Function at 0x406930
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
push edi
xor edi, edi
mov ebx, eax
mov dword [ebp - 0x20], str.MicrosoftWindowsThemes
mov dword [ebp - 0x1c], str.WindowsUpdate
mov dword [ebp - 0x18], str.Windows_Live
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], str.Microsoft
mov dword [ebp - 0xc], str.Windows
mov dword [ebp - 8], str.Kernel
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x406bbb
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x406bbb
cmp word [ebx], di
je 0x406bbb
cmp word [eax], di
je 0x406bbb
push 0x208
lea ecx, [ebp - 0x22e]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x230], ax
call sub.msvcrt.dll_memset
lea edx, [ebp - 0x230]
push edx
mov eax, 0x1898b122
call fcn.00401600
add esp, 0x10
lea ecx, [ebp - 0x230]
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4069f6
cmp dx, di
je 0x4069f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4069f6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4069d0
xor eax, eax
jmp 0x4069fb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x406bbb
push ebx
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, edi
je 0x406a36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
cmp eax, 0xb7
jne 0x406a30
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov eax, str.MicrosoftWindowsThemes
push eax
mov eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x406bbb
mov eax, dword [ebp + edi*4 - 0x1c]
inc edi
test eax, eax
jne 0x406a41
mov edi, dword [ebp + 8]
push str.Temp
push edi
call esi
test eax, eax
jne 0x406b58
push str..exe
push edi
call esi
test eax, eax
je 0x406b58
push 0x423f84
push ebx
call esi
test eax, eax
jne 0x406b58
push 0x423f88
push ebx
call esi
test eax, eax
jne 0x406b58
push 0x423f84
push edi
call esi
test eax, eax
jne 0x406b58
push 0x423f88
push edi
call esi
test eax, eax
jne 0x406b58
xor edi, edi
mov eax, str.Microsoft
push eax
push ebx
call esi
test eax, eax
jne 0x406b58
mov eax, dword [ebp + edi*4 - 0xc]
inc edi
test eax, eax
jne 0x406ac3
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.msvcrt.dll__wcsdup]
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
push 0x22
push esi
call edi
add esp, 0xc
test eax, eax
je 0x406b14
push 0x22
push esi
call edi
add eax, 2
mov edx, esi
add esp, 8
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x406b05
push 0x22
push esi
call edi
add esp, 8
test eax, eax
je 0x406b2d
push 0x22
push esi
call edi
add esp, 8
xor edx, edx
mov word [eax], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebx
cmp eax, 0xffffffff
je 0x406b64
test al, 2
je 0x406b64
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test esi, esi
je 0x406b58
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
je 0x406b83
push 0x5c
push esi
call edi
add esp, 8
xor ecx, ecx
mov word [eax], cx
push esi
call ebx
cmp eax, 0xffffffff
je 0x406b8f
test al, 2
jne 0x406b4a
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406b94
sub eax, edx
sar eax, 1
lea edx, [esi + eax*2 + 2]
push edx
call fcn.00406870
test esi, esi
je 0x406bbb
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret