Function at 0x404bc0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d4d1
mov eax, dword fs:[0]
push eax
sub esp, 0x8f8
mov eax, dword [0x427120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x522]
push ecx
mov word [ebp - 0x524], ax
call fcn.0040ae90
add esp, 0xc
lea ecx, [ebp - 0x87c]
call fcn.00406620
push str.Spooler
lea ecx, [ebp - 0x87c]
mov dword [ebp - 4], 0
call fcn.00406640
mov bl, al
mov byte [ebp - 0x869], bl
call fcn.004065d0
test eax, eax
je 0x404c59
push str.PdfsInstaller.DeleteFiles__Before_stop_spooler...
push 0x41e6ec
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
test bl, bl
je 0x404c75
push 0x4e20
push 1
lea ecx, [ebp - 0x87c]
call fcn.00406680
mov dword [ebp - 0x884], eax
call fcn.004065d0
test eax, eax
je 0x404c96
push str.PdfsInstaller.DeleteFiles__spooler_stoped__start_delete_files
push 0x41e6ec
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
cmp dword [esi + 0x354], 8
lea ecx, [esi + 0x33c]
mov dword [ebp - 0x880], ecx
jb 0x404cb0
mov ecx, dword [ecx + 4]
jmp 0x404cb3
add ecx, 4
lea edx, [ebp - 0x524]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x404cc0
push 0x103
lea edx, [ebp - 0x72b]
push 0
push edx
mov byte [ebp - 0x72c], al
call fcn.0040ae90
add esp, 0xc
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x404d06
xor eax, eax
jmp 0x404d22
lea esi, [eax + eax]
mov eax, esi
call fcn.0040ae60
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x524]
push ecx
push eax
call fcn.00401000
lea edx, [ebp - 0x72c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x404d28
xor eax, eax
jmp 0x404d40
mov cl, byte [ebp + eax - 0x72c]
mov byte [ebp + eax - 0x31c], cl
inc eax
test cl, cl
jne 0x404d40
mov eax, dword [0x427020]
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404d60
lea edi, [ebp - 0x31c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404d70
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x31c]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00408530
mov ebx, 1
add esp, 4
cmp eax, ebx
mov dword [ebp - 0x870], eax
jl 0x404ef0
jmp 0x404db0
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x31c]
push ebx
push ecx
call fcn.004085c0
add esp, 0xc
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jg 0x404e0e
lea eax, [esi + esi]
call fcn.0040ae60
mov edi, esp
test edi, edi
je 0x404e0e
push esi
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x628]
xor eax, eax
push ecx
push eax
push 3
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, edi
jmp 0x404e10
xor eax, eax
mov ecx, eax
lea edx, [ebp - 0x830]
jmp 0x404e20
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x404e20
xor eax, eax
jmp 0x404e40
movzx ecx, word [ebp + eax - 0x524]
mov word [ebp + eax - 0x218], cx
add eax, 2
test cx, cx
jne 0x404e40
lea eax, [ebp - 0x830]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404e60
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404e76
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x218]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404eba
call fcn.004065d0
test eax, eax
je 0x404ee3
lea eax, [ebp - 0x218]
push eax
push str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x404ed5
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004065d0
test eax, eax
je 0x404ee3
lea ecx, [ebp - 0x218]
push ecx
push str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x870]
jle 0x404db0
mov edx, dword [str.dopdfpr7.dll]
mov eax, dword [str.dopdfui7.dll]
mov ecx, dword [str.dopdfmn7.dll]
mov dword [ebp - 0x904], edx
mov edx, dword [str.dopdfmi7.dll]
xor ebx, ebx
push 0x58
mov dword [ebp - 0x8ec], edx
mov dword [ebp - 0x900], eax
mov eax, dword [str.dopdfmo7.dll]
mov dword [ebp - 0x8f0], ecx
mov ecx, dword [str.dopdfmu7.dll]
lea edx, [ebp - 0x8dc]
push ebx
push edx
mov dword [ebp - 0x8fc], str.dopdf7.chm
mov dword [ebp - 0x8f8], 0x41e91c
mov dword [ebp - 0x8f4], 0x41e934
mov dword [ebp - 0x8e8], eax
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8e0], ebx
call fcn.0040ae90
mov ecx, str.dopdfcl7.exe
mov eax, ecx
add esp, 0xc
lea esi, [ebx + 8]
lea edi, [eax + 2]
jmp 0x404f80
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404f80
sub eax, edi
sar eax, 1
je 0x404fd1
cmp esi, 0x1f
jge 0x404fd1
mov eax, ecx
mov dword [ebp + esi*4 - 0x904], ecx
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404fa2
sub eax, edi
sar eax, 1
lea ecx, [ecx + eax*2 + 2]
mov eax, ecx
inc esi
lea edi, [eax + 2]
jmp 0x404fc0
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404fc0
sub eax, edi
sar eax, 1
jne 0x404f91
lea eax, [ebp - 0x904]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x874], ebx
cmp eax, ebx
je 0x4052f2
mov ebx, eax
xor eax, eax
jmp 0x405000
movzx ecx, word [ebp + eax - 0x524]
mov word [ebp + eax - 0x218], cx
add eax, 2
test cx, cx
jne 0x405000
mov eax, ebx
mov edx, ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405020
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x405036
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str.dopdfmn7.dll]
mov eax, ebx
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405086
test dx, dx
je 0x405082
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405086
add eax, 4
add ecx, 4
test dx, dx
jne 0x405060
xor eax, eax
jmp 0x40508b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051c8
mov ecx, dword [str.dopdfmi7.dll]
mov eax, ebx
jmp 0x4050a0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4050c6
test dx, dx
je 0x4050c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4050c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4050a0
xor eax, eax
jmp 0x4050cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051c8
mov ecx, dword [str.dopdfmo7.dll]
mov eax, ebx
jmp 0x4050e0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405106
test dx, dx
je 0x405102
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405106
add eax, 4
add ecx, 4
test dx, dx
jne 0x4050e0
xor eax, eax
jmp 0x40510b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051c8
mov ecx, dword [str.dopdfmu7.dll]
mov eax, ebx
jmp 0x405120
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405146
test dx, dx
je 0x405142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405146
add eax, 4
add ecx, 4
test dx, dx
jne 0x405120
xor eax, eax
jmp 0x40514b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051c8
mov ecx, 0x41e934
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40517c
test dx, dx
je 0x405178
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40517c
add eax, 4
add ecx, 4
test dx, dx
jne 0x405156
xor eax, eax
jmp 0x405181
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051c8
mov ecx, 0x41e91c
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4051b6
test dx, dx
je 0x4051b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4051b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x405190
xor eax, eax
jmp 0x4051bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405232
cmp dword [ebp - 0x874], 7
jle 0x405232
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4051e3
mov edx, dword [0x420744]
mov eax, ebx
mov dword [edi], edx
mov edx, eax
jmp 0x405200
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405200
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x405216
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405264
inc dword [ebp - 0x874]
call fcn.004065d0
test eax, eax
je 0x4052d8
lea ecx, [ebp - 0x218]
push ecx
push str.PdfsInstaller.DeleteFiles__deleted_file:___s_
jmp 0x4052ca
cmp byte [ebp + 8], 0
jne 0x4052af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x4052d8
push 4
push 0
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.004065d0
test eax, eax
je 0x4052ab
lea eax, [ebp - 0x218]
push eax
push str.PdfsInstaller.DeleteFiles__file:___s__will_be_deleted_at_next_system_boot
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
call esi
jmp 0x4052d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004065d0
test eax, eax
je 0x4052d8
lea ecx, [ebp - 0x218]
push ecx
push str.PdfsInstaller.DeleteFiles__file:___s__could_not_be_deleted
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
mov eax, dword [ebp - 0x870]
mov ebx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x870], eax
test ebx, ebx
jne 0x404ff3
mov esi, dword [ebp - 0x880]
push 0xffffffffffffffff
xor edi, edi
push edi
xor edx, edx
push esi
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x854], edi
mov word [ebp - 0x864], dx
call fcn.00403da0
push 2
push 0x4209ec
lea ecx, [ebp - 0x868]
mov byte [ebp - 4], 1
call fcn.00403eb0
push 0xa
push 0x41e91c
lea ecx, [ebp - 0x868]
call fcn.00403eb0
mov eax, dword [ebp - 0x864]
mov ebx, 8
cmp dword [ebp - 0x850], ebx
jae 0x405363
lea eax, [ebp - 0x864]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, edi
je 0x405393
call fcn.004065d0
test eax, eax
je 0x4053c4
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x850], ebx
jae 0x40538b
lea eax, [ebp - 0x864]
push eax
push str.PdfsInstaller.DeleteFiles__deleted_custom_file:___s_
jmp 0x4053b6
call fcn.004065d0
test eax, eax
je 0x4053c4
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x850], ebx
jae 0x4053b0
lea eax, [ebp - 0x864]
push eax
push str.PdfsInstaller.DeleteFiles__Custom_file:___s__does_not_exist
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
push 0xffffffffffffffff
push edi
xor eax, eax
push esi
lea ecx, [ebp - 0x84c]
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], edi
mov word [ebp - 0x848], ax
call fcn.00403da0
push 2
push 0x4209ec
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 2
call fcn.00403eb0
push 0xa
push 0x41e934
lea ecx, [ebp - 0x84c]
call fcn.00403eb0
mov eax, dword [ebp - 0x848]
cmp dword [ebp - 0x834], ebx
jae 0x405428
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, edi
je 0x405458
call fcn.004065d0
test eax, eax
je 0x405489
mov eax, dword [ebp - 0x848]
cmp dword [ebp - 0x834], ebx
jae 0x405450
lea eax, [ebp - 0x848]
push eax
push str.PdfsInstaller.DeleteFiles__deleted_page_size_file:___s_
jmp 0x40547b
call fcn.004065d0
test eax, eax
je 0x405489
mov eax, dword [ebp - 0x848]
cmp dword [ebp - 0x834], ebx
jae 0x405475
lea eax, [ebp - 0x848]
push eax
push str.PdfsInstaller.DeleteFiles__Page_size_file:___s__does_not_exist
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
call fcn.004065d0
test eax, eax
je 0x4054aa
push str.PdfsInstaller.DeleteFiles__Before_start_spooler...
push 0x41e6ec
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
cmp byte [ebp - 0x869], 0
je 0x4054c6
cmp dword [ebp - 0x884], edi
jne 0x4054c6
lea ecx, [ebp - 0x87c]
call fcn.004068d0
lea ecx, [ebp - 0x87c]
call fcn.00406a20
call fcn.004065d0
test eax, eax
je 0x4054f2
push str.PdfsInstaller.DeleteFiles__spooler_has_started.
push 0x41e6ec
call fcn.004065d0
push eax
call fcn.004063d0
add esp, 0xc
cmp dword [ebp - 0x834], ebx
jb 0x405509
mov ecx, dword [ebp - 0x848]
push ecx
call fcn.0040adf0
add esp, 4
xor edx, edx
mov esi, 7
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x838], edi
mov word [ebp - 0x848], dx
cmp dword [ebp - 0x850], ebx
jb 0x40553a
mov eax, dword [ebp - 0x864]
push eax
call fcn.0040adf0
add esp, 4
xor ecx, ecx
mov word [ebp - 0x864], cx
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x854], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00406630
xor eax, eax
lea esp, [ebp - 0x914]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ae4c
mov esp, ebp
pop ebp
ret 4