Function at 0x45a4e0
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e960c
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x6a8a44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0x14], 0
mov dword [ebp - 0x8a0], 1
xor ecx, ecx
mov word [ebp - 0x650], cx
push 0x206
push 0
lea edx, [ebp - 0x64e]
push edx
call fcn.005be3a0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x38], ax
xor ecx, ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov dword [ebp - 0x22], ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov word [ebp - 0x12], cx
push 0x5f1b60
lea ecx, [ebp - 0x888]
call fcn.00402790
mov dword [ebp - 4], 0
push 0x5f1b7c
lea ecx, [ebp - 0x870]
call fcn.00402790
mov byte [ebp - 4], 1
push 0x5f1b84
lea ecx, [ebp - 0x870]
call fcn.00404340
push 0x5f1b8c
lea ecx, [ebp - 0x870]
call fcn.00404340
push 0xd0
lea ecx, [ebp - 0x888]
call fcn.00402820
push eax
push str._s_d
lea edx, [ebp - 0x38]
push edx
call fcn.00409310
add esp, 0x10
lea ecx, [ebp - 0x870]
call fcn.00402820
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.005c5a4b
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x650]
push edx
call fcn.005c7787
add esp, 8
lea eax, [ebp - 0x650]
push eax
push 1
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0xc], 0
jne 0x45aa52
mov dword [ebp - 0x890], 0x5a98
mov dword [ebp - 0x8a0], 0
lea ecx, [ebp - 0x8f0]
call fcn.005b9e8b
mov byte [ebp - 4], 2
push 0x10000000
push str.Everyone
lea ecx, [ebp - 0x8f0]
call fcn.005b9ee5
push 0x10000000
push str.ALL_APPLICATION_PACKAGES
lea ecx, [ebp - 0x8f0]
call fcn.005b9ee5
lea eax, [ebp - 0x650]
push eax
mov ecx, dword [ebp - 0x890]
push ecx
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.00402a50
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x45aa43
xor ecx, ecx
mov word [ebp - 0x858], cx
push 0x206
push 0
lea edx, [ebp - 0x856]
push edx
call fcn.005be3a0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x448], ax
push 0x206
push 0
lea ecx, [ebp - 0x446]
push ecx
call fcn.005be3a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x240], dx
push 0x206
push 0
lea eax, [ebp - 0x23e]
push eax
call fcn.005be3a0
add esp, 0xc
lea ecx, [ebp - 0x858]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x38]
push edx
push 0x5f1be8
push 0x5f1bfc
lea eax, [ebp - 0x858]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x448]
push ecx
call fcn.00409310
add esp, 0x18
lea ecx, [ebp - 0x870]
call fcn.00402820
push eax
lea edx, [ebp - 0x240]
push edx
call fcn.005c5a4b
add esp, 8
push str.TEMP__
lea eax, [ebp - 0x240]
push eax
call fcn.005c7787
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.005c7787
add esp, 8
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0x14], 1
lea ecx, [ebp - 0x240]
push ecx
push 1
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x45aa43
lea ecx, [ebp - 0x240]
push ecx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x45aa43
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
lea ecx, [ebp - 0x448]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0xffffffff
jne 0x45a873
mov dword [ebp - 0x8b0], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.005b9ed4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402750
mov eax, dword [ebp - 0x8b0]
jmp 0x45abc8
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x890]
push eax
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.00402a50
push eax
mov ecx, dword [ebp - 0x898]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x45aa36
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x89c]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0x5f1c48
push str.WanNengWBInput
lea eax, [ebp - 0x858]
push eax
push str._s_s_s_s_d
lea ecx, [ebp - 0x448]
push ecx
call fcn.00409310
add esp, 0x1c
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
lea edx, [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0xffffffff
jne 0x45a966
mov dword [ebp - 0x8b4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.005b9ed4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402750
mov eax, dword [ebp - 0x8b4]
jmp 0x45abc8
mov eax, dword [ebp - 0x89c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x870]
call fcn.00402820
push eax
push 0x5f1c94
lea edx, [ebp - 0x240]
push edx
call fcn.00409310
add esp, 0x14
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x890]
push ecx
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.00402a50
push eax
mov edx, dword [ebp - 0x894]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0xc], 0
jne 0x45aa16
mov dword [ebp - 0x8b8], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.005b9ed4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402750
mov eax, dword [ebp - 0x8b8]
jmp 0x45abc8
push 5
push 0
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x894]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45aa43
mov edx, dword [ebp - 0x898]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.005b9ed4
mov dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
je 0x45ab24
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0x10], 0
je 0x45ab07
mov dword [ebp - 0x8a4], 1
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x28], edx
cmp dword [ebp - 0x8a0], 0
jne 0x45aacf
mov eax, dword [ebp - 0x88c]
mov ecx, dword [eax + 0x28]
call fcn.00457ca0
mov dword [ebp - 0x8bc], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402750
mov eax, dword [ebp - 0x8bc]
jmp 0x45abc8
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0xc], 0
cmp dword [ebp - 0x8a4], 0
jne 0x45ab97
push 0x5a98
call fcn.005ad041
add esp, 4
mov dword [ebp - 0x8a8], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x8a8], 0
je 0x45ab60
mov ecx, dword [ebp - 0x8a8]
call fcn.00457c80
mov dword [ebp - 0x8ac], eax
jmp 0x45ab6a
mov dword [ebp - 0x8ac], 0
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x8c0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x88c]
mov eax, dword [ebp - 0x8c0]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp - 0x88c]
mov ecx, dword [ecx + 0x28]
call fcn.00457ca0
mov dword [ebp - 0x8c4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402750
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ad281
mov esp, ebp
pop ebp
ret