Function at 0x409830
Capabilities:
Copy file
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x260
mov eax, dword [0x43200c]
mov esi, edx
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [edx + 4]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebx, ebx
test eax, eax
jne 0x409ce6
mov dword [ebp - 0x268], esi
xor esi, esi
lea ebx, [ebp - 0x234]
xor eax, eax
mov edx, edi
dec esi
mov dword [ebx], 2
mov ecx, ebx
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
push eax
call fcn.00409340
add esp, 4
mov edx, dword [ebx + 4]
cmp edx, esi
je 0x409b4c
mov eax, edx
and eax, 0x10
je 0x409b4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x264], edx
add eax, 0x80
push eax
mov ebx, dword [ebp - 0x268]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409bef
mov dword [ebp - 0x260], edi
lea ecx, [ebp - 0x248]
xor edi, edi
mov edx, ebx
mov dword [ecx], 2
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
push edi
call fcn.00409340
add esp, 4
mov eax, 0x20a
push eax
call fcn.0040d784
add esp, 4
mov ebx, eax
mov ecx, 0x208
add eax, 2
push ecx
push edi
push eax
call fcn.0040fdd0
add esp, 0xc
mov eax, 0x20a
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], edi
mov word [ebx], di
push eax
call fcn.0040d784
add esp, 4
mov ebx, eax
mov ecx, 0x208
add eax, 2
push ecx
push edi
push eax
call fcn.0040fdd0
add esp, 0xc
cmp dword [ebp - 0x22c], esi
mov dword [ebp - 0x254], ebx
mov word [ebx], di
mov ebx, 0x80004005
mov dword [ebp - 0x258], edi
je 0x409c08
cmp dword [ebp - 0x240], 0xffffffff
mov esi, dword [ebp - 0x260]
je 0x409c0e
mov eax, dword [ebp - 0x244]
test al, 0x10
je 0x409c0e
cmp eax, 0xffffffff
je 0x409c0e
bt eax, 0xa
jb 0x409c0e
mov ecx, dword [ebp - 0x248]
cmp ecx, 1
je 0x409c0e
cmp eax, 0xffffffff
je 0x409c0e
cmp ecx, 2
je 0x409c0e
xor ebx, ebx
bt dword [ebp - 0x264], 0xa
jb 0x409c0e
mov eax, dword [ebp - 0x234]
dec eax
cmp eax, 2
jb 0x409c0e
lea edi, [ebp - 0x220]
mov ecx, edi
push dword [esi + 4]
call fcn.0040c0d0
call fcn.00413fcc
mov dword [eax], 0
push edi
call fcn.0040c130
add esp, 4
test eax, eax
je 0x409cfd
mov edx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x224]
mov ebx, eax
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x26c], ecx
push 0x42d062
push ebx
call fcn.004166a7
add esp, 8
test eax, eax
je 0x409a71
push 0x42d060
push ebx
call fcn.004166a7
add esp, 8
test eax, eax
je 0x409a71
cmp dword [ebp - 0x264], 0
je 0x409a85
push dword [ebp - 0x26c]
push ebx
call fcn.004166a7
add esp, 8
test eax, eax
jne 0x409a85
push edi
call fcn.0040c130
add esp, 4
mov ebx, eax
test eax, eax
jne 0x409a31
jmp 0x409d07
push ebx
push dword [esi + 4]
push 0x42cb46
push 0x105
lea eax, [ebp - 0x250]
push eax
call fcn.004096b0
add esp, 0x14
cmp dword [ebp - 0x250], 0
jne 0x409ac3
mov eax, dword [ebp - 0x25c]
mov ecx, 0x8007006f
test eax, eax
cmovns eax, ecx
mov dword [ebp - 0x25c], eax
jmp 0x409a71
push ebx
mov eax, dword [ebp - 0x268]
push dword [eax + 4]
push 0x42cb46
push 0x105
lea eax, [ebp - 0x258]
push eax
call fcn.004096b0
add esp, 0x14
cmp dword [ebp - 0x258], 0
je 0x409b2b
lea ecx, [ebp - 0x250]
lea edx, [ebp - 0x258]
push dword [ebp + 8]
call fcn.00409830
add esp, 4
mov edx, dword [ebp - 0x25c]
mov ecx, eax
test edx, edx
cmovs ecx, edx
test eax, eax
cmovs edx, ecx
mov dword [ebp - 0x25c], edx
call fcn.00413fcc
mov dword [eax], 0
jmp 0x409b41
mov eax, dword [ebp - 0x25c]
mov ecx, 0x8007006f
test eax, eax
cmovns eax, ecx
mov dword [ebp - 0x25c], eax
mov esi, dword [ebp - 0x260]
jmp 0x409a71
mov eax, dword [ebp - 0x22c]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409b65
push eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
cmp edx, 0xffffffff
mov dword [ebp - 0x22c], 0xffffffff
setne al
xor ebx, ebx
cmp edx, 0xffffffff
je 0x409bc1
mov ecx, dword [ebp - 0x234]
cmp ecx, 2
je 0x409bc1
mov esi, edx
shr edx, 0xa
and dl, al
jne 0x409bc1
cmp ecx, 1
je 0x409bc1
push 1
mov eax, dword [ebp - 0x268]
push dword [eax + 4]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x409bc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x409cb4
push 4
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x409cb4
test eax, eax
jne 0x409cb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x409cb4
mov esi, dword [ebp - 0x260]
lea edx, [ebp - 0x234]
mov ecx, esi
call fcn.004096f0
test eax, eax
jns 0x409c48
push 4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x409c48
test eax, eax
jne 0x409c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x254], 0
test eax, eax
je 0x409c65
push eax
call fcn.0040d78d
add esp, 4
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x24c], 0
test eax, eax
je 0x409c82
push eax
call fcn.0040d78d
add esp, 4
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x238], 0
test eax, eax
je 0x409c9f
push eax
call fcn.0040d78d
add esp, 4
mov eax, dword [ebp - 0x240]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409cb4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x224], 0
test eax, eax
je 0x409cd1
push eax
call fcn.0040d78d
add esp, 4
mov eax, dword [ebp - 0x22c]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x409ce6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, ebx
add esp, 0x260
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x25c], 0
call fcn.00413fcc
cmp dword [eax], 0
mov eax, dword [ebp - 0x25c]
mov ebx, 0x80004005
cmove ebx, eax
test eax, eax
cmovs ebx, eax
mov eax, dword [ebp - 0x220]
cmp eax, 0xffffffff
je 0x409c0e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x409c0e