517
push 3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10104f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10104b8
mov eax, 0x54f
test eax, eax
mov edi, eax
jle 0x10104c8
and edi, 0xffff
or edi, 0x80070000
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1010517
test byte [ecx + 0x1c], 1
je 0x1010517
push eax
push 0x10022b4
push 0x16
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010062be
jmp 0x1010517
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x940]
call fcn.010066e4
push dword [ebp - 0x91c]
lea eax, [esi + 8]
push eax
call fcn.01009f52
xor edi, edi
push 1
mov ecx, esi
call fcn.0100b91f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 0x10