Function at 0x41c448
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x138]
test ecx, ecx
je 0x41c7ef
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x41c7ef
mov ebx, dword [esp + 0x138]
mov eax, dword [ebx + 8]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x41c48c
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41c816
jmp 0x41c7f9
mov eax, dword [ebx + 0x24]
add eax, 4
mov edx, dword [eax]
mov ecx, dword [eax + 4]
or edx, ecx
jne 0x41c4d3
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41c4c1
add esi, 0x30
push 0x100
push esi
push 0xfffffffffffffffd
push eax
mov eax, dword [0x4f5e08]
push eax
mov ecx, 0x4f55f8
call fcn.0049b6c0
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x124
ret 0x14
lea ecx, [esp + 0x30]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [ebx + 0x34]
mov edi, dword [esp + 0x13c]
lea eax, [esp + 0x30]
push edx
push eax
push edi
call fcn.00471100
mov al, byte [esp + 0x14c]
add esp, 0xc
test al, 2
je 0x41c50f
test al, 1
je 0x41c7c0
lea ecx, [esp + 0x18]
push ecx
push 0
push edi
call fcn.00470f00
add esp, 0xc
test eax, eax
je 0x41c54e
mov eax, dword [ebx + 0x24]
mov edx, dword [esp + 0x18]
add eax, 4
cmp edx, dword [eax]
jne 0x41c54e
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax + 4]
cmp ecx, edx
jne 0x41c54e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x124
ret 0x14
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41c58e
add esi, 0x30
push 0x100
push esi
call fcn.004715d0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 0x14
mov edx, dword [ebx + 0x24]
push 0
mov eax, dword [edx + 4]
push eax
push 0
push 4
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x41c5d1
add esi, 0x30
push 0x100
push esi
call fcn.004715d0
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 0x14
mov ecx, dword [ebx + 0x24]
mov edx, dword [ecx + 4]
push edx
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x41c619
add esi, 0x30
push 0x100
push esi
call fcn.004715d0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push edi
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 0x14
mov edx, dword [esi + 0x144]
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x144]
push 0x2710
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41c676
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41c816
add esi, 0x30
push 0x100
push esi
push 0xffffffffffffffff
push eax
mov eax, dword [0x4f5e08]
push eax
jmp 0x41c80c
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x140]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x138]
push edx
push eax
call fcn.00490ec0
mov ecx, dword [esi + 0x144]
mov dword [esp + 0x10], eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41c6cd
mov ecx, dword [esp + 0x10]
lea edx, [esi + 0x30]
push 0x100
push edx
mov edx, dword [0x4f5e08]
push ecx
push eax
push edx
mov ecx, 0x4f55f8
call fcn.0049b6c0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [ebx + 0x24]
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0xc]
test ecx, ecx
jne 0x41c6f5
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x41c701
push eax
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41c7aa
test byte [esp + 0x140], 4
jne 0x41c7b8
mov ecx, dword [esp + 0x13c]
push ecx
call fcn.00470f80
mov ebx, dword [esi + 0x148]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x41c7b8
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
lea edx, [eax + 1]
cmp ecx, edx
jne 0x41c798
mov ecx, dword [ebx + 0x14]
add ecx, eax
lea edx, [ecx*4 + 4]
push edx
call fcn.004bd49b
mov ecx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov edi, eax
mov dword [esp + 0x18], eax
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
push eax
call fcn.004bd4c4
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
add esp, 8
add eax, edx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
mov dword [ecx + eax*4], ebp
mov eax, dword [ebx + 8]
inc eax
mov dword [ebx + 8], eax
jmp 0x41c7b8
mov edx, dword [esp + 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41c7d2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x124
ret 0x14
mov eax, dword [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 0x14
mov eax, dword [esi + 0x138]
test eax, eax
je 0x41c816
mov ecx, dword [0x4f5e08]
add esi, 0x30
push 0x100
push esi
push 0xffffffffffffffff
push eax
push ecx
mov ecx, 0x4f55f8
call fcn.0049b6c0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x124
ret 0x14