Function at 0x41ce27
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push 0x884
mov eax, 0x5aac15
call fcn.00553ddb
mov esi, ecx
and dword [esi + 0x14], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x650], ax
lea eax, [ebp - 0x64e]
xor ebx, ebx
push eax
inc ebx
call fcn.005534a0
add esp, 0xc
xor eax, eax
push 9
pop ecx
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0x5c1c78
lea ecx, [ebp - 0x888]
stosw word es:[edi], ax
call fcn.0040a171
and dword [ebp - 4], 0
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0x870]
push eax
call fcn.004104fa
pop ecx
pop ecx
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 2
call fcn.0040a1b3
cmp dword [ebp - 0x85c], 8
lea eax, [ebp - 0x870]
cmovae eax, dword [ebp - 0x870]
push eax
lea eax, [ebp - 0x38]
push 0x5bf428
push eax
call fcn.00554d64
lea eax, [ebp - 0x650]
push str.__dongfang__
push eax
call fcn.00554537
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.00554508
mov edi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
add esp, 0x1c
lea eax, [ebp - 0x650]
push eax
push ebx
push 0xf001f
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41d131
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea eax, [ebp - 0x650]
push eax
push 0x5d28
xor ecx, ecx
push ecx
push 4
push ecx
push 0xffffffffffffffff
mov dword [ebp - 0x88c], ecx
call ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41d12b
push 0x206
push eax
mov word [ebp - 0x858], ax
lea eax, [ebp - 0x856]
push eax
call fcn.005534a0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push eax
call fcn.005534a0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x23e]
push eax
call fcn.005534a0
add esp, 0x24
lea eax, [ebp - 0x858]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push str.DongFang
push str.DongFangInput
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x448]
push str._s_s_s_s
push eax
call fcn.00554d64
lea eax, [ebp - 0x240]
push str.__dongfang__
push eax
call fcn.00554537
lea eax, [ebp - 0x240]
push str.TEMP__
push eax
call fcn.00554508
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00554508
add esp, 0x30
xor ecx, ecx
lea eax, [ebp - 0x240]
inc ecx
push eax
push ecx
push 0xf001f
mov dword [esi + 0x14], ecx
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41d12b
lea eax, [ebp - 0x240]
push eax
push 1
push 6
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41d12b
push eax
push 0x80
push 4
push eax
push 3
push 0x10000000
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41d1a4
lea eax, [ebp - 0x240]
push eax
push 0x5d28
push 0
push 4
push 0
push edi
call ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41d124
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x38]
push eax
push str.DongFang
push str.DongFangInput
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x448]
push str._s_s_s_s_d
push eax
call fcn.00554d64
add esp, 0x1c
lea eax, [ebp - 0x448]
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41d1a4
push dword [ebp - 0x890]
lea eax, [ebp - 0x38]
push eax
push str.__dongfang__
lea eax, [ebp - 0x240]
push str._s_s_d
push eax
call fcn.00554d64
add esp, 0x14
lea eax, [ebp - 0x240]
push eax
push 0x5d28
push 0
push 4
push 0
push edi
call ebx
push 5
mov dword [esi + 0xc], eax
push 0
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x88c]
cmp dword [esi + 0xc], 0
je 0x41d172
push 0
push 0
push 0
push 0xf001f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x10], eax
test eax, eax
je 0x41d165
mov dword [esi + 0x28], eax
test ebx, ebx
jne 0x41d160
mov ecx, eax
call fcn.0041c0a2
xor esi, esi
inc esi
jmp 0x41d1a6
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 0xc], 0
push 0x5d28
call fcn.00432f09
pop ecx
mov dword [ebp - 0x890], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x41d194
mov ecx, eax
call fcn.00401de2
jmp 0x41d196
xor eax, eax
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [esi + 0x28], eax
call fcn.0041c0a2
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x870]
call fcn.00402004
mov eax, esi
call fcn.00553d8a
ret