Function at 0x47d0b0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x984
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x97c], edi
mov dword [ebp - 0x984], eax
mov dword [ebp - 0x980], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
test edi, edi
je 0x47d3ff
push esi
call dword [0x595e38]
test eax, eax
je 0x47d3ff
call dword [0x595ec4]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47d110
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x47d167
mov esi, dword [ebp - 0x97c]
push edi
call dword [0x595ed8]
mov ecx, eax
sub ecx, esi
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x47d140
push edi
call dword [0x595e64]
push edi
push 1
call dword [0x595e28]
mov dword [ebp - 0x980], 1
mov ecx, dword [ebp - 0x984]
mov eax, 0x4eb673
test ecx, ecx
cmovne eax, ecx
cmp byte [eax], 0
je 0x47d3d7
mov eax, dword [0x52e81c]
cmp eax, ebx
jae 0x47d3d7
sub ebx, eax
cmp ebx, 0x1f4
jae 0x47d3d7
push 0x104
lea eax, [ebp - 0x388]
push eax
push 0
call dword [0x595e30]
lea eax, [ebp - 0x4b4]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str._s_sTempCopySetting
push 1
lea eax, [ebp - 0x388]
push eax
push 0
call fcn.00481b90
add esp, 0xc
push eax
lea eax, [ebp - 0x4b4]
push eax
push 0x239d
push str.Misc.c
push str._s_sTempCopySetting
lea eax, [ebp - 0x25c]
push 0x12c
push eax
call fcn.00482bc0
lea eax, [ebp - 0x25c]
push eax
push 0
call fcn.0047d810
add esp, 0x28
test eax, eax
je 0x47d3d7
push str._s
lea eax, [ebp - 0x25c]
push eax
push 0x23a1
push str.Misc.c
push str._s
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.00482bc0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x838]
push eax
call fcn.00481670
mov ecx, eax
lea edx, [ebp - 0x5e0]
add esp, 0x28
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x47d270
lea eax, [ebp - 0x978]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [0x595e44]
mov esi, eax
cmp esi, 0xffffffff
je 0x47d2ed
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
test byte [ebp - 0x978], 0x10
jne 0x47d2d4
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x70c]
push 0x4f166c
push eax
call fcn.004010a0
add esp, 0x10
lea eax, [ebp - 0x70c]
push eax
call edi
lea eax, [ebp - 0x978]
push eax
push esi
call dword [0x595ecc]
test eax, eax
jne 0x47d2a0
push esi
call dword [0x595e94]
push 0x4f166c
push dword [ebp - 0x984]
lea eax, [ebp - 0x25c]
push eax
push 0x23a4
push str.Misc.c
push 0x4f166c
lea eax, [ebp - 0x130]
push 0x12c
push eax
call fcn.00482bc0
push 0
push 0
push 2
push 0
push 3
lea eax, [ebp - 0x130]
push 0x40000000
push eax
call fcn.0047da90
mov esi, eax
add esp, 0x3c
cmp esi, 0xffffffff
je 0x47d3d7
mov edx, dword [ebp - 0x97c]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47d353
push 0
push 0
sub ecx, edi
push ecx
push edx
push esi
call dword [0x595e5c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x16
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x47d3d7
push esi
call dword [0x595ed8]
test eax, eax
je 0x47d3bd
lea ecx, [ebp - 0x130]
mov dword [eax], 0x14
mov edx, ecx
sub eax, edx
lea edx, [eax + 0x14]
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x47d3b0
push esi
call dword [0x595e64]
push esi
push 0xf
call dword [0x595e28]
mov dword [ebp - 0x980], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x52e81c], eax
call dword [0x595e2c]
mov eax, dword [ebp - 0x980]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret