Function at 0x401e0c
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
sub eax, ebx
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
je 0x401e38
dec eax
je 0x401fb6
dec eax
je 0x401fbe
dec eax
je 0x401e41
dec eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [esi + 0x250]
cmp eax, ebx
jne 0x401f20
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
mov ax, word [edi + 0x1a]
push eax
mov ax, word [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
jne 0x401e94
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
jne 0x401e94
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [edi + 0x14]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add edi, 0x14
mov ecx, dword [edi]
call fcn.0040a26f
lea ebx, [esi + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401ecf
cmp dword [esi + 8], 0
je 0x401ec8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x401ec8
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x118]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x118]
push str..tmp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x118]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esi + 4]
test esi, esi
je 0x401f6e
push 0
push 0
push ebx
call esi
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x401f6e
cmp eax, 1
jne 0x401f9a
mov eax, dword [ebp + 0xc]
lea edi, [eax + 0x14]
mov ecx, dword [edi]
call fcn.0040a26f
mov eax, dword [esi + 4]
test eax, eax
je 0x401f71
push dword [esi + 0x24c]
push dword [esi + 0x244]
push 0
call eax
add esp, 0xc
mov dword [ebp - 4], eax
test al, 1
jne 0x401f60
push dword [esi + 0x244]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
and dword [esi + 0x244], 0
and dword [esi + 0x24c], 0
mov ebx, dword [ebp - 4]
mov esi, dword [edi]
test esi, esi
je 0x401f85
mov ecx, esi
call fcn.0040a26f
push esi
call fcn.00413f94
pop ecx
and dword [edi], 0
and bl, 2
neg bl
sbb ebx, ebx
and ebx, 0xfffffffe
inc ebx
mov eax, ebx
jmp 0x401e3a
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 0x14]
cmp edi, ebx
je 0x401fb2
mov ecx, edi
call fcn.0040a26f
push edi
call fcn.00413f94
pop ecx
and dword [esi + 0x14], 0
or eax, 0xffffffff
jmp 0x401e3a
mov eax, dword [esi]
mov edi, dword [ebp + 0xc]
cmp eax, ebx
je 0x401fda
push dword [edi + 4]
call eax
test eax, eax
pop ecx
je 0x401e38
cmp eax, 2
je 0x401fb6
mov eax, dword [esi + 0x250]
test eax, eax
jne 0x4020af
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0x28]
add esi, 0x12c
mov dword [ebp + 0xc], eax
push esi
push eax
call ebx
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov al, byte [eax]
cmp al, 0x2f
je 0x40201b
cmp al, 0x5c
je 0x40201b
push 0x417064
push dword [ebp + 0xc]
call esi
push dword [edi + 4]
push dword [ebp + 0xc]
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
call ebx
lea eax, [ebp - 0x118]
push str..tmp
push eax
call esi
lea eax, [ebp - 0x118]
push 1
push eax
call fcn.00402868
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor esi, esi
add esp, 0xc
cmp eax, esi
je 0x40206e
or dword [eax + 4], 0xffffffff
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x402070
xor edi, edi
push 0x180
lea eax, [ebp - 0x118]
push 0x8301
push eax
mov ecx, edi
call fcn.0040a05a
cmp eax, 0xffffffff
jne 0x4020a8
cmp edi, esi
je 0x401fb6
mov ecx, edi
call fcn.0040a26f
push edi
call fcn.00413f94
pop ecx
jmp 0x401fb6
mov eax, edi
jmp 0x401e3a
cmp eax, 1
jne 0x401fb6
mov edi, dword [edi]
push edi
mov dword [esi + 0x24c], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x18
mov dword [esi + 0x244], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
je 0x4020ee
or dword [eax + 4], 0xffffffff
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov ebx, eax
jmp 0x4020f0
xor ebx, ebx
push edi
push 1
push dword [esi + 0x24c]
mov ecx, ebx
push dword [esi + 0x244]
call fcn.0040a183
test eax, eax
je 0x401f93
push dword [esi + 0x244]
call fcn.00413f94
pop ecx
mov dword [esi + 0x244], edi
mov dword [esi + 0x24c], edi
jmp 0x401fb6