Function at 0x40c3dc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push edi
mov dword [ebp - 0x10c], 0
call fcn.004103f9
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004132d0
add esp, 8
push 0x434678
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x40c4c7
push str.GetVolumeInformationA
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x40c4ba
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x224], 0
push 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0x104
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [ebp - 0x114]
test eax, eax
je 0x40c4ba
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x11c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0xffffffff
jne 0x40c68c
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x40c68c
push str.GetFileInformationByHandle
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x40c67f
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x338], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
push 0x4346c4
lea edx, [ebp - 0x108]
push edx
call fcn.00412b28
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.0040fdec
add esp, 4
test eax, eax
je 0x40c590
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffff
jne 0x40c590
mov dword [ebp - 0x33c], 0xffffffff
cmp dword [ebp - 0x33c], 0xffffffff
jne 0x40c617
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push 0x4346cc
lea ecx, [ebp - 0x334]
push ecx
call fcn.00412b28
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0
push 0x4346d4
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40c617
push 0
push 0x80000080
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0xffffffff
je 0x40c60d
mov dword [ebp - 0x338], 1
jmp 0x40c617
mov dword [ebp - 0x33c], 0xffffffff
cmp dword [ebp - 0x33c], 0xffffffff
je 0x40c67f
mov dword [ebp - 0x370], 0
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x36c]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x33c]
push eax
call dword [ebp - 0x32c]
test eax, eax
je 0x40c65c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x354]
mov dword [ecx], edx
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x338], 0
je 0x40c67f
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x40c6bc
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
test eax, eax
je 0x40c6bc
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 3
jg 0x40c6bc
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x1b5de6b6
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
je 0x40c6e6
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x40c6e6
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0x1b5de6b6
jne 0x40c6e4
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x40c719
mov edx, dword [ebp + 8]
push edx
call fcn.0040d4ab
add esp, 4
cmp eax, 2
jne 0x40c710
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
push 0x30
call fcn.00410c1b
add esp, 8
mov dword [ebp - 0x10c], eax
jmp 0x40c719
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x1b5de6b6
mov eax, dword [ebp - 4]
push eax
call fcn.00410406
add esp, 4
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret