Function at 0x41d260
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfb17
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4cc], ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004830b0
add esp, 0x18
mov dword [ebp - 0x424], 7
xor eax, eax
mov dword [ebp - 0x428], 0
lea ecx, [ebp - 0x438]
mov word [ebp - 0x438], ax
push eax
push 0x5e87f0
call fcn.00402650
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x5e87f0
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 7
mov dword [ebp - 0x4b8], 0
mov word [ebp - 0x4c8], ax
call fcn.00402650
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x5e87f0
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x49c], 7
mov dword [ebp - 0x4a0], 0
mov word [ebp - 0x4b0], ax
call fcn.00402650
mov byte [ebp - 4], 2
call fcn.00473856
test al, al
je 0x41d371
xchg dword [edi + esi*2 + 0x63fcc869], ecx
aad 0xe1
sal byte [esi], 1
inc edx
xor eax, 0x176113bd
push esi
push 0
push 0x17
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41da45
push 7
xor eax, eax
mov dword [ebp - 0x484], 7
push 0x5e9d38
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x488], 0
mov word [ebp - 0x498], ax
call fcn.00402650
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x498]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x5ea9a0
push eax
call fcn.00407e70
lea eax, [ebp - 0x218]
push eax
call fcn.00458ac6
add esp, 0x14
call fcn.00473337
test al, al
je 0x41d421
mov byte [0x557946e2], al
sub byte [ebp - 0x4d], ah
dec ecx
pop esp
les ecx, [esi]
div dword [ecx + 0x1ab5cd81]
sub ah, byte [eax + 0x71]
xchg edi, eax
push ebp
xor bh, byte [ecx - 0x7b]
adc al, 0x75
call fcn.00473673
test al, al
je 0x41d443
int3
call fcn.00473490
test al, al
je 0x41d464
xchg byte [ebx - 0x33fc705a], ah
fsubr dword [esi - 0x3f]
sub byte [ebx], bh
sub dword [esi + 0x21118934], edx
test eax, 0x291ccc27
in eax, dx
jecxz 0x41d4cb
cmp word [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0
jne 0x41d472
xor ecx, ecx
jmp 0x41d48f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d480
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402650
push 7
push 0x5e9d38
lea ecx, [ebp - 0x438]
call fcn.00405710
push 4
push 0x5ea9b0
lea ecx, [ebp - 0x438]
call fcn.00405710
cmp dword [ebp - 0x424], 8
dec dword [eax]
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x67b31c]
test eax, eax
jne 0x41d519
push 0x15c
call fcn.0046cb58
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x41d50e
mov ecx, eax
call fcn.004453a0
jmp 0x41d510
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x67b31c], eax
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0x480]
call fcn.00403b30
xor eax, eax
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push eax
mov word [ebp - 0x450], ax
lea ecx, [ebp - 0x450]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x43c], 7
push eax
mov dword [ebp - 0x440], 0
call fcn.00402530
push 0xa
push str.Config.exe
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.00405710
cmp dword [ebp - 0x46c], 8
lea edx, [ebp - 0x480]
push 0x5e87f0
cmovae edx, dword [ebp - 0x480]
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x438]
push edx
cmovae ecx, dword [ebp - 0x450]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 1
push 0
push ecx
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.0041ccc0
push 9
xor eax, eax
mov dword [ebp - 0x454], 7
push str.ZNUpd.exe
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
call fcn.00402650
mov byte [ebp - 4], 7
call fcn.0047344b
test al, al
je 0x41d619
enter 0xffffffffffff840d, 0xffffffffffffffc6
sub byte [edx - 0x1e], ch
or al, 0xdb
xchg ebx, eax
loopne 0x41d60a
or eax, 0x6a28c684
loop 0x41d61d
fist dword [ebx - 0x64610a20]
sahf
wait
xor al, 0xa5
cmp dword [ebp - 0x458], 0
je 0x41d780
invalid
call fcn.00473925
test al, al
je 0x41d64a
sti
jg 0x41d6a5
push ecx
cld
das
jmp 0x41d67b
call fcn.004732f2
test al, al
je 0x41d66b
add dword [edi], ebp
pop ds
mov bl, 0x62
add eax, 0x8bb206dd
sub ah, byte [edx + 0x40]
mov cs, word [0x61668bf9]
hlt
call fcn.004739af
test al, al
je 0x41d688
adc byte [ecx], ch
cmpsd dword [esi], dword es:[edi]
sub al, 0xa3
add al, 0x95
xchg ebp, eax
sub esp, dword [ebx]
inc esi
cmpsd dword [esi], dword es:[edi]
mov byte [edi + 0x1f], ch
int3
cmp word [ebp - 0x218], 0
jne 0x41d696
xor ecx, ecx
jmp 0x41d6af
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d6a0
add ah, byte [esi - 0x7b]
sal byte [ebp - 0xb], 0x2b
retf 0xf9d1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402650
push 8
push 0x5ea9bc
lea ecx, [ebp - 0x438]
call fcn.00405710
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
mov edx, eax
cmp word [edx], 0
jne 0x41d707
xor ecx, ecx
jmp 0x41d71f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d710
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402650
push 9
push str.ZNUpd.exe
lea ecx, [ebp - 0x450]
call fcn.00405710
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push 0x5e87f0
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.0041ccc0
call fcn.00473856
test al, al
je 0x41d7a8
or byte [eax - 0x72a30705], ah
dec ebx
jecxz 0x41d79a
mov ds, word [eax]
rcl dword [eax], cl
std
mov edi, dword [edx]
jecxz 0x41d814
jns 0x41d7d9
cmp eax, 0x1e50a2d1
cld
fistp qword [eax + 0x37]
shl dword [edx - 0x2003e1b0], 1
js 0x41d7db
jge 0x41d7ea
lds ebp, [edx - 0x18]
mov bl, byte [ebx + 5]
add byte [eax + eax*8 - 0x490ee38c], al
test eax, 0x750877b7
test eax, 0x378ba8d1
das
imul ecx, dword [edx], 0xab1f0b40
call fcn.00473337
test al, al
je 0x41d7cd
int1
mov dh, 0xa9
mov bh, 0x77
or byte [ebp - 0x57], dh
shr dword [eax + 0x692f378b], 1
or al, byte [eax + 0xb]
pop ds
stosd dword es:[edi], eax
xchg esi, edi
outsd dx, dword [esi]
clc
cmp byte [ebx + ebp*4 - 0x4a], ch
and ch, al
out dx, eax
pop ebx
add eax, 0x74c08400
push ss
call fcn.004733c1
test al, al
je 0x41d7ec
push ebx
jmp 0xaa3a28eb
push ecx
clc
test eax, 0x80ac3b55
add eax, eax
stosd dword es:[edi], eax
xor ah, byte [ecx + eax*4]
jg 0x41d823
cwde
popal
fldenv [esi - 0x7d]
mov ebp, 0xfffffde8
add byte [ebp + 4], dh
cmp word [ebp - 0x218], 0
jne 0x41d7fa
xor ecx, ecx
jmp 0x41d812
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d803
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402650
push 6
push 0x5ea9d0
lea ecx, [ebp - 0x438]
call fcn.00405710
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x67b31c]
test eax, eax
jne 0x41d88a
test eax, ebp
std
invalid
invalid
push 0x15c
call fcn.0046cb58
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x41d87f
mov ecx, eax
call fcn.004453a0
jmp 0x41d881
xor eax, eax
mov byte [ebp - 4], 7
mov dword [0x67b31c], eax
mov ecx, eax
call fcn.004710c9
mov edx, eax
cmp word [edx], 0
jne 0x41d89d
xor ecx, ecx
jmp 0x41d8b1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d8a2
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402650
call fcn.0047337c
test al, al
je 0x41d8de
push edi
dec ecx
stosb byte es:[edi], al
bnd js 0x41d85b
sar byte [edx + 0x16654e1c], 1
jmp 0xd34f619
push 0xc
push 0x5ea858
lea ecx, [ebp - 0x450]
call fcn.00405710
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push 0x5e87f0
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.0041ccc0
call fcn.00473925
test al, al
je 0x41d954
mov cl, 0xd0
mov esi, edi
in al, dx
xchg esp, eax
shr edx, cl
movsb byte es:[edi], byte [esi]
add al, 0xe4
iretd
call fcn.004736fd
test al, al
je 0x41d976
cdq
pop ds
ret 0x3247
mov eax, dword [ebp - 0x454]
cmp eax, 8
jb 0x41d994
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x458], 0
cmp eax, 8
jb 0x41d9cf
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x440], 0
cmp eax, 8
jb 0x41da0a
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x470], 0
cmp eax, 8
jb 0x41da45
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.00402750
mov eax, dword [ebp - 0x49c]
cmp eax, 8
jb 0x41da63
inc eax
lea ecx, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4b0]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4a0], 0
cmp eax, 8
jb 0x41da9e
inc eax
lea ecx, [ebp - 0x4c8]
push eax
push dword [ebp - 0x4c8]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x4b8], 0
cmp eax, 8
jb 0x41dad9
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret