Function at 0x4016a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41118f
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x4187e4]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4187e4]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
push str.msimg32.dll
push eax
lea eax, [esp + 0x30]
push eax
call ebx
add esp, 0xc
mov dword [esp + 0x2e0], 0
mov eax, dword [esp + 0x2c]
mov edi, 8
cmp dword [esp + 0x40], edi
jae 0x401717
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or esi, 0xffffffff
cmp eax, esi
je 0x401783
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call fcn.0040a2e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2e0], 1
call fcn.0040a3d0
test al, al
jne 0x40178f
push str._wtf_FileTrust_Initialize_failed_
push 0x81
push str.CheckAndDelMsimg32
push str..CP2IM.cpp
push 4
push 0x418bd8
call fcn.00407780
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x2e0], 0
call fcn.0040a320
mov dword [esp + 0x2e0], esi
jmp 0x401900
push str._wtf_QQ_dir_exist_msimg32.dll_
push 0x84
push str.CheckAndDelMsimg32
push str..CP2IM.cpp
push 4
push 0x418bd8
call fcn.00407780
add esp, 0x18
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x2ec], 2
call fcn.0040a7d0
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x4017e7
lea eax, [esp + 0x48]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.sangfor
push eax
call esi
test eax, eax
jne 0x401817
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x401807
lea eax, [esp + 0x48]
push str.sinfor
push eax
call esi
test eax, eax
je 0x4018d2
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x401825
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4018d2
push str._wtf__Fail_to_delete_ours_msimg32.dll_
push 0x92
push str.CheckAndDelMsimg32
push str..CP2IM.cpp
push 2
push 0x418bd8
call fcn.00407780
push str.RSDN
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x80]
push edx
call ebx
add esp, 0x24
mov byte [esp + 0x2e0], 3
mov ecx, dword [esp + 0x64]
cmp dword [esp + 0x78], edi
jae 0x401881
lea ecx, [esp + 0x64]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x40188f
lea eax, [esp + 0x2c]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4018c0
push str._wtf_Fail_to_rename_ours_msimg32.dll
push 0x96
push str.CheckAndDelMsimg32
push str..CP2IM.cpp
push 2
push 0x418bd8
call fcn.00407780
add esp, 0x18
lea ecx, [esp + 0x60]
mov byte [esp + 0x2e0], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x44]
mov byte [esp + 0x2e0], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x14]
mov byte [esp + 0x2e0], 0
call fcn.0040a320
mov dword [esp + 0x2e0], 0xffffffff
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.0040f466
mov esp, ebp
pop ebp
ret