Function at 0x4ceba0
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x600956
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebx
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x4e8]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov word [esp + 0x4cc], 0x5c
mov dword [esp + 0x4d0], eax
mov dword [esp + 0x4d4], eax
mov dword [esp + 0x4f0], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0xa
mov dword [esp + 0x4c], eax
lea edi, [ecx + 8]
lea eax, [esp + 0x18]
push edi
push eax
mov ebx, str.QPC.TMP
mov byte [esp + 0x4f8], 1
mov dword [esp + 0x74], edi
call fcn.0040aab0
add esp, 8
mov byte [esp + 0x4f0], 2
mov eax, dword [eax]
lea esi, [esp + 0x74]
call fcn.0040ad20
mov esi, eax
mov byte [esp + 0x4f0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cec80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
cmp esi, ebx
je 0x4ced28
lea ebx, [ebx]
lea ecx, [esp + 0x18]
push edi
push ecx
lea ebx, [esp + 0xa8]
call fcn.0040aab0
add esp, 8
mov byte [esp + 0x4f0], 3
mov esi, dword [eax]
push esi
lea ecx, [esp + 0x3c]
call fcn.004c39a0
test eax, eax
jne 0x4cecca
mov eax, esi
lea ebx, [esp + 0x38]
call fcn.004c37c0
jmp 0x4cecce
mov byte [eax + 4], 0
mov byte [esp + 0x4f0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cecf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4d0]
test eax, eax
je 0x4ced26
cmp dword [esp + 0x4d4], 0
je 0x4ced26
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov dword [esp + 0x4d4], eax
jne 0x4cec90
xor ebx, ebx
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x4f0], 4
mov eax, dword [edi]
push str.CINI
push eax
lea esi, [esp + 0x20]
call fcn.004ce930
mov edi, dword [esp + 0x20]
add esp, 8
lea ecx, [esp + 0x28]
push ecx
call fcn.0050ea10
push edi
mov byte [esp + 0x4f4], 5
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4f0], 6
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x4f0], 7
mov eax, dword [0x677600]
mov edx, dword [eax + 0xc]
mov ecx, 0x677600
call edx
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x14]
push eax
lea esi, [esp + 0x60]
mov byte [esp + 0x4f4], 9
call fcn.0050ee10
lea ecx, [esp + 0x1c]
push ecx
mov eax, esi
call fcn.0050e990
test eax, eax
je 0x4cf032
push 0x6244e0
xor ebx, ebx
lea eax, [esp + 0x24]
call fcn.004037a0
mov esi, dword [esp + 0x20]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x32
or eax, ecx
jge 0x4cee49
lea ecx, [ebx + 0x32]
lea eax, [esp + 0x20]
call fcn.00403540
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x20]
mov ebx, 0x30
push ebx
push esi
push 0
push str.LastUpdate
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esi - 8], ebx
jl 0x4cf05b
mov eax, esi
mov dword [esi - 0xc], ebx
mov word [esi + 0x60], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cee80
sub eax, edx
sar eax, 1
js 0x4cf05b
cmp eax, dword [esi - 8]
jg 0x4cf05b
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
push 0xa
lea ecx, [esp + 0x74]
push ecx
push esi
call fcn.005d6a67
xor esi, esi
or esi, eax
mov eax, dword [esp + 0x3c]
xor ecx, ecx
or edx, ecx
or ecx, eax
mov eax, dword [esp + 0x40]
xor edi, edi
or eax, edi
add esp, 0xc
cmp eax, edx
jb 0x4cf01a
ja 0x4ceedd
cmp ecx, esi
jb 0x4cf01a
sub ecx, esi
sbb eax, edx
cmp eax, 0x580
jg 0x4cf01a
jl 0x4ceefa
cmp ecx, 0x28e44000
ja 0x4cf01a
mov esi, dword [esp + 0x24]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x32
or eax, ecx
jge 0x4cef22
mov ecx, 0x32
lea eax, [esp + 0x24]
call fcn.00403540
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edi, dword [esp + 0x1c]
push eax
push ebx
push esi
push 0
push str.TempFile
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esi - 8], ebx
jl 0x4cf05b
mov eax, esi
mov dword [esi - 0xc], ebx
mov word [esi + 0x60], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cef54
sub eax, edx
sar eax, 1
js 0x4cf05b
cmp eax, dword [esi - 8]
jg 0x4cf05b
mov ebx, dword [esp + 0x6c]
mov dword [esi - 0xc], eax
lea edx, [esp + 0x24]
mov word [esi + eax*2], cx
push edx
lea eax, [esp + 0x6c]
push eax
call fcn.0041eb50
mov eax, dword [eax]
add esp, 8
push eax
lea ecx, [esp + 0x3c]
call fcn.004c39a0
xor esi, esi
cmp eax, esi
je 0x4cefae
mov ebx, eax
lea esi, [esp + 0x38]
call fcn.0045f350
xor esi, esi
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cefce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edi, [esp + 0x58]
mov byte [esp + 0x4f8], 0xa
call fcn.0050ec70
mov edx, dword [esp + 0x1c]
push edx
mov eax, edi
lea ecx, [esp + 0x2c]
call fcn.0050f040
mov byte [esp + 0x4f0], 9
mov eax, dword [esp + 0x50]
push eax
call fcn.005d2367
add esp, 4
mov dword [esp + 0x50], esi
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x60]
call fcn.0050e990
test eax, eax
jne 0x4cee13
xor ebx, ebx
mov edx, dword [esp + 0x38]
cmp edx, ebx
mov ecx, dword [esp + 0x4c]
je 0x4cf065
cmp edx, ecx
je 0x4cf065
mov eax, dword [edx + 0xc]
cmp eax, ecx
je 0x4cf067
lea esp, [esp]
mov edx, eax
mov eax, dword [edx + 0xc]
cmp eax, ecx
jne 0x4cf050
jmp 0x4cf067
push 0x80070057
call fcn.00403650
xor edx, edx
cmp edx, ebx
mov esi, edx
je 0x4cf0d5
jmp 0x4cf074
mov ecx, dword [esp + 0x4c]
cmp esi, ebx
mov edi, esi
jne 0x4cf07e
xor esi, esi
jmp 0x4cf0c8
mov edx, dword [esi + 0x10]
cmp edx, ecx
je 0x4cf0a3
cmp edx, ebx
je 0x4cf09d
mov eax, dword [edx + 0xc]
cmp eax, ecx
je 0x4cf09f
mov edx, eax
mov eax, dword [edx + 0xc]
cmp eax, ecx
jne 0x4cf090
mov esi, edx
jmp 0x4cf0c8
xor edx, edx
mov esi, edx
jmp 0x4cf0c8
mov eax, dword [esi + 0x14]
cmp eax, ecx
je 0x4cf0c4
lea ebx, [ebx]
cmp esi, dword [eax + 0x10]
jne 0x4cf0c0
mov esi, eax
mov eax, dword [eax + 0x14]
cmp eax, ecx
jne 0x4cf0b0
jmp 0x4cf0c4
cmp eax, ecx
jne 0x4cf0c6
xor eax, eax
mov esi, eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, ebx
jne 0x4cf070
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
sub eax, 0x10
call fcn.0040a210
lea esi, [eax + 0x10]
mov dword [esp + 0x70], esi
push 0x6244e0
xor ebx, ebx
lea eax, [esp + 0x2c]
mov byte [esp + 0x4f4], 0xb
call fcn.004037a0
mov eax, dword [esp + 0x2c]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4cf117
push eax
call edi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x14]
push 0x6244e0
xor ebx, ebx
call fcn.004037a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x4cf13c
push eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esp + 0x18]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test esi, esi
jne 0x4cf157
xor eax, eax
jmp 0x4cf16f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4cf160
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [esp + 0x14]
push esi
call fcn.004037a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp eax, ebx
je 0x4cf192
push eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], ebx
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [esp + 0x4f0], 9
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cf1c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.005d2367
mov byte [esp + 0x4f4], 7
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cf1f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4f0], 6
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cf21e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4f0], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cf246
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x4f4], 4
call fcn.0050ea80
lea eax, [edi - 0x10]
mov byte [esp + 0x4f0], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4cf27c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [esp + 0x38]
call fcn.004c6cd0
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x4cf296
push eax
call fcn.005d27e0
add esp, 4
mov eax, dword [esp + 0x4d0]
cmp eax, ebx
mov dword [esp + 0x4d4], ebx
je 0x4cf2b4
cmp eax, 0xffffffff
je 0x4cf2b4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x4e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.005d28b3
mov esp, ebp
pop ebp
ret