Function at 0x405972
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
cmp dword [ebp + 0x14], 0
push ebx
push esi
push edi
jne 0x4059a7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40599f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4059a7
push 1
pop eax
jmp 0x405bda
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x4059b5
mov dword [eax], 1
push 5
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x405bda
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, 0x104
lea eax, [ebp - 0x834]
push ebx
push eax
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
jne 0x4059fc
push dword [ebp + 8]
lea eax, [ebp - 0x834]
push eax
call edi
cmp dword [ebp + 0x14], 0
jne 0x405a09
push 0x41608c
jmp 0x405a2d
lea eax, [ebp - 0x21c]
push ebx
push eax
push dword [ebp + 0x14]
call esi
test eax, eax
jne 0x405a26
push dword [ebp + 0x14]
lea eax, [ebp - 0x21c]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call edi
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0xc34]
push str._hs_hs_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, str._Rename__r_n
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x10
mov dword [ebp + 8], eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x62c]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x62c]
push str.WinInit.Ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor esi, esi
lea eax, [ebp - 0x62c]
push esi
push 0x8000080
push 4
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 4], edi
jne 0x405ac5
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
jne 0x405abe
mov dword [eax], 1
xor eax, eax
jmp 0x405bda
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp + 8]
push esi
lea eax, [ebx + eax + 0xa]
push eax
push esi
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x405bb2
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x405b97
lea eax, [ebp - 0x14]
push eax
push edi
call sub.MSVCRT.dll_strstr
pop ecx
cmp eax, esi
pop ecx
jne 0x405b31
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + ebx]
push 0x416054
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add ebx, eax
mov dword [ebp + 0x14], ebx
jmp 0x405b59
push 0xa
push eax
call sub.MSVCRT.dll_strchr
mov esi, eax
mov eax, edi
inc esi
sub eax, esi
add eax, ebx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push esi
push eax
call sub.MSVCRT.dll_memmove
sub esi, edi
add esp, 0x14
mov dword [ebp + 0x14], esi
xor esi, esi
lea eax, [ebp - 0xc34]
push eax
push edi
call sub.MSVCRT.dll_strstr
pop ecx
test eax, eax
pop ecx
jne 0x405b84
push dword [ebp + 8]
lea eax, [ebp - 0xc34]
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add ebx, dword [ebp + 8]
mov dword [ebp + 0xc], 1
jmp 0x405ba4
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
jne 0x405ba4
mov dword [eax], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 4]
jmp 0x405bbf
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
jne 0x405bbf
mov dword [eax], 1
push esi
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x10