Function at 0x4b6910
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a42f6
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x4e8]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov word [esp + 0x4cc], 0x5c
mov dword [esp + 0x4d0], eax
mov dword [esp + 0x4d4], eax
mov dword [esp + 0x4f0], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0xa
mov dword [esp + 0x4c], eax
lea edi, [ecx + 8]
lea eax, [esp + 0x18]
push edi
push eax
mov ebx, str.QPC.TMP
mov byte [esp + 0x4f8], 1
mov dword [esp + 0x74], edi
call fcn.00412480
add esp, 8
mov byte [esp + 0x4f0], 2
mov eax, dword [eax]
lea esi, [esp + 0x74]
call fcn.0049c410
mov esi, eax
mov byte [esp + 0x4f0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b69f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
cmp esi, ebx
je 0x4b6a98
lea ebx, [ebx]
lea ecx, [esp + 0x18]
push edi
push ecx
lea ebx, [esp + 0xa8]
call fcn.00412480
add esp, 8
mov byte [esp + 0x4f0], 3
mov esi, dword [eax]
push esi
lea ecx, [esp + 0x3c]
call fcn.00468e80
test eax, eax
jne 0x4b6a3a
mov eax, esi
lea ebx, [esp + 0x38]
call fcn.004ac5f0
jmp 0x4b6a3e
mov byte [eax + 4], 0
mov byte [esp + 0x4f0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6a66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4d0]
test eax, eax
je 0x4b6a96
cmp dword [esp + 0x4d4], 0
je 0x4b6a96
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov dword [esp + 0x4d4], eax
jne 0x4b6a00
xor ebx, ebx
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x4f0], 4
mov eax, dword [edi]
push str.CINI
push eax
lea esi, [esp + 0x20]
call fcn.004b66a0
mov edi, dword [esp + 0x20]
add esp, 8
lea ecx, [esp + 0x28]
push ecx
call fcn.004d0e10
push edi
mov byte [esp + 0x4f4], 5
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4f0], 6
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x4f0], 7
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x14]
push eax
lea esi, [esp + 0x60]
mov byte [esp + 0x4f4], 9
call fcn.004d1210
lea ecx, [esp + 0x1c]
push ecx
mov eax, esi
call fcn.004d0d90
test eax, eax
je 0x4b6da2
push 0x5bcc3c
xor ebx, ebx
lea eax, [esp + 0x24]
call fcn.00404050
mov esi, dword [esp + 0x20]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x32
or eax, ecx
jge 0x4b6bb9
lea ecx, [ebx + 0x32]
lea eax, [esp + 0x20]
call fcn.00403d50
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x20]
mov ebx, 0x30
push ebx
push esi
push 0
push str.LastUpdate
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esi - 8], ebx
jl 0x4b6dcb
mov eax, esi
mov dword [esi - 0xc], ebx
mov word [esi + 0x60], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6bf0
sub eax, edx
sar eax, 1
js 0x4b6dcb
cmp eax, dword [esi - 8]
jg 0x4b6dcb
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
push 0xa
lea ecx, [esp + 0x74]
push ecx
push esi
call fcn.0057cf6e
xor esi, esi
or esi, eax
mov eax, dword [esp + 0x3c]
xor ecx, ecx
or edx, ecx
or ecx, eax
mov eax, dword [esp + 0x40]
xor edi, edi
or eax, edi
add esp, 0xc
cmp eax, edx
jb 0x4b6d8a
ja 0x4b6c4d
cmp ecx, esi
jb 0x4b6d8a
sub ecx, esi
sbb eax, edx
cmp eax, 0x580
jg 0x4b6d8a
jl 0x4b6c6a
cmp ecx, 0x28e44000
ja 0x4b6d8a
mov esi, dword [esp + 0x24]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x32
or eax, ecx
jge 0x4b6c92
mov ecx, 0x32
lea eax, [esp + 0x24]
call fcn.00403d50
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edi, dword [esp + 0x1c]
push eax
push ebx
push esi
push 0
push str.TempFile
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esi - 8], ebx
jl 0x4b6dcb
mov eax, esi
mov dword [esi - 0xc], ebx
mov word [esi + 0x60], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6cc4
sub eax, edx
sar eax, 1
js 0x4b6dcb
cmp eax, dword [esi - 8]
jg 0x4b6dcb
mov ebx, dword [esp + 0x6c]
mov dword [esi - 0xc], eax
lea edx, [esp + 0x24]
mov word [esi + eax*2], cx
push edx
lea eax, [esp + 0x6c]
push eax
call fcn.00423280
mov eax, dword [eax]
add esp, 8
push eax
lea ecx, [esp + 0x3c]
call fcn.00468e80
xor esi, esi
cmp eax, esi
je 0x4b6d1e
mov ebx, eax
lea esi, [esp + 0x38]
call fcn.004689f0
xor esi, esi
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b6d3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edi, [esp + 0x58]
mov byte [esp + 0x4f8], 0xa
call fcn.004d1070
mov edx, dword [esp + 0x1c]
push edx
mov eax, edi
lea ecx, [esp + 0x2c]
call fcn.004d1440
mov byte [esp + 0x4f0], 9
mov eax, dword [esp + 0x50]
push eax
call fcn.00578327
add esp, 4
mov dword [esp + 0x50], esi
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x60]
call fcn.004d0d90
test eax, eax
jne 0x4b6b83
xor ebx, ebx
mov edx, dword [esp + 0x38]
cmp edx, ebx
mov ecx, dword [esp + 0x4c]
je 0x4b6dd5
cmp edx, ecx
je 0x4b6dd5
mov eax, dword [edx + 0xc]
cmp eax, ecx
je 0x4b6dd7
lea esp, [esp]
mov edx, eax
mov eax, dword [edx + 0xc]
cmp eax, ecx
jne 0x4b6dc0
jmp 0x4b6dd7
push 0x80070057
call fcn.00404550
xor edx, edx
cmp edx, ebx
mov esi, edx
je 0x4b6e45
jmp 0x4b6de4
mov ecx, dword [esp + 0x4c]
cmp esi, ebx
mov edi, esi
jne 0x4b6dee
xor esi, esi
jmp 0x4b6e38
mov edx, dword [esi + 0x10]
cmp edx, ecx
je 0x4b6e13
cmp edx, ebx
je 0x4b6e0d
mov eax, dword [edx + 0xc]
cmp eax, ecx
je 0x4b6e0f
mov edx, eax
mov eax, dword [edx + 0xc]
cmp eax, ecx
jne 0x4b6e00
mov esi, edx
jmp 0x4b6e38
xor edx, edx
mov esi, edx
jmp 0x4b6e38
mov eax, dword [esi + 0x14]
cmp eax, ecx
je 0x4b6e34
lea ebx, [ebx]
cmp esi, dword [eax + 0x10]
jne 0x4b6e30
mov esi, eax
mov eax, dword [eax + 0x14]
cmp eax, ecx
jne 0x4b6e20
jmp 0x4b6e34
cmp eax, ecx
jne 0x4b6e36
xor eax, eax
mov esi, eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, ebx
jne 0x4b6de0
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
sub eax, 0x10
call fcn.00403ce0
lea esi, [eax + 0x10]
mov dword [esp + 0x70], esi
push 0x5bcc3c
xor ebx, ebx
lea eax, [esp + 0x2c]
mov byte [esp + 0x4f4], 0xb
call fcn.00404050
mov eax, dword [esp + 0x2c]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4b6e87
push eax
call edi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x14]
push 0x5bcc3c
xor ebx, ebx
call fcn.00404050
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x4b6eac
push eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esp + 0x18]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test esi, esi
jne 0x4b6ec7
xor eax, eax
jmp 0x4b6edf
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b6ed0
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [esp + 0x14]
push esi
call fcn.00404050
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp eax, ebx
je 0x4b6f02
push eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], ebx
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [esp + 0x4f0], 9
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6f31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00578327
mov byte [esp + 0x4f4], 7
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6f66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4f0], 6
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b6f8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4f0], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b6fb6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x4f4], 4
call fcn.004d0e80
lea eax, [edi - 0x10]
mov byte [esp + 0x4f0], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6fec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [esp + 0x38]
call fcn.004af2c0
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x4b7006
push eax
call fcn.0057876f
add esp, 4
mov eax, dword [esp + 0x4d0]
cmp eax, ebx
mov dword [esp + 0x4d4], ebx
je 0x4b7024
cmp eax, 0xffffffff
je 0x4b7024
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x4e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret