Function at 0x41c6e0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddeb7
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4cc], ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480620
add esp, 0x18
mov dword [ebp - 0x424], 7
xor eax, eax
mov dword [ebp - 0x428], 0
lea ecx, [ebp - 0x438]
mov word [ebp - 0x438], ax
push eax
push 0x5e6948
call fcn.00402ac0
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x5e6948
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 7
mov dword [ebp - 0x4b8], 0
mov word [ebp - 0x4c8], ax
call fcn.00402ac0
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x5e6948
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x49c], 7
mov dword [ebp - 0x4a0], 0
mov word [ebp - 0x4b0], ax
call fcn.00402ac0
mov byte [ebp - 4], 2
call fcn.004520bc
test al, al
je 0x41c7fe
push esp
outsb dx, byte [esi]
dec ebx
imul eax, ecx, 0x61a52980
int1
in eax, dx
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
adc byte [eax - 0x5fe123cc], bl
dec edx
test dword [eax], 0xca5da011
std
xchg esi, eax
or eax, 0x6a006ae7
pop ss
push 0
push 0x17
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41cea8
push 7
xor eax, eax
mov dword [ebp - 0x484], 7
push 0x5e7d48
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x488], 0
mov word [ebp - 0x498], ax
call fcn.00402ac0
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x498]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x5e89dc
push eax
call fcn.00407df0
lea eax, [ebp - 0x218]
push eax
call fcn.00458c36
add esp, 0x14
call fcn.0045236e
test al, al
je 0x41c8a8
pop es
salc
ljmp 0x243a
call fcn.00452101
test al, al
je 0x41c8c9
sub edx, ebp
stosd dword es:[edi], eax
push 0xf3745325
adc eax, 0xa8359711
test esp, ebx
mov al, 0x8a
cmp bh, byte [esp + eax]
pop ds
xor esp, dword [ecx + 0x4f]
call fcn.0045218b
test al, al
je 0x41c8ea
je 0x41c92b
add eax, 0xfe6738ab
sub ch, byte [eax - 0x5b]
retf
cmp word [ebp - 0x218], 0
jne 0x41c8f8
xor ecx, ecx
jmp 0x41c910
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c901
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402ac0
push 7
push 0x5e7d48
lea ecx, [ebp - 0x438]
call fcn.00405c20
push 4
push 0x5e89ec
lea ecx, [ebp - 0x438]
call fcn.00405c20
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
mov eax, dword [0x679464]
test eax, eax
jne 0x41c99c
invalid
push 0x15c
call fcn.0046d554
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x41c991
mov ecx, eax
call fcn.00443ec0
jmp 0x41c993
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x679464], eax
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0x480]
call fcn.00404060
xor eax, eax
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push eax
mov word [ebp - 0x450], ax
lea ecx, [ebp - 0x450]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x43c], 7
push eax
mov dword [ebp - 0x440], 0
call fcn.004029a0
push 0xc
push str.WnConfig.exe
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.00405c20
cmp dword [ebp - 0x46c], 8
lea edx, [ebp - 0x480]
mov edi, dword [ebp - 0x4cc]
lea ecx, [ebp - 0x450]
cmovae edx, dword [ebp - 0x480]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x43c], 8
push 0x5e6948
cmovae ecx, dword [ebp - 0x450]
cmp dword [ebp - 0x424], 8
push edx
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
push eax
mov ecx, edi
call fcn.0041c110
push 9
xor eax, eax
mov dword [ebp - 0x454], 7
push str.WnUpd.exe
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
call fcn.00402ac0
mov byte [ebp - 4], 7
call fcn.00452329
test al, al
je 0x41caa6
xor bl, byte [edi + ebp*8]
sbb esi, dword [eax - 0x26]
int1
movsb byte es:[edi], byte [esi]
ror dword [ebp - 0x72b7aa37], 1
mov al, 0xbf
stosb byte es:[edi], al
mov edi, dword fs:[ebp - 0x4cc]
cmp dword [ebp - 0x458], 0
je 0x41cbcc
call fcn.00452596
test al, al
je 0x41cad2
add ch, byte [ebx - 0x62497e71]
push esp
sbb edi, esi
scasb al, byte es:[edi]
dec ebp
adc eax, 0x205f7635
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [ebp - 0x218], 0
jne 0x41cae0
xor ecx, ecx
jmp 0x41caff
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41caf0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402ac0
push 8
push 0x5e89f8
lea ecx, [ebp - 0x438]
call fcn.00405c20
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
call fcn.00402310
mov ecx, eax
call fcn.00471d04
mov edx, eax
cmp word [edx], 0
jne 0x41cb53
xor ecx, ecx
jmp 0x41cb6f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cb60
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402ac0
push 9
push str.WnUpd.exe
lea ecx, [ebp - 0x450]
call fcn.00405c20
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push 0x5e6948
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
push eax
mov ecx, edi
call fcn.0041c110
mov al, 0xfb
invalid
call fcn.004524c7
test al, al
je 0x41cbed
mov edx, 0x6020cdc3
jp 0x41cbef
push ds
cmp al, 0x3f
xchg byte [edi + 1], dl
je 0x41cc35
pushal
jo 0x41cb73
sbb eax, sym.imp.KERNEL32.dll_DeleteFileW
cmp word [ebp - 0x218], 0
jne 0x41cbfb
mov ebp, 0xfffffde8
add byte [ebp + 4], dh
xor ecx, ecx
jmp 0x41cc13
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cc04
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402ac0
push 6
push 0x5e8a0c
lea ecx, [ebp - 0x438]
call fcn.00405c20
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
mov eax, dword [0x679464]
test eax, eax
jne 0x41cc87
invalid
push 0x15c
call fcn.0046d554
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x41cc7c
mov ecx, eax
call fcn.00443ec0
jmp 0x41cc7e
xor eax, eax
mov byte [ebp - 4], 7
mov dword [0x679464], eax
mov ecx, eax
call fcn.00471d04
mov edx, eax
cmp word [edx], 0
jne 0x41cc9a
xor ecx, ecx
jmp 0x41ccaf
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cca0
add dword [ebx - 0x7a99fd3f], eax
sal byte [ebp - 0xb], 0x2b
into
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402ac0
call fcn.004523f8
test al, al
je 0x41cce0
lahf
pop ebp
xchg ebx, ebp
push cs
imul dword [edx]
and dword [ebx], esp
ror byte [ebp + 4], 1
sbb byte [edx - 0x6815527a], dh
jp 0x41cca2
xor esp, dword [ecx - 0x13]
sbb byte [edi - 0xd], 0xe8
jne 0x41cd38
call fcn.0045225a
add eax, dword [eax]
test al, al
je 0x41ccfe
adc al, 0xf
sub edi, 0x5e
inc ecx
cmp byte [ebp - 0x24eb0a1e], dh
jb 0x41ccca
push edi
test al, 0x59
sub al, 0xc9
mov bh, 0x8b
call fcn.004523b3
test al, al
je 0x41cd19
or eax, edi
invalid
push 0xc
push 0x5e8884
lea ecx, [ebp - 0x450]
call fcn.00405c20
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
invalid
push 0x5e6948
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.0041c110
call fcn.004522e4
test al, al
je 0x41cd8a
mov bl, 0x67
jmp 0x41cd2d
call fcn.00452101
test al, al
je 0x41cdb1
out 0x91, al
and esp, dword [edx + 0x61]
imul ecx, dword [ebx], 0x7110f644
fidivr word [ebx + 0x68]
mov dword [0x67191068], eax
jno 0x41cde9
cmp esi, dword [edi + 0x370334ef]
int1
push 0xffffffffffffffe8
sbb dl, byte [ebx + eax]
call fcn.004521d0
test al, al
je 0x41cdd9
sal byte [edx + ebx - 0x76], cl
mov byte [esi + 0x2bccb99e], 0xf1
mov dword [0xec5f71b2], eax
shl dword [ebx], cl
loopne 0x41cdf0
cmp byte [eax + 0x5bd9c58e], al
mov edi, 0xe14629ce
mov eax, dword [ebp - 0x454]
cmp eax, 8
jb 0x41cdf7
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00402c10
invalid
invalid
xor eax, eax
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x458], 0
cmp eax, 8
jb 0x41ce32
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x440], 0
cmp eax, 8
jb 0x41ce6d
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x470], 0
cmp eax, 8
jb 0x41cea8
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.00402c10
mov eax, dword [ebp - 0x49c]
cmp eax, 8
jb 0x41cec6
inc eax
lea ecx, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4b0]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4a0], 0
cmp eax, 8
jb 0x41cf01
inc eax
lea ecx, [ebp - 0x4c8]
push eax
push dword [ebp - 0x4c8]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x4b8], 0
cmp eax, 8
jb 0x41cf3c
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret