Function at 0x410e40
Capabilities:
Delete file
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44dc09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4ac
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x145]
mov byte [esp + 0x144], bl
mov dword [esp + 0x3c], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4dc]
mov dword [esp + 0x1c], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x4e0]
push eax
push ecx
lea ecx, [esp + 0x350]
call fcn.00410470
mov edx, 0x451004
mov dword [esp + 0x4c4], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 0xa
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x249]
mov byte [esp + 0x248], bl
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x4cc]
mov byte [esp + 0x4c4], 1
stosw word es:[edi], ax
cmp ebp, ebx
stosb byte es:[edi], al
je 0x411330
mov esi, dword [esp + 0x4d0]
cmp esi, ebx
je 0x411330
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x410fcb
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x40]
push ebp
push edx
mov dword [esp + 0x24], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x40]
push eax
call edi
cmp byte [esp + eax + 0x3f], 0x5c
jne 0x410f61
lea ecx, [esp + 0x40]
push ecx
call edi
mov byte [esp + eax + 0x3f], bl
lea edx, [esp + 0x40]
push 0x5c
push edx
call fcn.004234fc
add esp, 8
test eax, eax
je 0x410f85
lea eax, [esp + 0x40]
push 0x5c
push eax
call fcn.004234fc
add esp, 8
mov byte [eax], bl
push 1
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0043fe6a
lea eax, [esp + 0x28]
mov byte [esp + 0x4cc], 3
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebp
call fcn.0043fe6a
lea ecx, [esp + 0x358]
mov byte [esp + 0x4d4], 1
call fcn.004108d0
jmp 0x411056
push ebp
lea ecx, [esp + 0x14]
call fcn.0043fe6a
push ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c8], 4
call fcn.0043fe6a
sub esp, 0x10
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], esp
mov edi, esp
push ecx
mov ecx, edi
mov byte [esp + 0x4d8], 5
mov dword [esp + 0x2c], edi
call fcn.0043fb71
lea edx, [esp + 0x20]
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x4d8], 6
call fcn.0043fb71
lea ecx, [esp + 0x30]
mov byte [edi + 8], bl
mov dword [edi + 0xc], ebx
mov byte [esp + 0x4d4], 5
call fcn.004113a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c4], 4
call fcn.0043fdfc
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c4], 1
call fcn.0043fdfc
lea eax, [esp + 0x144]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x143], 0x5c
je 0x411097
lea ecx, [esp + 0x144]
push str.NC.
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x144]
push eax
push edx
push str._s_x08.tmp
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x348]
push esi
call fcn.00410520
test eax, eax
jne 0x411108
mov dword [esp + 0x20], 0x451004
mov edi, dword [esp + 0x24]
mov byte [esp + 0x4c4], 7
cmp edi, ebx
je 0x4110ef
lea eax, [edi + 8]
push 1
push eax
call fcn.004116f0
mov edi, dword [edi]
cmp edi, ebx
jne 0x4110de
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
jmp 0x41134e
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x411295
jmp 0x41111a
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea ebp, [eax + 8]
mov dword [esp + 0x14], ecx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
lea edx, [esp + 0x248]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push ebx
stosb byte es:[edi], al
mov eax, dword [ebp]
push ebx
push ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.00423b43
add esp, 0x14
lea eax, [esp + 0x248]
push str..CDG
push eax
call fcn.00423dfa
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41124a
mov ecx, dword [esp + 0x4d8]
mov dword [esp + 0x10], 1
cmp ecx, ebx
je 0x41124a
mov edx, dword [esp + 0x4d4]
mov eax, dword [ebp]
push edx
lea edx, [esp + 0x44]
push edx
push eax
call ecx
add esp, 0xc
test eax, eax
je 0x41128b
mov eax, dword [ebp + 4]
lea esi, [ebp + 4]
lea ecx, [esp + 0x18]
mov eax, dword [eax - 8]
add eax, 0xfffffffc
push eax
push ecx
mov ecx, esi
call fcn.0043956c
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 8
call fcn.0043ff35
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c4], 1
call fcn.0043fdfc
mov eax, dword [esi]
lea edx, [esp + 0x248]
push edx
push ebx
push ebx
push ebx
push eax
call fcn.00423b43
lea eax, [esp + 0x25c]
push eax
call fcn.0042445a
mov ecx, dword [esp + 0x4ec]
mov edi, eax
push ecx
call fcn.0042445a
add esp, 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41123e
push 0x4635a0
mov ecx, esi
call fcn.004399d0
mov edx, dword [esp + 0x4d4]
mov ecx, esi
push edx
call fcn.004401d8
lea eax, [esp + 0x40]
mov ecx, ebp
push eax
call fcn.0043ff85
mov dl, byte [ebp + 8]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebp + 4]
mov edi, dword [ebp]
neg dl
sbb edx, edx
push ecx
neg edx
dec edx
lea ecx, [esp + 0x34c]
push edx
push eax
push edi
call fcn.00410780
test eax, eax
je 0x41127a
mov dword [esp + 0x3c], 1
cmp dword [esp + 0x10], ebx
je 0x41128b
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], ebx
jne 0x411116
lea ecx, [esp + 0x348]
call fcn.00410700
mov dword [esp + 0x20], 0x451004
mov ebp, dword [esp + 0x24]
mov byte [esp + 0x4c4], 9
cmp ebp, ebx
je 0x4112f6
lea esi, [ebp + 8]
xor edi, edi
mov dword [esp + 0x1c], esi
lea ecx, [esi + 4]
mov byte [esp + 0x4c4], 0xa
call fcn.0043fdfc
mov ecx, esi
mov byte [esp + 0x4c4], 9
call fcn.0043fdfc
add esi, 0x10
mov ecx, edi
dec edi
mov dword [esp + 0x1c], esi
test ecx, ecx
jne 0x4112c2
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x4112b9
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0043ad17
lea ecx, [esp + 0x348]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x4c4], 0xffffffff
call fcn.004104d0
mov eax, dword [esp + 0x3c]
jmp 0x411370
mov dword [esp + 0x20], edx
mov byte [esp + 0x4c4], 2
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
xor ecx, ecx
call fcn.0043ad17
lea ecx, [esp + 0x348]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x4c4], 0xffffffff
call fcn.004104d0
xor eax, eax
mov ecx, dword [esp + 0x4bc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x4b8
ret