Function at 0x401326
Capabilities:
Check if file exists
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe78
mov ecx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0xe70], eax
test ecx, ecx
je 0x40187b
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
xor ebx, ebx
test eax, eax
je 0x40187d
mov edi, 0x208
lea eax, [esp + 0xc68]
push edi
push ebx
push eax
call fcn.006030b0
add esp, 0xc
lea esi, [esp + 0xa60]
push edi
push ebx
push esi
call fcn.006030b0
add esp, 0xc
lea eax, [esp + 0x858]
push edi
push ebx
push eax
call fcn.006030b0
add esp, 0xc
lea eax, [esp + 0x650]
push edi
push ebx
push eax
call fcn.006030b0
add esp, 0xc
cmp byte [ebp + 0xc], 0
je 0x401895
xor edi, edi
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push 0x26
lea eax, [esp + 0xc70]
push eax
push edi
call ebx
push edi
push 0x24
push esi
push edi
call ebx
push edi
push 8
lea eax, [esp + 0x860]
push eax
push edi
call ebx
push edi
push 0x1a
lea esi, [esp + 0x658]
push esi
push edi
call ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, eax
lea edi, [esp + 0x2c]
mov ecx, edi
push esi
call fcn.00401a6c
movzx ecx, byte [edi + 0xb]
test cl, cl
jns 0x401417
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
xor eax, eax
dec eax
test ecx, ecx
je 0x40143e
lea edx, [edi + ecx*2]
add edx, 0xfffffffe
add ecx, ecx
neg ecx
cmp word [edx], 0x5c
je 0x401438
add edx, 0xfffffffe
add ecx, 2
jne 0x401428
jmp 0x40143e
sub edx, edi
sar edx, 1
mov eax, edx
lea edx, [esp + 0x38]
lea edi, [esp + 0x2c]
lea ecx, [esp + 0x448]
push edx
push eax
push 0
push edi
call fcn.00468b4c
cmp byte [edi + 0xb], 0
js 0x40146b
mov word [esp + 0x2c], 0
mov byte [esp + 0x37], 0
jmp 0x401497
mov eax, dword [esp + 0x2c]
mov word [eax], 0
mov dword [esp + 0x30], 0
cmp byte [esp + 0x37], 0
jns 0x401497
push dword [esp + 0x2c]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x450]
mov dword [esp + 0x34], eax
movsd xmm0, qword [esp + 0x448]
movsd qword [esp + 0x2c], xmm0
cmp byte [esp + 0x37], 0
jns 0x4014bc
mov edi, dword [esp + 0x2c]
push edi
lea eax, [esp + 0x654]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea esi, [esp + 0x20]
mov ecx, esi
lea eax, [esp + 0x858]
push eax
call fcn.00401a6c
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, esi
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x4014fe
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [eax + ecx*2]
mov esi, edi
mov edx, edi
test ecx, ecx
mov dword [esp + 4], eax
jle 0x401529
mov edx, eax
mov eax, ecx
cmp word [edx], 0x5c
je 0x401523
add edx, 2
dec eax
jne 0x401511
mov esi, edi
mov edx, edi
jmp 0x401525
mov esi, edx
mov eax, dword [esp + 4]
sub esi, eax
sar esi, 1
inc esi
xor eax, eax
cmp edx, edi
cmovne eax, esi
xor edx, edx
dec edx
mov esi, edx
cmp ecx, eax
jb 0x401588
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 4]
lea esi, [esi + eax*2]
mov ebx, edi
sub ebx, esi
mov eax, edi
mov dword [esp + 8], edi
cmp ebx, 2
jl 0x401574
shr ebx, 1
cmp word [esi], 0x5c
je 0x40156e
add esi, 2
dec ebx
jne 0x40155a
mov eax, edi
mov dword [esp + 8], edi
jmp 0x401574
mov eax, esi
mov dword [esp + 8], esi
sub eax, dword [esp + 4]
sar eax, 1
xor esi, esi
dec esi
cmp dword [esp + 8], edi
cmovne esi, eax
mov ebx, dword [esp + 0xc]
inc esi
cmp ecx, esi
jb 0x4015c1
mov eax, dword [esp + 4]
lea ecx, [eax + esi*2]
mov edx, edi
sub edx, ecx
cmp edx, 2
jl 0x4015ab
shr edx, 1
cmp word [ecx], 0x5c
je 0x4015b1
add ecx, 2
dec edx
jne 0x40159f
mov eax, edi
mov ecx, edi
jmp 0x4015b3
mov eax, ecx
sub eax, dword [esp + 4]
sar eax, 1
xor edx, edx
dec edx
cmp ecx, edi
cmovne edx, eax
lea eax, [esp + 0x2c]
lea esi, [esp + 0x20]
lea edi, [esp + 0x448]
mov ecx, edi
push eax
push edx
push 0
push esi
call fcn.00468b4c
cmp byte [esi + 0xb], 0
js 0x4015f0
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x40161c
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x40161c
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x450]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x448]
movsd qword [esp + 0x20], xmm0
cmp byte [esp + 0x2b], 0
jns 0x401641
mov esi, dword [esp + 0x20]
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
test ebx, ebx
jne 0x40166f
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401825
lea eax, [esp + 0x240]
push 0x208
push 0
push eax
call fcn.006030b0
add esp, 0xc
lea edi, [esp + 0x20]
movzx eax, byte [edi + 0xb]
test al, al
cmovs eax, dword [edi + 4]
mov ecx, dword [edi]
cmovns ecx, edi
xor ebx, ebx
dec ebx
test eax, eax
je 0x4016c1
lea edx, [ecx + eax*2]
add edx, 0xfffffffe
lea esi, [eax + eax]
neg esi
cmp word [edx], 0x5c
je 0x4016bb
add edx, 0xfffffffe
add esi, 2
jne 0x4016ab
jmp 0x4016c1
sub edx, ecx
sar edx, 1
mov ebx, edx
dec eax
lea edx, [ebx + 1]
lea ecx, [esp + 0x38]
lea esi, [esp + 0x2c]
push esi
push eax
push edx
push edi
call fcn.00468b4c
cmp byte [esp + 0x1b], 0
js 0x4016eb
mov word [esp + 0x10], 0
mov byte [esp + 0x1b], 0
jmp 0x401717
mov eax, dword [esp + 0x10]
mov word [eax], 0
mov dword [esp + 0x14], 0
cmp byte [esp + 0x1b], 0
jns 0x401717
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x18], 0
lea esi, [esp + 0x38]
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
movsd xmm0, qword [esi]
movsd qword [esp + 0x10], xmm0
mov ecx, esi
lea eax, [esp + 0x2c]
push eax
push ebx
push 0
push edi
call fcn.00468b4c
cmp byte [esp + 0x2b], 0
js 0x401751
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x40177d
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x40177d
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0x20], xmm0
cmp byte [esp + 0x2b], 0
jns 0x40179c
mov edi, dword [esp + 0x20]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push edi
lea eax, [esp + 0x244]
push eax
call ebx
push 0x208
push 0
push esi
call fcn.006030b0
add esp, 0xc
cmp byte [esp + 0x1b], 0
jns 0x4017ca
mov eax, dword [esp + 0x10]
jmp 0x4017ce
lea eax, [esp + 0x10]
mov edi, dword [ebp + 8]
push eax
push esi
call ebx
lea eax, [esp + 0xc68]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, edi
xor edi, edi
inc edi
test eax, eax
jne 0x40183b
lea eax, [esp + 0xa60]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40183b
lea eax, [esp + 0x240]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401821
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40183b
xor edi, edi
jmp 0x40183b
push dword [ebp + 8]
call fcn.004012a8
add esp, 4
test eax, eax
je 0x40166f
xor edi, edi
inc edi
lea eax, [esp + 0x10]
cmp byte [eax + 0xb], 0
jns 0x401851
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x401864
push dword [esp + 0x20]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x37], 0
jns 0x401877
push dword [esp + 0x2c]
call fcn.00517bd6
add esp, 4
test edi, edi
je 0x401895
xor ebx, ebx
mov ecx, dword [esp + 0xe70]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea edi, [esp + 0x448]
push 0x208
push ebx
push edi
call fcn.006030b0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.006208d5
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, 3
mov ecx, 0x639214
mov edx, str._s_d.tmp
cmova edx, ecx
push eax
push dword [ebp + 8]
push edx
push 0xffffffffffffffff
push 0x104
push edi
call fcn.00401af6
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x639080]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x4000080
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40187d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esp + 0x240]
mov ecx, esi
push edi
call fcn.00401a6c
movzx eax, byte [esi + 0xb]
test al, al
jns 0x40194d
mov esi, dword [esp + 0x240]
mov eax, dword [esp + 0x244]
lea ecx, [esi + eax*2]
test eax, eax
jle 0x401964
mov edx, esi
mov edi, eax
cmp word [edx], 0x5c
je 0x40196a
add edx, 2
dec edi
jne 0x401958
mov edi, ecx
mov edx, ecx
jmp 0x40196c
mov edi, edx
sub edi, esi
sar edi, 1
xor esi, esi
dec esi
cmp edx, ecx
cmovne esi, edi
xor edx, edx
cmp esi, 0xffffffff
cmovne edx, esi
lea edi, [esp + 0x24c]
lea esi, [esp + 0x240]
lea ecx, [esp + 0x38]
push edi
push eax
push edx
push esi
call fcn.00468b4c
cmp byte [esi + 0xb], 0
js 0x4019b5
mov word [esp + 0x240], 0
mov byte [esp + 0x24b], 0
jmp 0x4019f0
mov eax, dword [esp + 0x240]
mov word [eax], 0
mov dword [esp + 0x244], 0
cmp byte [esp + 0x24b], 0
jns 0x4019f0
push dword [esp + 0x240]
call fcn.00517bd6
add esp, 4
mov dword [esp + 0x248], 0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x248], eax
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0x240], xmm0
cmp byte [esp + 0x24b], 0
jns 0x401a1b
mov esi, dword [esp + 0x240]
push esi
push str.LocalVirtualStore
lea esi, [esp + 0x658]
push esi
push str._s_s_s
push 0xffffffffffffffff
push 0x104
push esi
call fcn.00401af6
add esp, 0x1c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp byte [esp + 0x24b], 0
jns 0x40187d
push dword [esp + 0x240]
call fcn.00517bd6
add esp, 4
jmp 0x40187d