Function at 0x4061b0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x40a49b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00404310
lea eax, [esp + 0x18]
push 0xff
push eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x40d43c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d495
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf003f
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x40d63c
push 0x80000002
lea ecx, [esp + 0x28]
call fcn.00404400
mov ebp, dword [sym.imp.MSVCRT.dll_strrchr]
test eax, eax
jne 0x40635a
mov eax, dword [esp + 0x228]
test eax, eax
je 0x406290
push 0x40e3b8
push 0x40de38
jmp 0x406348
lea eax, [esp + 0x18]
push eax
call fcn.00405000
add esp, 4
test eax, eax
jne 0x4062bc
push eax
push 1
lea ecx, [esp + 0x20]
push 1
push ecx
push eax
call fcn.004054f0
add esp, 0x14
test eax, eax
je 0x406351
mov edi, 0x40d495
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call ebp
add esp, 8
test eax, eax
je 0x40630a
lea edx, [esp + 0x118]
push 0x2e
push edx
call ebp
add esp, 8
mov byte [eax], 0
mov edi, 0x40de2c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e3b8
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.004045c0
lea ecx, [esp + 0xc]
call fcn.004043e0
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call ebp
mov edx, eax
add esp, 8
mov edi, 0x40d4c9
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xf003f
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
push 0x40d605
push 0x80000002
lea ecx, [esp + 0x28]
call fcn.00404400
test eax, eax
jne 0x406497
mov eax, dword [esp + 0x228]
test eax, eax
je 0x4063cd
push 0x40e3b8
push 0x40de1c
jmp 0x406485
lea ecx, [esp + 0x18]
push ecx
call fcn.00405000
add esp, 4
test eax, eax
jne 0x4063f9
push eax
push 1
lea edx, [esp + 0x20]
push 1
push edx
push eax
call fcn.004054f0
add esp, 0x14
test eax, eax
je 0x40648e
mov edi, 0x40d4c9
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call ebp
add esp, 8
test eax, eax
je 0x406447
lea edx, [esp + 0x118]
push 0x2e
push edx
call ebp
add esp, 8
mov byte [eax], 0
mov edi, 0x40de18
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e3b8
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.004045c0
lea ecx, [esp + 0xc]
call fcn.004043e0
push 0xf003f
push 0x40ddf0
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.00404460
test eax, eax
je 0x4064d3
push 0xf003f
push 0x40dddc
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.00404460
test eax, eax
jne 0x4066ca
push 0
lea ecx, [esp + 0x1c]
push 0x40ddd0
push ecx
lea ecx, [esp + 0x18]
call fcn.00404500
test eax, eax
je 0x406509
push 0
lea edx, [esp + 0x1c]
push 0x40ddc8
push edx
lea ecx, [esp + 0x18]
call fcn.00404500
test eax, eax
jne 0x4066c1
push 1
push 0
push 0
lea eax, [esp + 0x24]
push 0x40d240
push eax
call fcn.004024d0
add esp, 0x14
test eax, eax
je 0x406545
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call ebp
add esp, 8
test eax, eax
je 0x406545
lea edx, [esp + 0x18]
push 0x5c
push edx
call ebp
add esp, 8
mov byte [eax + 1], 0
lea eax, [esp + 0x18]
push 0x40d531
push eax
lea ecx, [esp + 0x120]
push 0x40ddc0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40d54b
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x228]
mov ecx, ebp
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40663d
lea eax, [esp + 0x118]
push eax
call fcn.00405000
add esp, 4
test eax, eax
je 0x4066c1
lea ecx, [esp + 0x18]
push ecx
call fcn.00405000
add esp, 4
test eax, eax
je 0x4066c1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x120]
push 0
push edx
call fcn.00404e80
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
test eax, eax
je 0x4065f6
push 0x1f4
call esi
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00404e80
add esp, 0x10
test eax, eax
je 0x406614
push 0x1f4
call esi
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x118]
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
jmp 0x4066c1
lea ecx, [esp + 0x118]
push ecx
call fcn.00405000
add esp, 4
test eax, eax
je 0x4066c1
lea edx, [esp + 0x18]
push edx
call fcn.00405000
add esp, 4
test eax, eax
jne 0x4066c1
push eax
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00404e80
add esp, 0x10
test eax, eax
je 0x406685
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_rename]
lea eax, [esp + 0x20]
push eax
call fcn.00405000
add esp, 0xc
test eax, eax
je 0x4066c1
push 0
push 1
lea ecx, [esp + 0x120]
push 1
push ecx
push 0
call fcn.004054f0
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.004043e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x220], 0xffffffff
call fcn.00404350
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x218
ret