Function at 0x411ffd
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x6d3f4c
mov dword [ebp - 0x30], ecx
push esi
mov ebx, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41202b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x62b1f8
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.0041284a
add esp, 0x10
mov ecx, 0x62ad28
cmp byte [0x6d4821], 0
mov eax, 0x62ad24
cmove eax, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push 0x62ad2c
lea eax, [ebp - 0x2c]
push eax
call esi
mov edi, 0x6d3f4c
lea eax, [ebp - 0x2c]
push edi
push 0x6d2cc0
push str.pdtname
push eax
call esi
push edi
push 0x6d3ad0
push str.proctype
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x2c]
sub ebx, 1
je 0x4120bc
sub ebx, 1
mov ebx, edi
push ebx
je 0x4120b5
push str.crash
jmp 0x4120c7
push str.hang
jmp 0x4120c7
mov ebx, 0x6d3f4c
push ebx
push str.trycatch
push str.crashtype
push eax
call esi
push dword [0x6d3b34]
mov edi, 0x6d8840
push 0x62b1f8
push edi
call fcn.0041282c
add esp, 0xc
lea eax, [ebp - 0x2c]
push ebx
push edi
push str.trycatchcnt
push eax
call esi
mov edi, 0x6d4840
mov ecx, 0x6d02b4
push 0x2000
mov edx, edi
call fcn.004116e0
pop ecx
push ebx
push edi
push str.cururl
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d2d74
push 0x62add0
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d2d10
push str.pdtver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d3a44
push 0x62adf0
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d47d0
push str.ExcptCode
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d435c
push str.module
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d476c
push str.modulever
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d47f8
push 0x62ae30
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d3774
push str.osver
lea eax, [ebp - 0x2c]
push eax
call esi
push ebx
push 0x6d397c
push str.iever
lea eax, [ebp - 0x2c]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x62ae58
push 0xffffffffffffffff
mov edi, 0x6d8840
push edi
call fcn.0040ce75
add esp, 0x10
lea eax, [ebp - 0x2c]
push ebx
push edi
push 0x62ae60
push eax
call esi
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41221f
cmp dword [ebx], 0
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
je 0x412201
push 0x6d3f4c
push 0x50
push dword [ebx]
lea eax, [ebp - 0x2c]
push str.ExceptionRecord
push eax
call edi
cmp dword [ebx + 4], 0
je 0x41221f
push 0x6d3f4c
push 0x2cc
push dword [ebx + 4]
lea eax, [ebp - 0x2c]
push str.ContextRecord
push eax
call edi
mov edi, 0x6d3d44
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call fcn.0041165c
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x6d3b3c
push str._s_u__d__s
push 0x104
mov ebx, 0x6d8840
push ebx
call fcn.0040ce75
add esp, 0x1c
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
test eax, eax
je 0x412276
push 0x6d3f4c
push ebx
push str.dump
lea eax, [ebp - 0x2c]
push eax
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005926d8
leave
ret