Function at 0x40e846
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov eax, dword [0x413028]
cmp eax, 0x413028
je 0x40e877
test dword [eax + 0x1c], reloc.ADVAPI32.dll_TraceMessage
je 0x40e877
push 0x402488
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406dfe
push 1
push 0x4023d8
mov eax, 0x15a
lea esi, [ebp - 0x48]
call fcn.0040df9a
xor esi, esi
mov eax, 0x4013c0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x40e8c0
mov edi, 0x80070057
mov eax, 0x165
jmp 0x40ea63
mov eax, 0x166
mov word [ebp - 0x44], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
mov edx, ebx
mov dword [ebp - 0x48], esi
call fcn.0040e413
mov edi, eax
mov dword [ebp - 0x48], edi
mov eax, 0x16d
test edi, edi
js 0x40ea66
mov word [ebp - 0x44], ax
cmp dword [ebp - 4], esi
jne 0x40e90a
mov edi, esi
add eax, 5
mov dword [ebp - 0x48], edi
mov word [ebp - 0x44], ax
jmp 0x40ea6a
mov ecx, dword [ebp - 0xc]
push 4
pop eax
neg ecx
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebp - 0xc], ecx
cmp ecx, eax
jg 0x40ea6a
push 5
pop eax
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
cmp esi, eax
jl 0x40e991
push 0x401354
push esi
push ebx
push 0x4023ec
lea edi, [ebp - 0x18]
call fcn.00410069
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x48], edi
mov eax, 0x181
test edi, edi
js 0x40ea66
push dword [ebp - 0x18]
mov word [ebp - 0x44], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40ea26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
jne 0x40ea37
mov eax, 0x185
xor edi, edi
mov dword [ebp - 0x48], edi
mov word [ebp - 0x44], ax
jmp 0x40ea29
mov ecx, 0x4023ec
test esi, esi
jns 0x40e99f
mov ecx, 0x402400
mov eax, esi
cdq
xor eax, edx
push 0x401354
sub eax, edx
push eax
push ebx
push ecx
lea edi, [ebp - 0x18]
call fcn.00410069
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x48], edi
mov eax, 0x191
test edi, edi
js 0x40ea66
push 0x401354
push dword [ebp - 8]
lea edi, [ebp - 0x24]
push ebx
push 0x4023ec
mov word [ebp - 0x44], ax
call fcn.00410069
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x48], edi
mov eax, 0x196
test edi, edi
js 0x40ea66
push 1
push dword [ebp - 0x24]
mov word [ebp - 0x44], ax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40ea23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
jne 0x40ea4e
mov eax, 0x19b
jmp 0x40e983
dec dword [ebp - 8]
mov edi, dword [ebp - 0x48]
dec esi
cmp esi, dword [ebp - 0xc]
jl 0x40ea6a
mov eax, dword [ebp - 4]
jmp 0x40e92b
test edi, edi
jle 0x40ea47
and edi, 0xffff
or edi, 0x80070000
mov eax, 0x185
jmp 0x40ea63
test edi, edi
jle 0x40ea5e
and edi, 0xffff
or edi, 0x80070000
mov eax, 0x19b
mov dword [ebp - 0x48], edi
mov word [ebp - 0x42], ax
lea esi, [ebp - 0x24]
call fcn.0040fca0
lea esi, [ebp - 0x18]
call fcn.0040fca0
lea eax, [ebp - 0x48]
call fcn.0040e073
mov eax, edi
pop edi
pop esi
leave
ret