Function at 0x418d7b
Capabilities:
Get common file path
Move file

Disassembly:
push 0x120
mov eax, 0x46b972
call fcn.0042dc0b
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x118]
xor ebx, ebx
call fcn.0040699e
lea eax, [ebp - 0x118]
mov dword [ebp - 4], ebx
push str.IN_Operations::_RemoveFileOrDirectoryOnReboot_:_Entering__RemoveFileOrDirectoryOnReboot__
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x118]
pop ecx
pop ecx
cmp dword [eax - 4], 1
jle 0x418dd0
push dword [eax - 0xc]
lea ecx, [ebp - 0x118]
call fcn.00406aae
mov eax, dword [ebp - 0x118]
push 4
push eax
mov ecx, 0x493f4c
call fcn.0040c5b8
cmp dword [0x493f60], 0
mov esi, 0x493f68
jne 0x418e45
call fcn.0040c31e
test eax, eax
je 0x418e3b
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push 0x104
push 0x494070
call fcn.00414c25
push str.sysnative
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call esi
push str.system32
push 0x494070
call esi
mov esi, 0x493f68
push esi
call fcn.00436130
pop ecx
mov dword [0x494174], eax
mov dword [0x493f60], 1
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.0042f1f0
add esp, 0xc
lea eax, [ebp - 0x114]
push edi
push 0x104
push eax
call fcn.00414c25
mov eax, dword [0x494174]
test eax, eax
je 0x418f44
push eax
push esi
push edi
call fcn.00438a59
add esp, 0xc
test eax, eax
jne 0x418f44
push 0x494070
mov esi, 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00414c25
mov eax, dword [0x494174]
add eax, edi
push eax
push esi
lea eax, [ebp - 0x114]
push eax
call fcn.00414be7
lea eax, [ebp - 0x114]
push eax
push edi
lea eax, [ebp - 0x118]
push str.IN_Operations::_RemoveFileOrDirectoryOnReboot_:_replacing_sysnative_path__s_with_system32_path__s
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x118]
add esp, 0x10
cmp dword [eax - 4], 1
jle 0x418ef4
push dword [eax - 0xc]
lea ecx, [ebp - 0x118]
call fcn.00406aae
mov eax, dword [ebp - 0x118]
push 1
mov edi, 0x493f4c
push eax
mov ecx, edi
call fcn.0040c5b8
push 1
lea ecx, [ebp - 0x12c]
call fcn.004130e6
push 1
push str.IN_Operations::_RemoveFileOrDirectoryOnReboot_:_Disable_file_redirection
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040c5b8
push 4
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], bl
mov esi, eax
call fcn.004136ad
jmp 0x418f5b
push 4
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
mov edi, 0x493f4c
test esi, esi
je 0x418fb1
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push str.IN_Operations::_RemoveFileOrDirectoryOnReboot_:_Delete_file__s_on_reboot_successful
push eax
call fcn.00406b1a
mov esi, dword [ebp - 0x118]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x418f9a
push dword [esi - 0xc]
lea ecx, [ebp - 0x118]
call fcn.00406aae
mov esi, dword [ebp - 0x118]
push 4
push esi
mov ecx, edi
call fcn.0040c5b8
mov bl, 1
mov byte [0x493f5c], bl
jmp 0x41905f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x118]
push esi
push str.MoveFileEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x118]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x418fee
push dword [eax - 0xc]
lea ecx, [ebp - 0x118]
call fcn.00406aae
mov eax, dword [ebp - 0x118]
push 7
push eax
mov ecx, edi
call fcn.0040c5b8
cmp esi, 5
jne 0x41901a
lea eax, [ebp - 0x118]
mov bl, 1
push str.Ignore_ACCESS_DENIED_returned_by_movefileex._It_might_caused_by_a_pending_file_deletion
push eax
mov byte [0x493f5c], bl
call fcn.00406b1a
pop ecx
pop ecx
jmp 0x419035
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push str.IN_Operations::_RemoveFileOrDirectoryOnReboot_:_Delete_file__s_on_reboot_not_successful
push eax
call fcn.00406b1a
add esp, 0xc
mov esi, dword [ebp - 0x118]
cmp dword [esi - 4], 1
jle 0x419055
push dword [esi - 0xc]
lea ecx, [ebp - 0x118]
call fcn.00406aae
mov esi, dword [ebp - 0x118]
push 4
push esi
mov ecx, edi
call fcn.0040c5b8
lea ecx, [esi - 0x10]
call fcn.00406c57
mov al, bl
call fcn.0042dbb5
ret