Function at 0x40a520
Capabilities:
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45f0fe
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x477564]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x477564]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor ebx, ebx
push 0x104
lea eax, [esp + 0x159]
push ebx
push eax
mov byte [esp + 0x160], bl
call fcn.004423c0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, 0xf
lea eax, [esp + 0x154]
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40a5b1
sub eax, edx
push eax
lea edx, [esp + 0x158]
push edx
lea ecx, [esp + 0x98]
call fcn.004054f0
push 7
push str.d7pcfg
lea eax, [esp + 0x98]
mov dword [esp + 0x270], ebx
call fcn.004079f0
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x288], 1
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xb8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00405e10
call fcn.0040ee10
mov ecx, dword [esp + 0x8c]
add esp, 0x20
cmp ecx, ebx
mov esi, 0x10
jne 0x40a677
cmp dword [esp + 0x70], esi
jb 0x40a651
mov eax, dword [esp + 0x5c]
push eax
call fcn.0043c477
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ade3
mov ecx, dword [esp + 0x94]
push ecx
jmp 0x40addb
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x40a685
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004093e0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x274], 2
call fcn.00405e10
cmp dword [esp + 0x8c], esi
jb 0x40a6be
mov eax, dword [esp + 0x78]
push eax
call fcn.0043c477
add esp, 4
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
mov dword [esp + 0x148], ecx
mov byte [esp + 0x14c], bl
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0xdc]
mov byte [esp + 0x270], 5
call fcn.0041d620
test al, al
jne 0x40a82f
cmp dword [esp + 0x144], esi
jb 0x40a7b9
mov ecx, dword [esp + 0x130]
push ecx
call fcn.0043c477
add esp, 4
cmp dword [esp + 0x114], esi
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40a7e7
mov edx, dword [esp + 0x100]
push edx
call fcn.0043c477
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040bd80
lea esi, [esp + 0xd4]
call fcn.0040bd10
lea esi, [esp + 0x1c]
mov byte [esp + 0x268], 1
call fcn.004253f0
mov esi, 0x10
jmp 0x40a63e
mov byte [esp + 0x17], bl
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
push 0x463137
push 0x463134
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x274], 6
call fcn.00426760
mov ecx, eax
call fcn.00426e90
test al, al
je 0x40a9d7
push 0x463143
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.00426760
cmp byte [eax + 8], 4
jne 0x40a9d7
push 0x46314e
push str.createtime
lea ecx, [esp + 0x24]
push ecx
call fcn.00426760
mov ecx, eax
call fcn.00426fa0
test al, al
je 0x40a9d7
push 0x463137
push 0x463134
lea edx, [esp + 0x24]
push edx
call fcn.00426760
mov esi, eax
call fcn.00425870
push 0x463143
mov edi, eax
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.00426760
mov ecx, eax
call fcn.00425560
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40a910
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.004054f0
push 0x46314e
push str.createtime
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x274], 7
call fcn.00426760
mov esi, eax
call fcn.00425c80
mov ebp, edx
lea edx, [esp + 0xac]
mov ecx, edi
mov esi, eax
call fcn.004097c0
test al, al
je 0x40a9bc
cmp edi, dword [esp + 0xc8]
jne 0x40a9bc
mov ecx, dword [esp + 0xb0]
mov edi, 0x10
cmp dword [esp + 0xc4], edi
jae 0x40a984
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x8c], edi
mov eax, dword [esp + 0x78]
jae 0x40a995
lea eax, [esp + 0x78]
push ecx
push eax
call fcn.00454cd6
add esp, 8
test eax, eax
jne 0x40a9c1
cmp esi, dword [esp + 0xcc]
jne 0x40a9c1
cmp ebp, dword [esp + 0xd0]
jne 0x40a9c1
mov byte [esp + 0x17], 1
jmp 0x40a9c1
mov edi, 0x10
cmp dword [esp + 0x8c], edi
jb 0x40a9d7
mov edx, dword [esp + 0x78]
push edx
call fcn.0043c477
add esp, 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 0x463155
push str.files
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x274], 9
call fcn.00426760
cmp byte [eax + 8], 6
jne 0x40abab
push 0x463155
push str.files
lea ecx, [esp + 0x24]
push ecx
xor edi, edi
call fcn.00426760
mov ecx, eax
call fcn.004260c0
test eax, eax
jbe 0x40abab
push 0x463155
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.00426760
push edi
push eax
call fcn.004265b0
push 0x46315c
push str.file
push eax
call fcn.00426760
cmp byte [eax + 8], 4
jne 0x40ab85
push 0x463155
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.00426760
push edi
push eax
call fcn.004265b0
push 0x46315c
push str.file
push eax
call fcn.00426760
mov ecx, eax
call fcn.00425560
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40aac0
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.004054f0
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x3c]
mov byte [esp + 0x26c], 0xa
call fcn.00405700
push 0x463155
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.00426760
push edi
push eax
call fcn.004265b0
push 0x463166
push str.HANDLE
push eax
call fcn.00426760
mov ecx, eax
call fcn.00426e90
test al, al
je 0x40ab66
push 0x463155
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.00426760
push edi
push eax
call fcn.004265b0
push 0x463166
push str.HANDLE
push eax
call fcn.00426760
mov esi, eax
call fcn.00425870
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x4c]
mov dword [esp + 0x1c], eax
call fcn.0040bb10
mov byte [esp + 0x268], 9
cmp dword [esp + 0x8c], 0x10
jb 0x40ab85
mov edx, dword [esp + 0x78]
push edx
call fcn.0043c477
add esp, 4
push 0x463155
push str.files
lea eax, [esp + 0x24]
push eax
add edi, 1
call fcn.00426760
mov ecx, eax
call fcn.004260c0
cmp edi, eax
jb 0x40aa3a
cmp byte [esp + 0x17], bl
je 0x40abc1
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x48]
call fcn.004099d0
xor edi, edi
xor ebp, ebp
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x40ac17
mov ecx, dword [esp + 0x40]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x40ac17
cmp dword [esi + ebp + 0x18], 0x10
jb 0x40ac04
mov esi, dword [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40abc5
lea esi, [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40abc5
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40ac2c
push eax
call fcn.0043c477
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov ebp, 0xf
je 0x40ac80
mov edi, dword [esp + 0x40]
cmp esi, edi
je 0x40ac77
add esi, 0x18
lea esp, [esp]
cmp dword [esi], 0x10
jb 0x40ac61
mov eax, dword [esi - 0x14]
push eax
call fcn.0043c477
add esp, 4
mov dword [esi], ebp
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea ecx, [esi - 0x18]
cmp ecx, edi
jne 0x40ac50
mov esi, dword [esp + 0x3c]
push esi
call fcn.0043c477
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jb 0x40aca6
mov edx, dword [esp + 0xb0]
push edx
call fcn.0043c477
add esp, 4
cmp dword [esp + 0x144], 0x10
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
jb 0x40acd5
mov eax, dword [esp + 0x130]
push eax
call fcn.0043c477
add esp, 4
cmp dword [esp + 0x114], 0x10
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40ad04
mov ecx, dword [esp + 0x100]
push ecx
call fcn.0043c477
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040bd80
lea esi, [esp + 0xd4]
call fcn.0040bd10
mov byte [esp + 0x268], 1
mov ecx, dword [esp + 0x24]
movsx eax, cl
cmp eax, 4
je 0x40ad64
add eax, 0xfffffffa
cmp eax, 1
ja 0x40ad79
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov esi, ecx
je 0x40ad79
call fcn.00427190
push esi
call fcn.0043c477
jmp 0x40ad76
test ecx, 0x100
je 0x40ad79
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043d169
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40ad9e
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x424dc0
push ecx
push 4
push eax
call fcn.0043ca15
push esi
call fcn.0043d49c
add esp, 4
mov esi, 0x10
cmp dword [esp + 0x70], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jb 0x40adbe
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043c477
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ade3
mov eax, dword [esp + 0x94]
push eax
call fcn.0043c477
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043c709
add esp, 0x258
ret