Function at 0x599898
Capabilities:
Delete file
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00403e18
lea eax, [ebp - 0x4c]
mov edx, dword [0x543578]
call fcn.00403e38
xor eax, eax
push ebp
push 0x59a089
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00506a54
mov esi, dword [eax + 0x19c]
mov byte [ebp - 0x15], 0
mov eax, dword [edi + 0x168]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 5], 0
je 0x599b93
mov dl, 1
mov eax, edi
call fcn.005990b8
test al, al
jne 0x599913
mov byte [ebp - 6], 1
jmp 0x59a048
cmp byte [edi + 0x45c], 0
je 0x599962
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.00565578
mov eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
mov edx, dword [0x66e8a8]
mov edx, dword [edx + 0x22]
mov ecx, dword [0x66f35c]
mov edx, dword [ecx + edx*4]
call fcn.00403a24
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 4]
pop eax
call fcn.0065512c
mov eax, dword [0x66e8a8]
mov eax, dword [eax + 0x22]
call fcn.00539f84
mov dword [esi + 0x60], eax
jmp 0x5999bc
cmp byte [edi + 0x432], 0
jne 0x5999bc
mov eax, dword [edi + 0x168]
call fcn.00539ff8
test al, al
je 0x59998a
mov eax, dword [edi + 0x168]
call fcn.00539f84
mov dword [esi + 0x60], eax
jmp 0x5999bc
mov eax, dword [esi + 0x60]
call fcn.00539fa8
mov edx, dword [0x66f35c]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x54]
call fcn.00403a24
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0065512c
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0065530c
cmp dword [ebp - 0x50], 0
jne 0x5999da
lea eax, [ebp - 4]
mov edx, 0x59a0a0
call fcn.00403ab4
cmp byte [edi + 0x427], 0
je 0x599a08
mov eax, dword [0x66ebf8]
test byte [eax], 2
je 0x599a08
lea eax, [ebp - 0x50]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.005656b8
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.004038bc
mov eax, dword [0x66e8a8]
test byte [eax + 9], 0x80
jne 0x599a36
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.006552dc
mov ecx, dword [ebp - 0x50]
mov eax, dword [0x66fc80]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 8]
lea eax, [ebp - 4]
call fcn.00403b14
lea eax, [esi + 0x38]
mov edx, dword [ebp - 4]
call fcn.004038bc
lea eax, [esi + 0x34]
mov edx, dword [0x66f31c]
mov edx, dword [edx]
call fcn.00403438
mov eax, dword [0x66eb38]
mov edx, dword [edi + 0x160]
call fcn.004038bc
mov eax, dword [0x66eb38]
add eax, 4
mov edx, dword [edi + 0x178]
call fcn.004032c8
cmp byte [edi + 0x427], 0
jne 0x599a8d
cmp byte [edi + 0x43c], 0
jne 0x599a8d
mov byte [esi + 0x86], 1
mov byte [esi + 0x56], 2
cmp byte [edi + 0x3f6], 0
jne 0x599ac4
cmp byte [edi + 0x3f5], 0
jne 0x599ac4
cmp byte [edi + 0x43c], 0
jne 0x599ac4
cmp byte [edi + 0x45c], 0
jne 0x599ac4
mov eax, dword [edi + 0x160]
call fcn.00654ea8
test al, al
jne 0x599ac8
xor eax, eax
jmp 0x599aca
mov al, 1
mov byte [esi + 0x84], al
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x599af5
mov byte [esi + 0x84], 0
mov byte [ebp - 6], 1
mov eax, dword [0x66eb38]
call fcn.00403880
jmp 0x59a048
lea edx, [ebp - 4]
mov eax, esi
call fcn.00630690
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.00655078
mov ebx, eax
xor bl, 1
mov al, byte [esi + 0x84]
and al, bl
mov byte [ebp - 0x15], al
mov byte [esi + 0x84], 0
mov eax, dword [esi + 0x60]
call fcn.00539fa8
mov dword [ebp - 0x14], eax
test bl, bl
je 0x599b53
mov eax, dword [ebp - 4]
call fcn.00539cd4
test al, al
je 0x599b93
mov eax, dword [0x66fd40]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.0062001c
jmp 0x599a74
cmp byte [edi + 0x3f5], 0
je 0x599b73
mov eax, dword [0x66f400]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.0062001c
jmp 0x599a74
cmp byte [edi + 0x3f6], 0
je 0x599b93
mov eax, dword [0x670138]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.0061ff68
jmp 0x599a74
cmp byte [ebp - 0x15], 0
je 0x599c70
cmp byte [edi + 0x38], 0
jne 0x599c70
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x168]
jne 0x599c70
mov eax, edi
call fcn.005b9b50
push 3
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x599c2c
mov eax, dword [0x66fe80]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.0065068c
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, edi
call fcn.00506a5c
mov eax, dword [0x66f364]
mov byte [eax + 0xf], 1
mov eax, dword [0x66f364]
mov byte [eax + 0x10], 1
mov eax, dword [0x66fe80]
mov eax, dword [eax]
mov edx, dword [edi + 0x160]
call fcn.006189dc
mov eax, dword [0x670050]
or dword [eax], 0x40
mov byte [ebp - 6], 0
jmp 0x599c3d
mov dl, 3
mov eax, dword [edi + 0x160]
call fcn.0062016c
mov byte [ebp - 6], 1
mov eax, dword [edi + 0x160]
call fcn.0061caec
test al, al
jne 0x59a030
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.00658f04
mov dword [edi + 0x164], eax
jmp 0x59a030
cmp dword [ebp - 0x14], 6
jne 0x599c8c
xor edx, edx
mov eax, edi
call fcn.0059914c
test al, al
jne 0x599c8c
mov byte [ebp - 6], 1
jmp 0x59a030
cmp byte [0x66a86c], 0
je 0x599d10
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, edi
call fcn.005b9a48
test al, al
je 0x599d10
mov byte [edi + 0x432], 1
mov eax, dword [0x66f264]
mov eax, dword [eax + 4]
call fcn.00539f84
mov dword [esi + 0x60], eax
lea eax, [ebp - 0x54]
mov edx, dword [0x66f264]
mov edx, dword [edx + 4]
mov ecx, dword [0x66f35c]
mov edx, dword [ecx + edx*4]
call fcn.00403a24
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0065512c
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, edi
call fcn.00599898
mov byte [ebp - 6], al
mov byte [edi + 0x432], 0
cmp byte [ebp - 6], 1
jne 0x59a030
mov byte [edi + 0x431], 0
jmp 0x59a030
cmp byte [0x6733f9], 0
jne 0x599d42
mov eax, dword [ebp - 4]
call fcn.00654ea8
test al, al
je 0x599d42
lea edx, [ebp - 4]
mov cl, byte [0x59a0a4]
mov eax, edi
call fcn.00544534
test al, al
jne 0x599d42
mov byte [ebp - 6], 1
jmp 0x59a030
cmp dword [ebp - 0x14], 4
sete al
and al, byte [ebp - 5]
je 0x599da5
cmp dword [edi + 0x168], 4
jne 0x599d60
cmp byte [edi + 0x427], 0
jne 0x599da5
lea eax, [edi + 0x178]
call fcn.004d2870
test al, al
je 0x599d92
call fcn.004306f4
lea ecx, [ebp - 0x58]
mov edx, dword [edi + 0x178]
call fcn.004300f4
mov edx, dword [ebp - 0x58]
lea eax, [edi + 0x178]
call fcn.004032c8
jmp 0x599da5
mov byte [ebp - 6], 1
mov eax, dword [0x66eb38]
call fcn.00403880
jmp 0x59a048
mov ebx, dword [edi + 0x164]
test ebx, ebx
je 0x599dc1
mov eax, ebx
call fcn.0061cc70
test al, al
jne 0x599dc1
mov eax, edi
call fcn.005b9b50
mov eax, dword [edi + 0x164]
mov dword [ebp - 0x10], eax
mov edx, dword [edi + 0x160]
mov eax, dword [ebp - 4]
call fcn.00655078
mov ebx, eax
xor bl, 1
cmp dword [edi + 0x164], 0
sete al
or al, bl
je 0x599e2a
mov eax, dword [ebp - 4]
call fcn.00658f24
mov esi, eax
mov dword [edi + 0x164], esi
inc esi
jne 0x599e2a
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0062016c
cmp ax, 2
jne 0x599deb
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
mov byte [ebp - 6], 2
mov eax, dword [0x66eb38]
call fcn.00403880
jmp 0x59a048
lea eax, [ebp - 0xc]
mov edx, dword [edi + 0x160]
call fcn.004038bc
lea eax, [edi + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x78]
mov eax, edi
call fcn.005c5b44
push edi
lea esi, [ebp - 0x78]
lea edi, [ebp - 0x48]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0x16c]
mov dword [ebp - 0x24], eax
mov al, byte [edi + 0x170]
mov byte [ebp - 0x4b], al
mov al, byte [0x59a0a8]
mov byte [ebp - 0x4a], al
cmp byte [edi + 0x45c], 0
je 0x599e90
or byte [ebp - 0x4a], 1
cmp byte [ebp - 5], 0
je 0x599ea2
mov dword [edi + 0x1cc], 1
jmp 0x599ea8
inc dword [edi + 0x1cc]
lea edx, [ebp - 0x4c]
mov eax, edi
call fcn.005b944c
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x599fec
cmp byte [0x6733f9], 0
je 0x599ed4
mov eax, edi
call fcn.005b9b50
jmp 0x59a020
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 0x164]
je 0x599efb
cmp dword [ebp - 0x10], 0
je 0x599efb
test bl, bl
jne 0x599ef2
cmp dword [edi + 0x168], 2
je 0x599efb
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x15], 0
je 0x599f0a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, edi
call fcn.005f894c
mov byte [edi + 0x3f5], 0
mov byte [edi + 0x3f6], 0
push 0
mov eax, dword [edi + 0x164]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [edi + 0x1b8], eax
call fcn.00656138
fstp qword [edi + 0x1a0]
wait
mov eax, dword [edi + 0x1a0]
mov dword [edi + 0x1a8], eax
mov eax, dword [edi + 0x1a4]
mov dword [edi + 0x1ac], eax
mov eax, edi
call fcn.005b9b50
cmp byte [edi + 0x45c], 0
jne 0x599f91
mov eax, dword [edi + 0x160]
call fcn.0061caec
test al, al
jne 0x599f91
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [edi + 0x160]
call fcn.00658f04
mov dword [edi + 0x164], eax
cmp byte [edi + 0x45c], 0
je 0x599fb3
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
mov eax, dword [0x66e8a8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x22], edx
mov eax, dword [edi + 0x174]
test eax, eax
je 0x59a020
call fcn.004617f8
push 0x401
push 0
push 0
mov eax, dword [0x66fb14]
mov eax, dword [eax]
push eax
call sub.user32.dll_RedrawWindow
mov eax, dword [0x66f364]
mov byte [eax + 0xf], 1
mov eax, dword [0x66f364]
mov byte [eax + 0x10], 1
jmp 0x59a020
mov eax, dword [edi + 0x164]
cmp eax, dword [ebp - 0x10]
je 0x59a020
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [edi + 0x160]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x164], eax
lea eax, [edi + 0x160]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
cmp byte [0x6733f9], 0
jne 0x59a030
mov eax, edi
call fcn.00506a5c
mov eax, dword [0x66eb38]
call fcn.00403880
mov eax, dword [0x66f364]
mov byte [eax + 0x11], 1
call fcn.00506b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a090
lea eax, [ebp - 0x58]
call fcn.00403274
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x4c]
mov edx, dword [0x543578]
call fcn.00403f00
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret