Function at 0x40e25c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push edi
mov dword [ebp - 0x10c], 0
call fcn.00412279
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00414370
add esp, 8
push 0x436598
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x40e347
push str.GetVolumeInformationA
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x40e33a
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x224], 0
push 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0x104
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [ebp - 0x114]
test eax, eax
je 0x40e33a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x11c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0xffffffff
jne 0x40e50c
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x40e50c
push str.GetFileInformationByHandle
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x40e4ff
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x338], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
push 0x4365e4
lea edx, [ebp - 0x108]
push edx
call fcn.004138f8
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.00411c6c
add esp, 4
test eax, eax
je 0x40e410
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffff
jne 0x40e410
mov dword [ebp - 0x33c], 0xffffffff
cmp dword [ebp - 0x33c], 0xffffffff
jne 0x40e497
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push 0x4365ec
lea ecx, [ebp - 0x334]
push ecx
call fcn.004138f8
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0
push 0x4365f4
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40e497
push 0
push 0x80000080
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffff
je 0x40e48d
mov dword [ebp - 0x338], 1
jmp 0x40e497
mov dword [ebp - 0x33c], 0xffffffff
cmp dword [ebp - 0x33c], 0xffffffff
je 0x40e4ff
mov dword [ebp - 0x370], 0
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x36c]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x33c]
push eax
call dword [ebp - 0x32c]
test eax, eax
je 0x40e4dc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x354]
mov dword [ecx], edx
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x338], 0
je 0x40e4ff
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x40e53c
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
test eax, eax
je 0x40e53c
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 3
jg 0x40e53c
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x1b5de6b6
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
je 0x40e566
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x40e566
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0x1b5de6b6
jne 0x40e564
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x40e599
mov edx, dword [ebp + 8]
push edx
call fcn.0040f32b
add esp, 4
cmp eax, 2
jne 0x40e590
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
push 0x30
call fcn.00412a9b
add esp, 8
mov dword [ebp - 0x10c], eax
jmp 0x40e599
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x1b5de6b6
mov eax, dword [ebp - 4]
push eax
call fcn.00412286
add esp, 4
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret