Function at 0x4061b6
Capabilities:
Get common file path
Get file size

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x408bb8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x28]
je 0x4061f1
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4061f1
push 5
push esi
push dword [esp + 0x2c]
call eax
test eax, eax
jne 0x406406
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42d178], 0x4c554e
mov edi, 0x400
je 0x406236
push 1
push 0
push esi
call fcn.00405cd9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ebx, 0x42d178
push ebx
push esi
call ebp
test eax, eax
je 0x40640c
cmp eax, edi
jle 0x406247
jmp 0x40640c
push 0x408c50
mov ebx, 0x42d178
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov esi, 0x42c930
push esi
push dword [esp + 0x2c]
call ebp
xor ebp, ebp
cmp eax, ebp
je 0x40640c
cmp eax, edi
jg 0x40640c
push esi
push ebx
push str._s_s_r_n
push 0x42c530
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x3f0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push 0x8000080
push 4
push ebp
push ebp
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x406406
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ecx, ecx
push ecx
lea ebp, [esi + ebx]
lea eax, [ebp + 0xa]
push eax
push ecx
push 4
push ecx
push edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x28], eax
je 0x4063ee
push ecx
push ecx
push ecx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4063de
push str._Rename__r_n
push edi
call fcn.0040610a
test eax, eax
jne 0x40633c
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
add esi, 0xa
push 0x42c530
lea eax, [edi + esi]
push eax
call fcn.00405cb9
add esi, ebx
jmp 0x4063d7
push 0x408c28
add eax, 0xa
push eax
call fcn.0040610a
test eax, eax
je 0x4063c6
push dword [esp + 0x14]
inc eax
push 0x40
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4063ab
push 0x42c530
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [edi + esi]
mov esi, dword [esp + 0x18]
add ebx, ebp
sub ebx, esi
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x406394
mov dl, byte [eax]
mov byte [ebx + eax], dl
inc eax
mov dword [esp + 0x24], eax
jmp 0x406380
sub eax, esi
push eax
push ebp
push esi
call fcn.00405cb9
mov esi, dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4063d7
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
jmp 0x40640c
push ebx
push 0x42c530
lea eax, [edi + esi]
push eax
call fcn.00405cb9
mov esi, ebp
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
xor ecx, ecx
push ecx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x431150]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8