Function at 0x40b160
Capabilities:
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45fede
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor ebx, ebx
push 0x104
lea eax, [esp + 0x159]
push ebx
push eax
mov byte [esp + 0x160], bl
call fcn.0043eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, 0xf
lea eax, [esp + 0x154]
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40b1f1
sub eax, edx
push eax
lea edx, [esp + 0x158]
push edx
lea ecx, [esp + 0x98]
call fcn.00406100
push 7
push str.d7pcfg
lea eax, [esp + 0x98]
mov dword [esp + 0x270], ebx
call fcn.00408660
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x288], 1
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xb8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00406a20
call fcn.0040fa00
mov ecx, dword [esp + 0x8c]
add esp, 0x20
cmp ecx, ebx
mov esi, 0x10
jne 0x40b2b7
cmp dword [esp + 0x70], esi
jb 0x40b291
mov eax, dword [esp + 0x5c]
push eax
call fcn.0043c992
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ba23
mov ecx, dword [esp + 0x94]
push ecx
jmp 0x40ba1b
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x40b2c5
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x78]
push edx
call fcn.0040a050
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x274], 2
call fcn.00406a20
cmp dword [esp + 0x8c], esi
jb 0x40b2fe
mov eax, dword [esp + 0x78]
push eax
call fcn.0043c992
add esp, 4
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
mov dword [esp + 0x148], ecx
mov byte [esp + 0x14c], bl
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0xdc]
mov byte [esp + 0x270], 5
call fcn.0041e1a0
test al, al
jne 0x40b46f
cmp dword [esp + 0x144], esi
jb 0x40b3f9
mov ecx, dword [esp + 0x130]
push ecx
call fcn.0043c992
add esp, 4
cmp dword [esp + 0x114], esi
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40b427
mov edx, dword [esp + 0x100]
push edx
call fcn.0043c992
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040c9b0
lea esi, [esp + 0xd4]
call fcn.0040c940
lea esi, [esp + 0x1c]
mov byte [esp + 0x268], 1
call fcn.004260c0
mov esi, 0x10
jmp 0x40b27e
mov byte [esp + 0x17], bl
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
push 0x46428b
push 0x464288
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x274], 6
call fcn.00427430
mov ecx, eax
call fcn.00427b60
test al, al
je 0x40b617
push 0x464297
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.00427430
cmp byte [eax + 8], 4
jne 0x40b617
push 0x4642a2
push str.createtime
lea ecx, [esp + 0x24]
push ecx
call fcn.00427430
mov ecx, eax
call fcn.00427c70
test al, al
je 0x40b617
push 0x46428b
push 0x464288
lea edx, [esp + 0x24]
push edx
call fcn.00427430
mov esi, eax
call fcn.00426540
push 0x464297
mov edi, eax
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.00427430
mov ecx, eax
call fcn.00426230
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40b550
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.00406100
push 0x4642a2
push str.createtime
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x274], 7
call fcn.00427430
mov esi, eax
call fcn.00426950
mov ebp, edx
lea edx, [esp + 0xac]
mov ecx, edi
mov esi, eax
call fcn.0040a430
test al, al
je 0x40b5fc
cmp edi, dword [esp + 0xc8]
jne 0x40b5fc
mov ecx, dword [esp + 0xb0]
mov edi, 0x10
cmp dword [esp + 0xc4], edi
jae 0x40b5c4
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x8c], edi
mov eax, dword [esp + 0x78]
jae 0x40b5d5
lea eax, [esp + 0x78]
push ecx
push eax
call fcn.00453d3e
add esp, 8
test eax, eax
jne 0x40b601
cmp esi, dword [esp + 0xcc]
jne 0x40b601
cmp ebp, dword [esp + 0xd0]
jne 0x40b601
mov byte [esp + 0x17], 1
jmp 0x40b601
mov edi, 0x10
cmp dword [esp + 0x8c], edi
jb 0x40b617
mov edx, dword [esp + 0x78]
push edx
call fcn.0043c992
add esp, 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 0x4642a9
push str.files
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x274], 9
call fcn.00427430
cmp byte [eax + 8], 6
jne 0x40b7eb
push 0x4642a9
push str.files
lea ecx, [esp + 0x24]
push ecx
xor edi, edi
call fcn.00427430
mov ecx, eax
call fcn.00426d90
test eax, eax
jbe 0x40b7eb
push 0x4642a9
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.00427430
push edi
push eax
call fcn.00427280
push 0x4642b0
push str.file
push eax
call fcn.00427430
cmp byte [eax + 8], 4
jne 0x40b7c5
push 0x4642a9
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.00427430
push edi
push eax
call fcn.00427280
push 0x4642b0
push str.file
push eax
call fcn.00427430
mov ecx, eax
call fcn.00426230
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40b700
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.00406100
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x3c]
mov byte [esp + 0x26c], 0xa
call fcn.00406310
push 0x4642a9
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.00427430
push edi
push eax
call fcn.00427280
push 0x4642ba
push str.HANDLE
push eax
call fcn.00427430
mov ecx, eax
call fcn.00427b60
test al, al
je 0x40b7a6
push 0x4642a9
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.00427430
push edi
push eax
call fcn.00427280
push 0x4642ba
push str.HANDLE
push eax
call fcn.00427430
mov esi, eax
call fcn.00426540
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x4c]
mov dword [esp + 0x1c], eax
call fcn.0040c740
mov byte [esp + 0x268], 9
cmp dword [esp + 0x8c], 0x10
jb 0x40b7c5
mov edx, dword [esp + 0x78]
push edx
call fcn.0043c992
add esp, 4
push 0x4642a9
push str.files
lea eax, [esp + 0x24]
push eax
add edi, 1
call fcn.00427430
mov ecx, eax
call fcn.00426d90
cmp edi, eax
jb 0x40b67a
cmp byte [esp + 0x17], bl
je 0x40b801
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x48]
call fcn.0040a640
xor edi, edi
xor ebp, ebp
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x40b857
mov ecx, dword [esp + 0x40]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x40b857
cmp dword [esi + ebp + 0x18], 0x10
jb 0x40b844
mov esi, dword [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40b805
lea esi, [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40b805
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40b86c
push eax
call fcn.0043c992
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov ebp, 0xf
je 0x40b8c0
mov edi, dword [esp + 0x40]
cmp esi, edi
je 0x40b8b7
add esi, 0x18
lea esp, [esp]
cmp dword [esi], 0x10
jb 0x40b8a1
mov eax, dword [esi - 0x14]
push eax
call fcn.0043c992
add esp, 4
mov dword [esi], ebp
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea ecx, [esi - 0x18]
cmp ecx, edi
jne 0x40b890
mov esi, dword [esp + 0x3c]
push esi
call fcn.0043c992
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jb 0x40b8e6
mov edx, dword [esp + 0xb0]
push edx
call fcn.0043c992
add esp, 4
cmp dword [esp + 0x144], 0x10
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
jb 0x40b915
mov eax, dword [esp + 0x130]
push eax
call fcn.0043c992
add esp, 4
cmp dword [esp + 0x114], 0x10
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40b944
mov ecx, dword [esp + 0x100]
push ecx
call fcn.0043c992
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040c9b0
lea esi, [esp + 0xd4]
call fcn.0040c940
mov byte [esp + 0x268], 1
mov ecx, dword [esp + 0x24]
movsx eax, cl
cmp eax, 4
je 0x40b9a4
add eax, 0xfffffffa
cmp eax, 1
ja 0x40b9b9
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov esi, ecx
je 0x40b9b9
call fcn.00427e60
push esi
call fcn.0043c992
jmp 0x40b9b6
test ecx, 0x100
je 0x40b9b9
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043d55d
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40b9de
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x425a90
push ecx
push 4
push eax
call fcn.0043cb2b
push esi
call fcn.0043d20c
add esp, 4
mov esi, 0x10
cmp dword [esp + 0x70], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jb 0x40b9fe
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043c992
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ba23
mov eax, dword [esp + 0x94]
push eax
call fcn.0043c992
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043c23a
add esp, 0x258
ret