Function at 0x401693
Capabilities:
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x8a8]
sub esp, 0x928
mov eax, dword [0x418420]
xor eax, ebp
mov dword [ebp + 0x8a4], eax
push esi
mov esi, dword [ebp + 0x8b0]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4018dc
push esi
push 0x414384
push str._hs_hs_r_n
lea eax, [ebp + 0x390]
push 0x400
push eax
call fcn.0040951d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4016fd
push 0x774
push str.sfxhead.c
call fcn.0040256a
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x390]
push edi
push eax
call fcn.00409910
mov esi, str._Rename__r_n
lea edi, [ebp + 0x898]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebx, eax
movsb byte es:[edi], byte [esi]
lea eax, [ebp + 0x790]
mov dword [esp], 0x104
xor esi, esi
push eax
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x105
lea eax, [ebp + 0x790]
push edi
push eax
call fcn.0040129b
push str.WinInit.Ini
lea eax, [ebp + 0x790]
push edi
push eax
call fcn.004093fb
push eax
call section..text
add esp, 0x18
test al, al
jne 0x401778
push 0x77f
push str.sfxhead.c
call fcn.0040256a
pop ecx
pop ecx
push esi
push 0x8000080
push 4
push esi
push esi
push 0xc0000000
lea eax, [ebp + 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x4018da
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push esi
push 4
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 0x80], eax
je 0x4018bc
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x4018b3
lea ecx, [ebp + 0x898]
push ecx
push eax
call fcn.004092a0
cmp eax, esi
pop ecx
pop ecx
jne 0x401861
lea eax, [ebp + 0x898]
push eax
push 0x41435c
lea eax, [ebp - 0x70]
push 0x400
push eax
call fcn.0040951d
add esp, 0x10
cmp eax, 0xffffffff
jne 0x401825
push 0x79d
push str.sfxhead.c
call fcn.0040256a
pop ecx
pop ecx
lea eax, [ebp - 0x70]
push eax
call fcn.00409910
add edi, eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebx + 0xa]
push eax
mov eax, dword [ebp - 0x74]
add eax, edi
push eax
call fcn.0040951d
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40185c
push 0x7a0
push str.sfxhead.c
call fcn.0040256a
pop ecx
pop ecx
mov dword [ebp - 0x7c], edi
jmp 0x40188f
push 0xa
push eax
call fcn.004091e0
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40188d
mov eax, dword [ebp - 0x74]
inc esi
sub eax, esi
add eax, edi
push eax
lea eax, [esi + ebx]
push esi
push eax
call fcn.004095a0
add esp, 0xc
sub esi, dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
xor esi, esi
mov ecx, dword [ebp - 0x7c]
push ebx
lea eax, [ebp + 0x390]
push eax
mov eax, dword [ebp - 0x74]
add eax, ecx
push eax
call fcn.00401329
add esp, 0xc
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp + 0x8a4]
xor ecx, ebp
pop esi
call fcn.00409326
add ebp, 0x8a8
leave
ret