Function at 0x40295a
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov eax, 0x2728
call fcn.00433f20
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x26f0], rcx
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2678], rax
mov rax, qword [rbp + 0x2678]
mov rdx, qword [rbp + 0x26f0]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x2678]
add rax, rdx
mov byte [rax], 0
mov dword [rbp + 0x269c], 0
mov dword [rbp + 0x2624], 0
mov rax, qword [rbp + 0x2678]
lea rdx, [0x00439a05]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x2670], rax
cmp qword [rbp + 0x2670], 0
jne 0x402a1f
lea rax, [0x0044de40]
mov eax, dword [rax + 0x10]
lea edx, [rax + 1]
lea rax, [0x0044de40]
mov dword [rax + 0x10], edx
jmp 0x4034e5
mov qword [rbp + 0x2690], 0
mov rdx, rbp
mov rax, qword [rbp + 0x2678]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stat64]
call rax
cmp eax, 0xffffffff
je 0x402a50
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x2690], rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov edx, 0
mov rcx, rax
call fcn.00434690
mov dword [rbp + 0x266c], 4
mov dword [rbp + 0x2668], 4
mov eax, dword [rbp + 0x266c]
add eax, eax
cdqe
cmp qword [rbp + 0x2690], rax
jle 0x4034d6
mov eax, dword [rbp + 0x2668]
cdqe
mov rdx, qword [rbp + 0x2690]
sub rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x2668]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2670]
lea rax, [rbp + 0x2624]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x269c], eax
mov eax, dword [rbp + 0x266c]
cdqe
mov rdx, qword [rbp + 0x2690]
sub rdx, rax
mov eax, dword [rbp + 0x2668]
cdqe
sub rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x266c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2670]
lea rax, [rbp + 0x2620]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 1
jne 0x4034ae
mov eax, dword [rbp + 0x266c]
add eax, eax
mov edx, eax
mov eax, dword [rbp + 0x2620]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x2690], rax
jle 0x4034ae
mov eax, dword [rbp + 0x2620]
test eax, eax
je 0x4034ae
mov eax, dword [rbp + 0x2620]
mov edx, eax
mov rax, qword [rbp + 0x2690]
sub rax, rdx
mov rdx, rax
mov eax, dword [rbp + 0x266c]
cdqe
sub rdx, rax
mov eax, dword [rbp + 0x2668]
cdqe
sub rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x2620]
mov ecx, eax
mov rdx, qword [rbp + 0x2670]
lea rax, [rbp + 0x40]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x269c], eax
mov eax, dword [rbp + 0x2620]
mov edx, eax
mov rax, qword [rbp + 0x2690]
sub rax, rdx
mov rdx, rax
mov eax, dword [rbp + 0x266c]
add eax, eax
cdqe
sub rdx, rax
mov eax, dword [rbp + 0x2668]
cdqe
sub rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x266c]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2670]
lea rax, [rbp + 0x261c]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 1
jne 0x403484
mov edx, dword [rbp + 0x261c]
mov eax, dword [rbp + 0x2620]
add edx, eax
mov eax, dword [rbp + 0x266c]
add eax, eax
add eax, edx
mov eax, eax
cmp qword [rbp + 0x2690], rax
jle 0x403484
mov eax, dword [rbp + 0x261c]
test eax, eax
je 0x403484
mov edx, dword [rbp + 0x261c]
mov eax, dword [rbp + 0x2620]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x2690]
sub rax, rdx
mov rdx, rax
mov eax, dword [rbp + 0x266c]
add eax, eax
cdqe
sub rdx, rax
mov eax, dword [rbp + 0x2668]
cdqe
sub rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x261c]
mov ecx, eax
mov rdx, qword [rbp + 0x2670]
lea rax, [rbp + 0xa40]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
jle 0x403473
mov edx, dword [rbp + 0x261c]
mov eax, dword [rbp + 0x2620]
add edx, eax
mov eax, dword [rbp + 0x266c]
add eax, eax
add eax, edx
mov eax, eax
cmp qword [rbp + 0x2690], rax
jle 0x403473
mov edx, dword [rbp + 0x261c]
mov eax, dword [rbp + 0x2620]
add edx, eax
mov eax, dword [rbp + 0x266c]
add eax, eax
add edx, eax
mov eax, dword [rbp + 0x2668]
add eax, edx
mov eax, eax
sub qword [rbp + 0x2690], rax
lea rax, [0x0044de40]
mov eax, dword [rax + 8]
lea edx, [rax + 1]
lea rax, [0x0044de40]
mov dword [rax + 8], edx
mov dword [rbp + 0x2618], 0x20
lea rax, [0x00452380]
mov r8d, dword [rax]
mov r11d, 0xb
mov edx, dword [rbp + 0x261c]
lea r9, [rbp + 0x2618]
lea r10, [rbp - 0x20]
lea rcx, [rbp + 0xa40]
lea rax, [0x004523a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2614]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r11d
lea rax, str.Rhysida_0.3
mov qword [rsp + 0x20], rax
mov r8, r10
call fcn.0040d830
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x402e7e
lea rax, [0x00452380]
mov r8d, dword [rax]
mov r11d, 0xb
mov edx, dword [rbp + 0x261c]
lea r9, [rbp + 0x2618]
lea r10, [rbp - 0x20]
lea rcx, [rbp + 0xa40]
lea rax, [0x004523a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2614]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r11d
lea rax, str.Rhysida_0.3
mov qword [rsp + 0x20], rax
mov r8, r10
call fcn.0040d830
mov dword [rbp + 0x269c], eax
mov eax, dword [rbp + 0x2614]
test eax, eax
jne 0x402e9c
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x40345f
mov dword [rbp + 0x25fc], 0x10
lea rax, [0x00452380]
mov r8d, dword [rax]
mov r11d, 0xb
mov edx, dword [rbp + 0x2620]
lea r9, [rbp + 0x25fc]
lea r10, [rbp + 0x2600]
lea rcx, [rbp + 0x40]
lea rax, [0x004523a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2614]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r11d
lea rax, str.Rhysida_0.3
mov qword [rsp + 0x20], rax
mov r8, r10
call fcn.0040d830
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x402f87
lea rax, [0x00452380]
mov r8d, dword [rax]
mov r11d, 0xb
mov edx, dword [rbp + 0x2620]
lea r9, [rbp + 0x25fc]
lea r10, [rbp + 0x2600]
lea rcx, [rbp + 0x40]
lea rax, [0x004523a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2614]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r11d
lea rax, str.Rhysida_0.3
mov qword [rsp + 0x20], rax
mov r8, r10
call fcn.0040d830
mov dword [rbp + 0x269c], eax
mov eax, dword [rbp + 0x2614]
test eax, eax
jne 0x402fa5
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x40344b
lea rax, [0x0044de00]
mov eax, dword [rax]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x2600]
lea rcx, [rbp + 0x1440]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0xe
mov r9d, 0x20
mov ecx, eax
call fcn.0040b1d0
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x403005
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x403437
lea rdx, [rbp + 0x1440]
lea rax, [rbp + 0x2600]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.0040b110
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
jne 0x40326e
mov eax, dword [rbp + 0x2624]
cmp eax, 1
jne 0x40326e
mov rax, qword [rbp + 0x2690]
mov qword [rbp + 0x2660], rax
mov dword [rbp + 0x2684], 4
mov rax, qword [rbp + 0x2660]
shr rax, 2
mov qword [rbp + 0x2688], rax
mov dword [rbp + 0x2680], 0x100000
jmp 0x4030b3
cmp dword [rbp + 0x2684], 1
jle 0x4030ac
sub dword [rbp + 0x2684], 1
mov eax, dword [rbp + 0x2684]
movsxd rbx, eax
mov rax, qword [rbp + 0x2660]
mov edx, 0
div rbx
mov qword [rbp + 0x2688], rax
jmp 0x4030b3
sub dword [rbp + 0x2684], 1
cmp qword [rbp + 0x2688], 0
je 0x4030d3
cmp qword [rbp + 0x2688], 0xfffff
ja 0x4030d3
cmp dword [rbp + 0x2684], 0
jg 0x40307b
cmp dword [rbp + 0x2684], 0
je 0x4030e6
cmp qword [rbp + 0x2688], 0
jne 0x40310b
mov dword [rbp + 0x2684], 1
mov rax, qword [rbp + 0x2660]
mov qword [rbp + 0x2688], rax
mov rax, qword [rbp + 0x2660]
mov dword [rbp + 0x2680], eax
mov ecx, 0x100000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2658], rax
mov dword [rbp + 0x2698], 0
jmp 0x40324d
mov eax, dword [rbp + 0x2698]
cdqe
imul rax, qword [rbp + 0x2688]
mov rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov eax, dword [rbp + 0x2680]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2670]
mov rax, qword [rbp + 0x2658]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x2654], eax
mov eax, dword [rbp + 0x2680]
cdqe
cmp qword [rbp + 0x2690], rax
je 0x4031a1
cmp dword [rbp + 0x2654], 0
je 0x403246
lea r8, [rbp + 0x1440]
mov ecx, dword [rbp + 0x2654]
mov rdx, qword [rbp + 0x2658]
mov rax, qword [rbp + 0x2658]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call fcn.0040a710
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x4031e5
mov dword [rbp + 0x2698], 4
jmp 0x403232
mov eax, dword [rbp + 0x2698]
cdqe
imul rax, qword [rbp + 0x2688]
mov rdx, rax
mov rax, qword [rbp + 0x2670]
mov r8d, 0
mov rcx, rax
call fcn.00434690
mov edx, dword [rbp + 0x2654]
mov rcx, qword [rbp + 0x2670]
mov rax, qword [rbp + 0x2658]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x2658]
mov edx, 8
mov rcx, rax
call fcn.0040a640
add dword [rbp + 0x2698], 1
mov eax, dword [rbp + 0x2698]
cmp eax, dword [rbp + 0x2684]
jl 0x40312b
mov rax, qword [rbp + 0x2658]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x2678]
lea rdx, [0x00439a05]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x2670], rax
mov rax, qword [rbp + 0x2670]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__fileno]
call rax
mov ecx, eax
mov rax, qword [rbp + 0x2690]
mov rdx, rax
mov rax, qword [0x00438900]
call rax
mov dword [rbp + 0x269c], eax
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, dword [0x00438544]
sub edx, eax
mov eax, edx
add eax, 1
mov dword [rbp + 0x2650], eax
mov eax, dword [rbp + 0x2650]
mov rdx, rsp
mov rbx, rdx
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x2648], rdx
movsxd rdx, eax
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], 0
movsxd rdx, eax
mov r14, rdx
mov r15d, 0
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.00433f20
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x2640], rax
mov dword [rbp + 0x2698], 0
jmp 0x403391
mov eax, dword [rbp + 0x2698]
movsxd rdx, eax
mov rax, qword [rbp + 0x2678]
add rax, rdx
movzx ecx, byte [rax]
mov rdx, qword [rbp + 0x2640]
mov eax, dword [rbp + 0x2698]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2698], 1
mov eax, dword [rbp + 0x2650]
sub eax, 2
cmp dword [rbp + 0x2698], eax
jl 0x403362
mov eax, dword [rbp + 0x2650]
sub eax, 2
mov rdx, qword [rbp + 0x2640]
cdqe
mov byte [rdx + rax], 0
mov rdx, qword [rbp + 0x2640]
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_rename
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x40341f
mov eax, dword [rbp + 0x2650]
sub eax, 2
mov rdx, qword [rbp + 0x2640]
cdqe
mov byte [rdx + rax], 0x5f
mov eax, dword [rbp + 0x2650]
sub eax, 1
mov rdx, qword [rbp + 0x2640]
cdqe
mov byte [rdx + rax], 0
mov rdx, qword [rbp + 0x2640]
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [rbp + 0x1440]
mov rcx, rax
call fcn.0040a780
mov dword [rbp + 0x269c], eax
mov rsp, rbx
lea rax, [rbp + 0x1440]
mov edx, 0x11b8
mov rcx, rax
call fcn.0040a640
lea rax, [rbp + 0x2600]
mov edx, 0x10
mov rcx, rax
call fcn.0040a640
lea rax, [rbp - 0x20]
mov edx, 0x20
mov rcx, rax
call fcn.0040a640
nop
jmp 0x4034ac
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x4034ac
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
lea rax, [0x0044de40]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x0044de40]
mov dword [rax + 0xc], edx
jmp 0x4034e5
jmp 0x4034e5
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
lea rax, [0x0044de40]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x0044de40]
mov dword [rax + 0xc], edx
jmp 0x4034e5
mov rax, qword [rbp + 0x2670]
mov rcx, rax
call sub.msvcrt.dll_fclose
cmp dword [rbp + 0x269c], 0
je 0x403639
mov rax, rsp
mov rbx, rax
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, dword [0x00438544]
sub edx, eax
mov eax, edx
add eax, 1
mov dword [rbp + 0x263c], eax
mov eax, dword [rbp + 0x263c]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x2630], rdx
movsxd rdx, eax
mov r12, rdx
mov r13d, 0
movsxd rdx, eax
mov rsi, rdx
mov edi, 0
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.00433f20
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x2628], rax
mov dword [rbp + 0x2698], 0
jmp 0x4035a8
mov eax, dword [rbp + 0x2698]
movsxd rdx, eax
mov rax, qword [rbp + 0x2678]
add rax, rdx
movzx ecx, byte [rax]
mov rdx, qword [rbp + 0x2628]
mov eax, dword [rbp + 0x2698]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2698], 1
mov eax, dword [rbp + 0x263c]
sub eax, 2
cmp dword [rbp + 0x2698], eax
jl 0x403579
mov eax, dword [rbp + 0x263c]
sub eax, 2
mov rdx, qword [rbp + 0x2628]
cdqe
mov byte [rdx + rax], 0
mov rdx, qword [rbp + 0x2628]
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_rename
mov dword [rbp + 0x269c], eax
cmp dword [rbp + 0x269c], 0
je 0x403636
mov eax, dword [rbp + 0x263c]
sub eax, 2
mov rdx, qword [rbp + 0x2628]
cdqe
mov byte [rdx + rax], 0x5f
mov eax, dword [rbp + 0x263c]
sub eax, 1
mov rdx, qword [rbp + 0x2628]
cdqe
mov byte [rdx + rax], 0
mov rdx, qword [rbp + 0x2628]
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_rename
mov rsp, rbx
mov rax, qword [rbp + 0x2678]
mov rcx, rax
call sub.msvcrt.dll_free
nop
lea rsp, [rbp + 0x26a8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret