Function at 0x41d7d0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5995e3
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x5da084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x320], esi
mov edx, esi
mov dword [ebp - 0x23c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x238], 0
movups xmmword [ebp - 0x24c], xmm0
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41d830
sub edx, ecx
lea ecx, [ebp - 0x24c]
sar edx, 1
push edx
push esi
call fcn.0040b8b0
mov dword [ebp - 4], 0
call fcn.00431670
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x23
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
test al, al
je 0x41d87e
push str.CoreSyncExtensionCoreSync_x64.dll
jmp 0x41d883
push str.CoreSyncExtensionCoreSync_x86.dll
call fcn.0040b8b0
lea ecx, [ebp - 0x24c]
call fcn.00431750
add esp, 0x18
test al, al
je 0x41e772
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41d98d
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41d98d
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x234]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 1
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x66
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.DLL_Path_is:
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41d937
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x220]
cmp ecx, 0x10
jb 0x41d98d
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41d983
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7d7
push ecx
push edx
call fcn.0056ebaf
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00431500
mov ecx, dword [0x5dfbe0]
test al, al
jne 0x41da1e
test ecx, ecx
je 0x41da17
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41da17
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x6a
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.DLL_does_not_exist__skipping_move_mark_for_delete.
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov al, 1
jmp 0x41e774
test ecx, ecx
je 0x41da97
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41da97
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x6e
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.DLL_Exists__moving_to_temp_location.
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0
call fcn.00430bd0
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00570cd0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
js 0x41e6f5
xorps xmm0, xmm0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], 0
movups xmmword [ebp - 0x234], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41daf0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b8b0
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
xorps xmm0, xmm0
push 0x11
movups xmmword [ecx], xmm0
push str.CoreSync.dll_TEMP
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b8b0
lea ecx, [ebp - 0x234]
call fcn.00431750
add esp, 0x18
test al, al
je 0x41e066
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41dc40
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41dc40
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x264]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 6
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x76
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Temp_DLL_Path_is:
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41dbea
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x41dc40
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41dc36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7dc
push ecx
push edx
call fcn.0056ebaf
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.00431500
test al, al
je 0x41de11
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41dcd4
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41dcd4
lea eax, [ebp - 0x31c]
push ecx
mov ecx, eax
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x79
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Temp_file_already_exists._Trying_alternate_name.
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 5
call fcn.00430bd0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 1
movups xmmword [ecx], xmm0
push 0x5bd528
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b8b0
lea ecx, [ebp - 0x234]
call fcn.00431750
add esp, 0x18
test al, al
je 0x41e066
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41ddfe
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41ddfe
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x264]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 9
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x7b
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Temp_DLL_Path_is:
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41dda8
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x41ddfe
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ddf4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7d7
push ecx
push edx
call fcn.0056ebaf
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.00431500
test al, al
jne 0x41dc53
cmp dword [ebp - 0x238], 8
lea ecx, [ebp - 0x24c]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x234]
cmovae ecx, dword [ebp - 0x24c]
cmp dword [ebp - 0x220], 8
push 3
cmovae eax, dword [ebp - 0x234]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41defc
lea ecx, [ebp - 0x24c]
call fcn.00431500
test al, al
je 0x41e48f
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push 4
cmovae eax, dword [ebp - 0x234]
push 0
push eax
call esi
test eax, eax
jne 0x41df87
call edi
mov ecx, dword [0x5dfbe0]
mov esi, eax
test ecx, ecx
je 0x41df87
mov edx, dword [ecx]
push 2
mov edx, dword [edx + 0x10]
call edx
test al, al
je 0x41df87
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 2
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x8b
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0xc
mov edx, str.Error___unable_to_mark_Dll_for_delete_on_reboot:
jmp 0x41df65
call edi
mov ecx, dword [0x5dfbe0]
mov esi, eax
test ecx, ecx
je 0x41df87
mov edx, dword [ecx]
push 2
mov edx, dword [edx + 0x10]
call edx
test al, al
je 0x41df87
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 2
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x84
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0xb
mov edx, str.Error___unable_to_move_DLL:
push esi
lea ecx, [ebp - 0x31c]
call fcn.00416960
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 5
call fcn.00430bd0
mov esi, dword [ebp - 0x320]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41df92
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x234]
call fcn.0040b270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x24
movups xmmword [ecx], xmm0
push str.CoreSyncExtensionCoreSync.dll_TEMP
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b8b0
lea ecx, [ebp - 0x234]
call fcn.00431750
mov ecx, dword [0x5dfbe0]
add esp, 0x18
test al, al
jne 0x41e0a9
test ecx, ecx
je 0x41e066
mov eax, dword [ecx]
push 2
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e066
lea eax, [ebp - 0x31c]
push ecx
mov ecx, eax
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 2
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x91
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0xd
mov edx, str.Error___unable_to_append_path
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov ecx, dword [ebp - 0x220]
cmp ecx, 8
jb 0x41e772
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e6e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7e1
jmp 0x41e6e9
test ecx, ecx
je 0x41e192
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e192
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x264]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0xe
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x94
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.InPlace_Move_Path_is:
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41e13c
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x41e192
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41e188
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7e6
push ecx
push edx
call fcn.0056ebaf
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.00431500
test al, al
je 0x41e363
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41e226
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e226
lea eax, [ebp - 0x31c]
push ecx
mov ecx, eax
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x96
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.InPlace_Temp_file_already_exists._Trying_alternate_name.
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 5
call fcn.00430bd0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 1
movups xmmword [ecx], xmm0
push 0x5bd528
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b8b0
lea ecx, [ebp - 0x234]
call fcn.00431750
mov ecx, dword [0x5dfbe0]
add esp, 0x18
test al, al
je 0x41e426
test ecx, ecx
je 0x41e350
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e350
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x264]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x12
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x9b
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.InPlace_Temp_DLL_Path_is:
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41e2fa
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x41e350
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41e346
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7d7
push ecx
push edx
call fcn.0056ebaf
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.00431500
test al, al
jne 0x41e1a5
cmp dword [ebp - 0x238], 8
lea ecx, [ebp - 0x24c]
lea eax, [ebp - 0x234]
cmovae ecx, dword [ebp - 0x24c]
cmp dword [ebp - 0x220], 8
push 1
cmovae eax, dword [ebp - 0x234]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41e48f
call edi
mov ecx, dword [0x5dfbe0]
mov esi, eax
test ecx, ecx
je 0x41e066
mov edx, dword [ecx]
push 1
mov edx, dword [edx + 0x10]
call edx
test al, al
je 0x41e066
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0xa1
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0x14
mov edx, str.Error___unable_to_move_DLL_to_Inplace_path:
push esi
lea ecx, [ebp - 0x31c]
call fcn.00416960
mov ecx, eax
call fcn.00423f60
jmp 0x41e05b
test ecx, ecx
je 0x41e066
mov eax, dword [ecx]
push 2
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e066
lea eax, [ebp - 0x31c]
push ecx
mov ecx, eax
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 2
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0x98
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0x11
jmp 0x41e04b
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41e57e
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e57e
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x264]
call fcn.00430e10
mov esi, eax
push ecx
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x15
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0xa6
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Moved_DLL_to:
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x31c]
call fcn.00416960
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x41e528
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00417a10
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x41e57e
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41e574
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7eb
push ecx
push edx
call fcn.0056ebaf
add esp, 8
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push 4
cmovae eax, dword [ebp - 0x234]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41e617
call edi
mov ecx, dword [0x5dfbe0]
mov esi, eax
test ecx, ecx
je 0x41e066
mov edx, dword [ecx]
push 1
mov edx, dword [edx + 0x10]
call edx
test al, al
je 0x41e066
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0xab
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov byte [ebp - 4], 0x17
mov edx, str.Error___unable_to_mark_Dll_for_delete_on_reboot:
jmp 0x41e40e
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41e692
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e692
push ecx
lea ecx, [ebp - 0x31c]
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0xaf
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Marked_Dll_for_delete_on_reboot.
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
mov ecx, dword [ebp - 0x220]
mov al, 1
mov byte [ebp - 0x265], al
cmp ecx, 8
jb 0x41e77a
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e6d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7e1
push ecx
push edx
call fcn.0056ebaf
mov al, byte [ebp - 0x265]
add esp, 8
jmp 0x41e77a
push ecx
push edx
call fcn.0056ebaf
add esp, 8
jmp 0x41e772
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x41e772
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41e772
lea eax, [ebp - 0x31c]
push ecx
mov ecx, eax
call fcn.00430ce0
mov dword [ebp - 0x284], str.customhook
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinCoreSyncCustomHook.cpp
mov dword [ebp - 0x278], 0xb2
mov dword [ebp - 0x274], str.moveDLLs
mov byte [ebp - 0x270], 1
mov edx, str.Unable_to_get_AppData_folder_path__unable_to_move_DLL
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x31c]
call fcn.00416960
lea ecx, [ebp - 0x31c]
call fcn.00430bd0
xor al, al
mov byte [ebp - 0x265], al
mov ecx, dword [ebp - 0x238]
cmp ecx, 8
jb 0x41e7bc
mov edx, dword [ebp - 0x24c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41e7ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e7f0
push ecx
push edx
call fcn.0056ebaf
mov al, byte [ebp - 0x265]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056eb71
mov esp, ebp
pop ebp
ret
call fcn.00578112
call fcn.00578112
call fcn.00578112
call fcn.00578112
call fcn.00578112
call fcn.00578112
int3