Function at 0x413990
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xeb0
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xeac], ecx
mov dword [ebp - 0xe88], 0xffffffff
xor eax, eax
mov word [ebp - 0x824], ax
push 0x206
push 0
lea ecx, [ebp - 0x822]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x824]
push eax
call fcn.004136d0
push 0x43de1c
push 0x104
lea ecx, [ebp - 0x824]
push ecx
call fcn.00413720
lea edx, [ebp - 0xe84]
push edx
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xe88], eax
cmp dword [ebp - 0xe88], 0xffffffff
jne 0x413a39
mov ecx, dword [ebp - 0xe88]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x413dd8
lea edx, [ebp - 0xe84]
push edx
mov eax, dword [ebp - 0xe88]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x413dc9
mov ecx, dword [ebp - 0xe84]
and ecx, 0x10
jne 0x413dc4
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xe58]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xe90], ecx
mov dword [ebp - 0xe8c], 0x43de24
mov edx, dword [ebp - 0xe8c]
mov ax, word [edx]
mov word [ebp - 0xe92], ax
mov ecx, dword [ebp - 0xe90]
cmp ax, word [ecx]
jne 0x413b14
cmp word [ebp - 0xe92], 0
je 0x413b08
mov edx, dword [ebp - 0xe8c]
mov ax, word [edx + 2]
mov word [ebp - 0xe94], ax
mov ecx, dword [ebp - 0xe90]
cmp ax, word [ecx + 2]
jne 0x413b14
add dword [ebp - 0xe8c], 4
add dword [ebp - 0xe90], 4
cmp word [ebp - 0xe94], 0
jne 0x413aae
mov dword [ebp - 0xe98], 0
jmp 0x413b1f
sbb edx, edx
or edx, 1
mov dword [ebp - 0xe98], edx
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0xea4], eax
cmp dword [ebp - 0xea4], 0
jne 0x413b83
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x413b7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xea8], eax
mov edx, dword [ebp - 0xea8]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x43de28
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
push 4
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x413dc4
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xeb0]
push ecx
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x413dc4
lea edx, [ebp - 0x20c]
push edx
call fcn.00411320
mov ecx, eax
call fcn.004252c0
movzx eax, al
test eax, eax
jne 0x413dc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xe9c], eax
mov ecx, dword [ebp - 0xe9c]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.CUninstalltools::DeleteFileAsType__ForceRemoveFile_failed:_path___s__err___d_
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc34]
push eax
push 0x43df60
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0xeac]
call fcn.00414e40
movzx edx, al
test edx, edx
jne 0x413d3c
push str.CUninstalltools::DeleteFileAsType__IsFileInSystemDrive:_return_false_
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 4
xor eax, eax
mov word [ebp - 0x61c], ax
push 0x206
push 0
lea ecx, [ebp - 0x61a]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.004078a0
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
push str.TEMP
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413cfd
call fcn.0040ba00
lea ecx, [ebp - 0x414]
call fcn.00424e40
lea ecx, [ebp - 0x414]
push ecx
push str.CUninstalltools::DeleteFileAsType__MakeSureDirPathExist:_path___s_
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 8
push 4
push 0
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413d3c
push 0x208
push 0
lea ecx, [ebp - 0xc34]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 0x104
lea eax, [ebp - 0xc34]
push eax
call fcn.004136d0
lea ecx, [ebp - 0xa2c]
push ecx
push 0
push 0x43e0b0
lea edx, [ebp - 0xc34]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 3
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x413db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xea0], eax
mov edx, dword [ebp - 0xea0]
push edx
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.CUninstalltools::DeleteFileAsType__MoveFileEx_failed:_src___s__dst___s__err___d_
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0x10
push 4
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x413dc4
push 4
push 0
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x413a39
mov ecx, dword [ebp - 0xe88]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret 8