Function at 0x4063c0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x40a69b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00404360
lea eax, [esp + 0x18]
push 0xff
push eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x40d43c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40d495
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf003f
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x40d63c
push 0x80000002
lea ecx, [esp + 0x28]
call fcn.00404450
mov ebp, dword [sym.imp.msvcrt.dll_strrchr]
test eax, eax
jne 0x40656a
mov eax, dword [esp + 0x228]
test eax, eax
je 0x4064a0
push 0x40e508
push 0x40df98
jmp 0x406558
lea eax, [esp + 0x18]
push eax
call fcn.00405050
add esp, 4
test eax, eax
jne 0x4064cc
push eax
push 1
lea ecx, [esp + 0x20]
push 1
push ecx
push eax
call fcn.00405440
add esp, 0x14
test eax, eax
je 0x406561
mov edi, 0x40d495
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call ebp
add esp, 8
test eax, eax
je 0x40651a
lea edx, [esp + 0x118]
push 0x2e
push edx
call ebp
add esp, 8
mov byte [eax], 0
mov edi, 0x40df8c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e508
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.00404610
lea ecx, [esp + 0xc]
call fcn.00404430
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call ebp
mov edx, eax
add esp, 8
mov edi, 0x40d4c9
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xf003f
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
push 0x40d605
push 0x80000002
lea ecx, [esp + 0x28]
call fcn.00404450
test eax, eax
jne 0x4066a7
mov eax, dword [esp + 0x228]
test eax, eax
je 0x4065dd
push 0x40e508
push 0x40df7c
jmp 0x406695
lea ecx, [esp + 0x18]
push ecx
call fcn.00405050
add esp, 4
test eax, eax
jne 0x406609
push eax
push 1
lea edx, [esp + 0x20]
push 1
push edx
push eax
call fcn.00405440
add esp, 0x14
test eax, eax
je 0x40669e
mov edi, 0x40d4c9
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call ebp
add esp, 8
test eax, eax
je 0x406657
lea edx, [esp + 0x118]
push 0x2e
push edx
call ebp
add esp, 8
mov byte [eax], 0
mov edi, 0x40df78
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e508
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.00404610
lea ecx, [esp + 0xc]
call fcn.00404430
push 0xf003f
push 0x40df50
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.004044b0
test eax, eax
je 0x4066e3
push 0xf003f
push 0x40df3c
push 0x80000002
lea ecx, [esp + 0x18]
call fcn.004044b0
test eax, eax
jne 0x4068da
push 0
lea ecx, [esp + 0x1c]
push 0x40df30
push ecx
lea ecx, [esp + 0x18]
call fcn.00404550
test eax, eax
je 0x406719
push 0
lea edx, [esp + 0x1c]
push 0x40df28
push edx
lea ecx, [esp + 0x18]
call fcn.00404550
test eax, eax
jne 0x4068d1
push 1
push 0
push 0
lea eax, [esp + 0x24]
push 0x40d238
push eax
call fcn.00402500
add esp, 0x14
test eax, eax
je 0x406755
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call ebp
add esp, 8
test eax, eax
je 0x406755
lea edx, [esp + 0x18]
push 0x5c
push edx
call ebp
add esp, 8
mov byte [eax + 1], 0
lea eax, [esp + 0x18]
push 0x40d531
push eax
lea ecx, [esp + 0x120]
push 0x40df20
push ecx
call dword [sym.imp.msvcrt.dll_sprintf]
mov edi, 0x40d54b
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x228]
mov ecx, ebp
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40684d
lea eax, [esp + 0x118]
push eax
call fcn.00405050
add esp, 4
test eax, eax
je 0x4068d1
lea ecx, [esp + 0x18]
push ecx
call fcn.00405050
add esp, 4
test eax, eax
je 0x4068d1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x120]
push 0
push edx
call fcn.00404ed0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
test eax, eax
je 0x406806
push 0x1f4
call esi
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00404ed0
add esp, 0x10
test eax, eax
je 0x406824
push 0x1f4
call esi
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x118]
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.msvcrt.dll_rename]
add esp, 8
jmp 0x4068d1
lea ecx, [esp + 0x118]
push ecx
call fcn.00405050
add esp, 4
test eax, eax
je 0x4068d1
lea edx, [esp + 0x18]
push edx
call fcn.00405050
add esp, 4
test eax, eax
jne 0x4068d1
push eax
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x124]
push eax
call fcn.00404ed0
add esp, 0x10
test eax, eax
je 0x406895
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.msvcrt.dll_rename]
lea eax, [esp + 0x20]
push eax
call fcn.00405050
add esp, 0xc
test eax, eax
je 0x4068d1
push 0
push 1
lea ecx, [esp + 0x120]
push 1
push ecx
push 0
call fcn.00405440
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.00404430
lea ecx, [esp + 0xc]
mov dword [esp + 0x220], 0xffffffff
call fcn.004043a0
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x218
ret