Function at 0x4ca4e0
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da63a
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x63d284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x494], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, SysReAllocString
test eax, eax
jne 0x4ca5bc
add edi, 8
lea eax, [ebp + 8]
cmp edi, eax
je 0x4ca5af
cmp dword [ebp + 0x1c], 8
mov ecx, dword [edi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x498], ecx
cmp eax, ecx
ja 0x4ca606
mov dword [ebp - 0x498], edi
mov edx, edi
cmp ecx, 8
jb 0x4ca588
mov edx, dword [edi]
mov dword [ebp - 0x498], edx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
push dword [ebp - 0x49c]
push edx
call fcn.00572f50
mov eax, dword [ebp - 0x498]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov esi, SysReAllocString
mov edi, dword [ebp - 0x4a8]
mov dword [edi + 4], 2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4cad08
mov eax, 0x5c
mov dword [ebp - 0x30], 0
mov word [ebp - 0x34], ax
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 2
jb 0x4caf42
jmp 0x4ca726
cmp eax, 0x7ffffffe
ja 0x4caf47
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4ca62a
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4ca664
mov edx, ecx
mov eax, SysReAllocString
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4ca645
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4ca664
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x4caf6e
add eax, eax
cmp eax, 0x1000
jb 0x4ca68d
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4caf6e
push ecx
call fcn.00591cad
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4caf4c
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4ca6ac
test eax, eax
je 0x4ca6aa
push eax
call fcn.00591cad
add esp, 4
mov dword [ebp - 0x494], eax
test eax, eax
je 0x4caf5d
jmp 0x4ca6b2
xor eax, eax
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x4a4]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ecx
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x49c]
push eax
call fcn.005729d0
mov eax, dword [ebp - 0x494]
xor ecx, ecx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x498]
cmp ecx, 8
jb 0x4ca71f
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4ca70f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4caf73
mov eax, edx
push ecx
push eax
call fcn.0056c61e
mov eax, dword [ebp - 0x494]
add esp, 8
mov dword [edi], eax
jmp 0x4ca5aa
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 2
cmovae eax, dword [ebp + 8]
push 0x61befc
push ecx
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x28]
call fcn.00447219
mov edi, 1
mov dword [ebp - 0x494], edi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x48c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c5a20
mov byte [ebp - 4], 1
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4ca7b2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4ca7a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4caf73
push edx
push ecx
call fcn.0056c61e
add esp, 8
test esi, esi
je 0x4cab00
mov ecx, dword [ebp - 0x2c]
nop dword [eax]
xor edx, edx
test ecx, ecx
je 0x4ca7fe
mov eax, dword [ebp - 0x48c]
shr eax, 4
and eax, 1
je 0x4ca7fe
cmp word [ebp - 0x460], 0x2e
jne 0x4ca7fe
mov ax, word [ebp - 0x45e]
test ax, ax
je 0x4ca7f9
cmp ax, 0x2e
jne 0x4ca7fe
cmp word [ebp - 0x45c], dx
jne 0x4ca7fe
mov edx, 1
test edx, edx
jne 0x4caada
mov byte [ebp - 4], 3
call fcn.0040b813
mov ecx, eax
test ecx, ecx
je 0x4caf82
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
or edi, 2
cmp dword [ebp - 0x2c], 0
mov dword [ebp - 0x494], edi
lea esi, [eax + 0x10]
mov dword [ebp - 0x498], esi
je 0x4ca98b
lea edi, [ebp - 0x460]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4ca845
sub edi, ecx
sar edi, 1
jne 0x4ca8b4
cmp dword [esi - 0xc], 0
lea edx, [esi - 0x10]
mov edi, dword [edx]
je 0x4ca985
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x4ca889
cmp dword [esi - 8], 0
jl 0x4caf78
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x4ca985
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4ca89d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x498], esi
jmp 0x4ca985
mov eax, dword [esi - 0xc]
lea edx, [ebp - 0x460]
sub edx, esi
mov dword [ebp - 0x49c], eax
sar edx, 1
mov dword [ebp - 0x4a4], edx
test edi, edi
js 0x4caf78
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4ca8fe
push edi
lea ecx, [ebp - 0x498]
call fcn.0040bfb3
mov esi, dword [ebp - 0x498]
mov edx, dword [ebp - 0x4a4]
lea ecx, [edi + edi]
mov eax, dword [esi - 8]
cmp edx, dword [ebp - 0x49c]
ja 0x4ca937
lea edx, [esi + edx*2]
test ecx, ecx
je 0x4ca973
test edx, edx
jne 0x4ca924
call fcn.00591b4a
mov dword [eax], 0x16
jmp 0x4ca96b
add eax, eax
cmp eax, ecx
jb 0x4ca960
push ecx
push edx
push esi
call fcn.00572f50
add esp, 0xc
jmp 0x4ca970
add eax, eax
test ecx, ecx
je 0x4ca973
cmp eax, ecx
jb 0x4ca954
push ecx
lea eax, [ebp - 0x460]
push eax
push esi
call fcn.005729d0
add esp, 0xc
jmp 0x4ca970
push eax
push 0
push esi
call fcn.00573610
add esp, 0xc
call fcn.00591b4a
mov dword [eax], 0x22
call fcn.0057da70
lea ecx, [edi + edi]
cmp edi, dword [esi - 8]
jg 0x4caf78
xor eax, eax
mov dword [esi - 0xc], edi
mov word [ecx + esi], ax
mov edi, dword [ebp - 0x494]
mov ecx, dword [ebp + 0x18]
mov eax, SysReAllocString
sub eax, ecx
cmp eax, 1
jb 0x4caf47
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 1
cmovae eax, dword [ebp + 8]
push 0x60db0c
push ecx
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x28]
call fcn.00447219
or edi, 4
mov dword [ebp - 0x494], edi
mov ecx, esi
mov byte [ebp - 4], 4
sub esp, 0x18
mov dword [ebp - 0x4ac], esp
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ca9e0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.0040993b
mov ecx, dword [ebp - 0x4ac]
or edi, 8
mov dword [ebp - 0x494], edi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x4a8]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
call fcn.004ca4e0
test eax, eax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x14]
sete byte [ebp - 0x48d]
cmp edx, 8
jb 0x4caa91
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4caa87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4caf73
push edx
push ecx
call fcn.0056c61e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
and edi, 0xfffffffd
mov word [ebp - 0x28], ax
mov dword [ebp - 0x14], 7
add esi, 0xfffffff0
mov dword [ebp - 0x494], edi
or eax, 0xffffffff
mov byte [ebp - 4], 1
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4caaca
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x48d], 0
jne 0x4cacd8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4cab00
test ecx, ecx
je 0x4cab00
lea ecx, [ebp - 0x48c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
jne 0x4ca7c0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4cacdc
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, dword [ebp - 0x4a8]
lea eax, [ebp + 8]
add esi, 8
cmp esi, eax
je 0x4cacc9
cmp dword [ebp + 0x1c], 8
mov ecx, dword [esi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a4], ecx
cmp eax, ecx
ja 0x4caba3
mov edi, esi
cmp ecx, 8
jb 0x4cab71
mov edi, dword [esi]
mov dword [esi + 0x10], eax
lea esi, [eax + eax]
push esi
push dword [ebp - 0x49c]
push edi
call fcn.00572f50
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x4a8]
xor esi, esi
mov dword [ecx + 4], eax
jmp 0x4cace1
cmp eax, 0x7ffffffe
ja 0x4caf8c
mov edi, eax
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x4cabcc
mov dword [ebp - 0x498], SysReAllocString
mov eax, 0xfffffffe
jmp 0x4cac10
mov eax, ecx
mov edx, SysReAllocString
shr eax, 1
sub edx, eax
cmp ecx, edx
jbe 0x4cabec
mov dword [ebp - 0x498], SysReAllocString
mov eax, 0xfffffffe
jmp 0x4cac10
add eax, ecx
cmp edi, eax
cmovb edi, eax
mov dword [ebp - 0x498], edi
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x4caf6e
add eax, eax
cmp eax, 0x1000
jb 0x4cac37
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4caf6e
push ecx
call fcn.00591cad
add esp, 4
test eax, eax
je 0x4caf91
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4cac52
test eax, eax
je 0x4cac50
push eax
call fcn.00591cad
mov edi, eax
add esp, 4
test edi, edi
je 0x4cafa2
jmp 0x4cac52
xor edi, edi
mov ecx, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x498]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x49c]
push edi
call fcn.005729d0
xor eax, eax
add esp, 0xc
mov word [edi + esi], ax
mov eax, dword [ebp - 0x4a4]
cmp eax, 8
jb 0x4cacc0
lea ecx, [eax*2 + 2]
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax + 8]
cmp ecx, 0x1000
jb 0x4cacb6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4caf73
mov eax, edx
push ecx
push eax
call fcn.0056c61e
add esp, 8
mov eax, dword [ebp - 0x4a8]
mov dword [eax + 8], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx + 4], eax
xor esi, esi
jmp 0x4cace1
mov esi, 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0
test eax, eax
je 0x4caee9
cmp eax, 0xffffffff
je 0x4caee9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4caee9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x4a4], eax
test eax, eax
jne 0x4caee3
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x4a4], eax
test eax, eax
jne 0x4caee3
add edi, 8
lea eax, [ebp + 8]
cmp edi, eax
je 0x4caed4
cmp dword [ebp + 0x1c], 8
mov ecx, dword [edi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x49c], ecx
cmp eax, ecx
ja 0x4cadba
mov dword [ebp - 0x49c], edi
mov edx, edi
cmp ecx, 8
jb 0x4cad93
mov edx, dword [edi]
mov dword [ebp - 0x49c], edx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
push dword [ebp - 0x498]
push edx
call fcn.00572f50
mov eax, dword [ebp - 0x49c]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x4caed4
cmp eax, 0x7ffffffe
ja 0x4cafb3
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4cadde
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4cae17
mov eax, ecx
mov edx, SysReAllocString
shr eax, 1
sub edx, eax
cmp ecx, edx
jbe 0x4cadf9
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4cae17
add eax, ecx
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x4caf6e
add eax, eax
cmp eax, 0x1000
jb 0x4cae40
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4caf6e
push ecx
call fcn.00591cad
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4cafb8
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4cae5f
test eax, eax
je 0x4cae5d
push eax
call fcn.00591cad
add esp, 4
mov dword [ebp - 0x494], eax
test eax, eax
je 0x4cafc9
jmp 0x4cae65
xor eax, eax
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ecx
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x498]
push eax
call fcn.005729d0
mov eax, dword [ebp - 0x494]
xor ecx, ecx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x49c]
cmp ecx, 8
jb 0x4caed2
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4caec2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4caf73
mov eax, edx
push ecx
push eax
call fcn.0056c61e
mov eax, dword [ebp - 0x494]
add esp, 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x4a4]
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4caf23
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4caf19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4cafda
push edx
push ecx
call fcn.0056c61e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056cd75
mov esp, ebp
pop ebp
ret 0x18
call fcn.0040791f
call fcn.0040791f
push 0x638780
lea eax, [ebp - 0x48d]
push eax
call fcn.0057359b
push 0x638780
lea eax, [ebp - 0x49d]
push eax
call fcn.0057359b
call fcn.00407b84
call fcn.0057da80
push 0x80070057
call fcn.0040c3c1
push 0x80004005
call fcn.0040c3c1
call fcn.0040791f
push 0x638780
lea eax, [ebp - 0x49d]
push eax
call fcn.0057359b
push 0x638780
lea eax, [ebp - 0x48d]
push eax
call fcn.0057359b
call fcn.0040791f
push 0x638780
lea eax, [ebp - 0x49d]
push eax
call fcn.0057359b
push 0x638780
lea eax, [ebp - 0x48d]
push eax
call fcn.0057359b
call fcn.0057da80
int3