Function at 0x47a1b4
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405c50
mov eax, dword [ebp - 8]
call fcn.00405c50
xor eax, eax
push ebp
push 0x47a5a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405bf8
jne 0x47a234
push 0xa
push 3
mov ecx, dword [ebp - 4]
mov edx, 0x390
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp 0x47a567
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040b1a4
mov ebx, eax
mov dword [ebp - 0x26f], ebx
cmp ebx, 0xffffffff
jne 0x47a263
push 2
push 1
mov ecx, dword [ebp - 4]
mov edx, 0x391
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp 0x47a567
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.0040b254
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47a298
push ebx
call sub.kernel32.dll_CloseHandle_1
push 0xa
push 2
mov ecx, dword [ebp - 4]
mov edx, 0x392
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp 0x47a567
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0040b254
cmp byte [esi + 0x141], 0
je 0x47a2d8
lea eax, [ebp - 0x123]
push eax
push 0
push 0x47a5b8
lea eax, [ebp - 0x3c0]
call fcn.00478764
mov eax, dword [ebp - 0x3c0]
call fcn.00405c60
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x47a2f7
lea eax, [ebp - 0x123]
push eax
push 0
push 0x47a5b8
mov eax, dword [esi + 0x150]
call fcn.00405c60
push eax
call sub.kernel32.dll_GetTempFileNameA
lea edx, [ebp - 0x3c4]
lea eax, [ebp - 0x123]
call fcn.0040bc38
mov edi, dword [ebp - 0x3c4]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov dword [ebp - 0x3c8], edi
mov eax, dword [ebp - 0x3c8]
call fcn.00405c60
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, eax
mov dword [ebp - 0x3bb], edx
test edx, edx
jge 0x47a34e
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x47a567
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1e], 0
mov eax, 0x4000
call fcn.00402fec
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
mov edx, edi
mov ecx, 0x4000
mov eax, dword [ebp - 0x26f]
call fcn.0040b1fc
mov ebx, eax
test ebx, ebx
jge 0x47a3a7
mov eax, dword [ebp - 0x26f]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x3bb]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x4000
mov eax, dword [ebp - 0x18]
call fcn.00403008
mov byte [ebp - 0x1e], 1
mov edx, edi
mov ecx, ebx
mov eax, dword [ebp - 0x3bb]
call fcn.0040b228
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x47a3e8
mov eax, dword [ebp - 0x26f]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x3bb]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x4000
mov eax, dword [ebp - 0x18]
call fcn.00403008
mov byte [ebp - 0x1e], 1
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
cmp word [esi + 0x8a], 0
je 0x47a411
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [esi + 0x8c]
call dword [esi + 0x88]
lea edx, [ebp - 0x1d]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x4dff2c]
mov eax, dword [eax]
call fcn.0044745c
test ebx, ebx
je 0x47a440
cmp ebx, dword [ebp - 0x14]
jne 0x47a440
cmp byte [ebp - 0x1d], 0
jne 0x47a440
cmp byte [ebp - 0x1e], 0
je 0x47a363
mov eax, dword [ebp - 0x26f]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x3bb]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x4000
mov eax, dword [ebp - 0x18]
call fcn.00403008
movzx eax, byte [ebp - 0x1d]
mov byte [esi + 0x181], al
movzx eax, byte [ebp - 0x1d]
or al, byte [ebp - 0x1e]
je 0x47a4b1
lea edx, [ebp - 0x3cc]
lea eax, [ebp - 0x123]
call fcn.0040bc38
mov ebx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3c8], ebx
mov eax, dword [ebp - 0x3c8]
call fcn.00405c60
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x47a567
mov eax, dword [ebp - 8]
call fcn.0040b414
test al, al
je 0x47a526
mov eax, dword [ebp - 8]
call fcn.00405c60
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x47a526
mov eax, dword [ebp - 8]
call fcn.0047a194
push ebx
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x47a526
mov byte [ebp - 9], 0
push 0x13
push 6
mov ecx, dword [ebp - 8]
mov edx, 0x3cc
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x38]
lea eax, [ebp - 0x3d0]
mov ecx, dword [ebp - 8]
mov edx, 0x47a5c8
call fcn.00405ae8
mov eax, dword [ebp - 0x3d0]
call fcn.00478600
jmp 0x47a567
lea edx, [ebp - 0x3d4]
lea eax, [ebp - 0x123]
call fcn.0040bc38
mov ebx, dword [ebp - 0x3d4]
mov eax, dword [ebp - 8]
call fcn.00405c60
push eax
mov dword [ebp - 0x3c8], ebx
mov eax, dword [ebp - 0x3c8]
call fcn.00405c60
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a5a9
lea eax, [ebp - 0x3d4]
mov edx, 3
call fcn.004057f4
lea eax, [ebp - 0x3c4]
mov edx, 2
call fcn.004057f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004057f4
ret