Function at 0x401340
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x8010
call fcn.0040209c
mov eax, dword [esp + 0x8028]
mov esi, dword [eax]
push 0x2f
push esi
call sub.msvcrt.dll_wcsrchr
add esp, 8
mov edi, eax
push 0x5c
push esi
call sub.msvcrt.dll_wcsrchr
add esp, 8
mov ebx, eax
test edi, edi
je 0x401393
cmp edi, ebx
mov ebp, edi
cmovb ebp, ebx
test ebx, ebx
cmove ebp, edi
push 0x403058
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov ebx, ebp
jmp 0x4013a5
push 0x403058
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
test ebx, ebx
je 0x401421
push esi
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov edi, eax
add ebx, 2
mov eax, ebx
sub eax, esi
mov word [edi + eax], 0
mov esi, ebx
lea ebx, [esp + 0x4010]
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ebp, [esp + 0x10]
push 0x2000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x1ffe
ja 0x401439
mov dword [esp], edi
push 0x2f
push ebp
call sub.msvcrt.dll_wcsrchr
add esp, 8
mov edi, eax
push 0x5c
push ebp
call sub.msvcrt.dll_wcsrchr
add esp, 8
test edi, edi
je 0x401418
test eax, eax
je 0x401425
cmp edi, eax
cmovae eax, edi
jmp 0x401427
test eax, eax
mov edi, dword [esp]
jne 0x40142a
jmp 0x401439
mov edi, eax
jmp 0x4013c0
mov eax, edi
mov edi, dword [esp]
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov esi, eax
push 0x5c
push ebx
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x40145a
mov word [eax + 2], 0
push ebx
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov ebx, eax
push 0x2e
push eax
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
je 0x40147a
mov word [eax], 0
push ebx
call dword [sym.imp.msvcrt.dll__wcsdup]
add esp, 4
mov ebp, eax
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x4014ec
mov esi, eax
mov dword [esp], edi
mov word [eax], 0
push 0x2d
push ebp
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x4014c2
mov edi, eax
push str._llvm
push eax
call sub.msvcrt.dll_wcscmp
add esp, 8
test eax, eax
je 0x4014da
add esi, 2
push str.llvm
push ebp
call sub.msvcrt.dll_wcscmp
add esp, 8
test eax, eax
cmovne ebx, esi
jmp 0x4014e9
mov word [esi], 0x2d
mov word [edi], 0
add edi, 2
mov ebx, edi
mov edi, dword [esp]
push 5
push 0x40304c
push ebx
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40153a
push ebx
call sub.msvcrt.dll_wcslen
add esp, 4
lea eax, [eax*2 + 0xc]
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov esi, eax
push 0x40304c
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
mov eax, esi
add eax, 0xa
push ebx
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
mov ebx, esi
push edi
call sub.msvcrt.dll_wcslen
add esp, 4
mov ebp, eax
push ebx
call sub.msvcrt.dll_wcslen
add esp, 4
add eax, ebp
lea eax, [eax*2 + 2]
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov esi, eax
push edi
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
mov dword [esp + 4], esi
lea eax, [esi + ebp*2]
push ebx
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
xor eax, eax
mov ebx, dword [esp + 0x8028]
nop word cs:[eax + eax]
cmp dword [ebx + eax], 0
lea eax, [eax + 4]
jne 0x401590
push eax
mov esi, eax
call sub.msvcrt.dll_malloc
add esp, 4
mov ebp, eax
mov edi, dword [ebx]
test edi, edi
je 0x401878
mov dword [esp + 0xc], esi
xor esi, esi
xor ecx, ecx
mov dword [esp + 8], ebp
jmp 0x4015ea
mov dword [ecx], 0x22
mov ebp, dword [esp + 8]
mov dword [ebp + esi*4], eax
push eax
call sub.msvcrt.dll_wcslen
add esp, 4
mov ecx, dword [esp]
add ecx, eax
inc ecx
mov edi, dword [ebx + esi*4 + 4]
inc esi
test edi, edi
je 0x4016d6
mov dword [esp], ecx
push 0x20
push edi
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
jne 0x40160f
push 0x22
push edi
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
je 0x4016cf
push edi
call sub.msvcrt.dll_wcslen
add esp, 4
lea eax, [eax*4 + 6]
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov word [eax], 0x22
xor ebx, ebx
mov ebp, 1
mov ecx, eax
jmp 0x401651
mov word [ecx], 0x5c
add ecx, 2
movzx edx, word [edi + ebx*2]
mov word [ecx], dx
inc ebx
inc ebp
add ecx, 2
movzx edx, word [edi + ebx*2]
cmp edx, 0x22
je 0x401670
test edx, edx
jne 0x40164c
jmp 0x4016a0
mov edx, ebp
test ebx, ebx
je 0x401640
nop word cs:[eax + eax]
cmp word [edi + edx*2 - 4], 0x5c
jne 0x401640
mov word [ecx], 0x5c
add ecx, 2
dec edx
cmp edx, 1
jg 0x401680
jmp 0x401640
test ebx, ebx
mov ebx, dword [esp + 0x8028]
je 0x4015c0
nop
cmp word [edi + ebp*2 - 4], 0x5c
jne 0x4015c0
mov word [ecx], 0x5c
add ecx, 2
dec ebp
cmp ebp, 1
jg 0x4016b0
jmp 0x4015c0
mov eax, edi
jmp 0x4015ca
mov eax, dword [esp + 0xc]
mov dword [ebp + eax - 4], 0
cmp ecx, 0x7d00
mov esi, dword [esp + 4]
jle 0x401884
cmp dword [ebp + 4], 0
je 0x401887
push 0x208
call sub.msvcrt.dll_malloc
add esp, 4
mov ebp, eax
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x401887
push 0x208
call sub.msvcrt.dll_malloc
add esp, 4
mov ebx, eax
push eax
push 0
push 0x403070
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401887
push str.w__ccsUNICODE
push ebx
call dword [sym.imp.msvcrt.dll__wfopen]
add esp, 8
mov ebp, eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x401788
mov esi, dword [esp + 8]
add esi, 8
nop dword [eax + eax]
push eax
push str._ls_n
push ebp
call sub.msvcrt.dll_fwprintf
add esp, 0xc
mov eax, dword [esi]
add esi, 4
test eax, eax
jne 0x401770
push ebp
call sub.msvcrt.dll_fclose
add esp, 4
push ebx
call sub.msvcrt.dll_wcslen
add esp, 4
lea eax, [eax*2 + 4]
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov ebp, eax
push 0x4030a0
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
lea eax, [ebp + 2]
push ebx
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
push 0x20
push ebp
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
jne 0x4017e9
push 0x22
push ebp
call sub.msvcrt.dll_wcschr
add esp, 8
test eax, eax
je 0x401912
push ebp
call sub.msvcrt.dll_wcslen
add esp, 4
lea eax, [eax*4 + 6]
push eax
call sub.msvcrt.dll_malloc
add esp, 4
mov word [eax], 0x22
xor esi, esi
mov edx, 1
mov ecx, eax
jmp 0x401832
mov word [ecx], 0x5c
add ecx, 2
movzx edi, word [ebp + esi*2]
mov word [ecx], di
inc esi
inc edx
add ecx, 2
movzx edi, word [ebp + esi*2]
cmp edi, 0x22
je 0x401850
test edi, edi
jne 0x40182d
jmp 0x4018b6
mov edi, edx
test esi, esi
je 0x401820
nop word cs:[eax + eax]
cmp word [ebp + edi*2 - 4], 0x5c
jne 0x401820
mov word [ecx], 0x5c
add ecx, 2
dec edi
cmp edi, 1
jg 0x401860
jmp 0x401820
mov dword [ebp + esi - 4], 0
mov esi, dword [esp + 4]
push ebp
jmp 0x40188b
push dword [esp + 8]
push esi
push 0
call dword [sym.imp.msvcrt.dll__wspawnvp]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4018ab
push esi
call dword [sym.imp.msvcrt.dll__wperror]
add esp, 4
mov eax, 1
add esp, 0x8010
pop esi
pop edi
pop ebx
pop ebp
ret
test esi, esi
je 0x4018d8
mov esi, dword [esp + 4]
nop
cmp word [ebp + edx*2 - 4], 0x5c
jne 0x4018dc
mov word [ecx], 0x5c
add ecx, 2
dec edx
cmp edx, 1
jg 0x4018c0
jmp 0x4018dc
mov esi, dword [esp + 4]
mov dword [ecx], 0x22
mov ecx, dword [esp + 8]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
push ecx
push esi
push 0
call dword [sym.imp.msvcrt.dll__wspawnvp]
add esp, 0xc
test ebx, ebx
je 0x401897
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov esi, dword [esp + 4]
jmp 0x401897
mov eax, ebp
mov esi, dword [esp + 4]
jmp 0x4018e2