Function at 0x42bca0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597c21
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x616738]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18c], ecx
lea ecx, [ebp - 0x140]
call fcn.004a2910
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004a2910
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x14]
call fcn.004a2910
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004a2910
mov byte [ebp - 4], 3
mov dword [ebp - 0x144], 0
lea ecx, [ebp - 0x2c]
call fcn.004a2910
mov byte [ebp - 4], 4
push 0x5a6b78
lea ecx, [ebp - 0x2c]
call fcn.00409090
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14c], esp
push 0x5a6ba8
call fcn.00408ff0
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x194], eax
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x150], esp
lea edx, [ebp - 0x2c]
push edx
call fcn.00408fd0
mov dword [ebp - 0x198], eax
push reloc.WS2_32.dll_accept
mov byte [ebp - 4], 4
call fcn.00492d60
add esp, 0x14
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 1
jmp 0x42bdb9
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x144]
add edx, 1
cmp dword [ebp - 0x18], edx
jge 0x42bea1
push 0
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x154], esp
push 0x5a6bb4
call fcn.00408ff0
mov dword [ebp - 0x1a0], eax
lea edx, [ebp - 0x158]
push edx
mov ecx, dword [ebp - 0x18c]
call fcn.0042c2c0
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00409070
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x158]
call fcn.00408330
lea ecx, [ebp - 0x24]
call fcn.00408290
movzx edx, al
test edx, edx
je 0x42be9c
mov dword [ebp - 0x15c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00408330
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00408330
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.00408330
mov eax, dword [ebp - 0x15c]
jmp 0x42c29e
jmp 0x42bdb0
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x18], 0
jmp 0x42beb7
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x144]
jge 0x42c24d
lea ecx, [ebp - 0x148]
call fcn.004a2910
mov byte [ebp - 4], 7
lea edx, [ebp - 0x148]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x5a6bc0
call fcn.00408ff0
mov dword [ebp - 0x1ac], eax
lea edx, [ebp - 0x164]
push edx
mov ecx, dword [ebp - 0x18c]
call fcn.0042c2c0
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1b4]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00409070
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x164]
call fcn.00408330
lea ecx, [ebp - 0x14]
call fcn.00408290
movzx edx, al
test edx, edx
jne 0x42bf66
lea ecx, [ebp - 0x148]
call fcn.00408290
movzx eax, al
test eax, eax
je 0x42bf81
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.00408330
jmp 0x42c24d
push 1
lea ecx, [ebp - 0x148]
call fcn.004090f0
push eax
lea ecx, [ebp - 0x14]
call fcn.004090f0
push eax
call fcn.004a0960
add esp, 0xc
test eax, eax
jne 0x42bfce
lea ecx, [ebp - 0x14]
call fcn.004090f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.00408330
jmp 0x42c24d
push 0
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
lea ecx, [ebp - 0x168]
push ecx
call fcn.00496560
add esp, 0xc
lea ecx, [ebp - 0x168]
call fcn.00408330
push 0x5c
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
call fcn.0042e210
add esp, 8
add eax, 1
push eax
push str.eausvc.exe
call fcn.0042e230
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xd], al
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x42c04a
push ecx
mov ecx, esp
mov dword [ebp - 0x16c], esp
push 0x5a6bd8
call fcn.00408ff0
mov dword [ebp - 0x1b8], eax
call fcn.004aed70
add esp, 4
lea eax, [ebp - 0x170]
push eax
call fcn.00498fb0
add esp, 4
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1c0]
mov eax, dword [edx]
push eax
push str._sESTSoftALUpdate
lea ecx, [ebp - 0x20]
push ecx
call fcn.004098b0
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x170]
call fcn.00408330
lea edx, [ebp - 0x13c]
push edx
push 0
push 0x5a6bfc
lea ecx, [ebp - 0x20]
call fcn.004090f0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 5
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
call fcn.0049dfa0
add esp, 0xc
push 5
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
lea ecx, [ebp - 0x14]
call fcn.004090f0
push eax
call fcn.0049dfa0
add esp, 0xc
test eax, eax
jne 0x42c1b1
mov dword [ebp - 0x28], 0
push 5
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
lea edx, [ebp - 0x13c]
push edx
call fcn.0049dfa0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x174], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00408fd0
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x178], esp
lea edx, [ebp - 0x24]
push edx
call fcn.00408fd0
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x17c], esp
push 0x5a6c00
call fcn.00408ff0
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x18c]
call fcn.0042c770
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.00408330
jmp 0x42c24d
push 0
push 0x1a
lea ecx, [ebp - 0x24]
call fcn.004090f0
push eax
call fcn.0049af40
add esp, 0xc
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42c1e8
push 4
push 0
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x180], esp
push 0x5a6c0c
call fcn.00408ff0
mov dword [ebp - 0x1d8], eax
mov ecx, dword [ebp - 0x18c]
call fcn.0042c960
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x42c239
push ecx
mov ecx, esp
mov dword [ebp - 0x184], esp
push 0x5a6c18
call fcn.00408ff0
mov dword [ebp - 0x1dc], eax
call fcn.004aeb70
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.00408330
jmp 0x42beae
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x188], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00408330
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00408330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00408330
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00408330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.00408330
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.0056edd3
mov esp, ebp
pop ebp
ret