Function at 0x41bf40
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5282d8
mov eax, dword fs:[0]
push eax
sub esp, 0x6cc
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6d0], ebx
mov dword [ecx], 0
mov ecx, eax
call fcn.00404470
test al, al
jne 0x41c3d3
mov ecx, esi
call fcn.00404470
test al, al
jne 0x41c3d3
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x41c3d3
push esi
call fcn.0048de30
add esp, 4
test al, al
je 0x41c3bb
lea ecx, [ebp - 0x6cc]
call fcn.00496160
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x69c]
call fcn.00402a90
mov byte [ebp - 4], 1
mov eax, dword [0x58e9c4]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x58e9c4
test eax, eax
je 0x41c013
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
mov ecx, 0x58e9c8
call fcn.00404470
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test al, al
jne 0x41c063
push 0x58e9c8
call fcn.00402d80
lea ecx, [ebp - 0x69c]
add esp, 4
cmp ecx, eax
je 0x41c127
mov ecx, 0x58e9c8
call fcn.00402ab0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x41c05a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x41c11c
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e48c0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x41c310
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004e48c0
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x41c105
test eax, eax
je 0x41c105
add eax, eax
cmp eax, 0x412
jae 0x41c3f1
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.00402d30
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x41c11b
lea eax, [ebp - 0x220]
push eax
call fcn.00402d30
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x69c]
call fcn.00402b20
mov byte [ebp - 4], 1
mov eax, dword [0x58e9c4]
test eax, eax
je 0x41c13b
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x63c], 0
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.0048f1b0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
push 0xb
call fcn.00403390
push eax
mov ecx, esi
call fcn.00403390
push eax
call edi
test eax, eax
jne 0x41c217
lea ecx, [ebp - 0x66c]
xor bl, bl
call fcn.00402a90
mov byte [ebp - 4], 4
lea edx, [ebp - 0x66c]
mov ecx, esi
call fcn.004b0950
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp - 0x6b4]
call fcn.00402a90
mov byte [ebp - 4], 5
lea edx, [ebp - 0x6b4]
lea ecx, [ebp - 0x654]
call fcn.004b0950
test al, al
jne 0x41c1d9
test bl, bl
je 0x41c243
push 0xb
lea ecx, [ebp - 0x6b4]
call fcn.00403390
push eax
lea ecx, [ebp - 0x66c]
call fcn.00403390
push eax
call edi
test eax, eax
je 0x41c243
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6b4]
call fcn.00402a30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.00402a30
push 4
push 0
lea ecx, [ebp - 0x654]
call fcn.00403390
push eax
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x654]
call fcn.00402a30
mov ebx, dword [ebp - 0x6d0]
jmp 0x41c32e
lea ecx, [ebp - 0x654]
call fcn.004b0350
cmp eax, 0xffffffff
je 0x41c2db
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x684]
call fcn.00404520
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x684]
call fcn.004b0710
test al, al
je 0x41c2cc
lea edx, [ebp - 0x684]
lea ecx, [ebp - 0x654]
call fcn.004b03f0
test al, al
je 0x41c2cc
lea edx, [ebp - 0x654]
mov ecx, esi
call fcn.004b03f0
lea ecx, [ebp - 0x684]
test al, al
je 0x41c2c1
call fcn.004b0500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x684]
call fcn.00402a30
jmp 0x41c1f9
lea edx, [ebp - 0x654]
call fcn.004b03f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x684]
call fcn.00402a30
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6b4]
call fcn.00402a30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.00402a30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x654]
call fcn.00402a30
mov ebx, dword [ebp - 0x6d0]
jmp 0x41c32e
mov byte [ebp - 4], 1
mov eax, dword [0x58e9c4]
test eax, eax
je 0x41c324
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
push esi
call fcn.0048de30
add esp, 4
test al, al
je 0x41c39a
mov ecx, ebx
call fcn.0048e4d0
test al, al
je 0x41c39a
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x66c]
push ebx
push eax
call fcn.0048f1b0
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x66c]
push 1
call fcn.00403390
push eax
mov ecx, esi
call fcn.00403390
push eax
call edi
push 4
push 0
lea ecx, [ebp - 0x66c]
call fcn.00403390
push eax
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x66c]
call fcn.00402a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x69c]
call fcn.00402a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6cc]
call fcn.00402a30
push dword [ebp - 0x6d4]
mov ecx, dword [ebp - 0x6d8]
mov edx, esi
call fcn.0041bbc0
add esp, 4
jmp 0x41c3d5
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret
call fcn.004e2671
int3