Function at 0x412970
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Move file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xebc
mov eax, dword [0x467060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xeb4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
mov dword [ebp - 0xebc], ebx
call sub.MSVCR110.dll_memset
lea ecx, [ebp - 0x620]
mov esi, ebx
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
jmp 0x4129d0
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4129ee
movzx eax, word [esi + ecx]
test ax, ax
je 0x4129ee
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4129d0
jmp 0x4129f2
test edx, edx
jne 0x4129f5
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push ecx
lea ecx, [ebp - 0x620]
call fcn.00412610
lea eax, [ebp - 0xeb0]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xeb8], eax
cmp eax, 0xffffffff
jne 0x412a41
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004413e6
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0xeb0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x412d76
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea esp, [esp]
test byte [ebp - 0xeb0], 0x10
jne 0x412d5b
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe84]
push eax
push dword [ebp - 0xebc]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [ebp - 0xeb4]
mov eax, 0x44c110
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412ae6
test dx, dx
je 0x412ae2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412ae6
add eax, 4
add ecx, 4
test dx, dx
jne 0x412ac0
xor eax, eax
jmp 0x412aeb
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [ebp - 0x210]
push eax
jne 0x412b23
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412d5b
call ebx
push eax
lea eax, [ebp - 0x210]
push eax
push str.CUninstalltools::DeleteFileAsType__DeleteFile_failed:_path___s__err___d_
call edi
add esp, 0xc
lea eax, [ebp - 0x210]
jmp 0x412d54
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push dword [ebp - 0xeb4]
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x412d5b
mov eax, dword [0x46a8ec]
test al, 1
jne 0x412b5f
or eax, 1
push 0x448710
mov dword [0x46a8ec], eax
call fcn.00441527
add esp, 4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412bbf
lea eax, [ebp - 0xc5c]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x412baa
mov eax, dword [ebp - 0xc5c]
and eax, 0xffffff7f
test al, 1
je 0x412baa
xor eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412d5b
call ebx
push eax
lea eax, [ebp - 0x210]
push eax
push str.CUninstalltools::DeleteFileAsType__ForceRemoveFile_failed:_path___s__err___d_
call edi
add esp, 0xc
lea eax, [ebp - 0xc38]
push 0x104
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x210]
push eax
call fcn.00413e60
test al, al
jne 0x412cfa
push str.CUninstalltools::DeleteFileAsType__IsFileInSystemDrive:_return_false_
call edi
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call sub.MSVCR110.dll_memset
add esp, 8
lea eax, [ebp - 0x210]
push eax
push ecx
mov edx, 0x82
lea ecx, [ebp - 0x828]
call fcn.00405d10
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x828]
push str.TEMP
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412cc1
call fcn.00403fa0
lea ecx, [ebp - 0x418]
call fcn.004333d0
lea eax, [ebp - 0x418]
push eax
push str.CUninstalltools::DeleteFileAsType__MakeSureDirPathExist:_path___s_
call edi
add esp, 8
lea eax, [ebp - 0x418]
push 4
push 0
push eax
call esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412cfa
push 0x208
lea eax, [ebp - 0xc38]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0xc38]
call fcn.004125c0
lea eax, [ebp - 0xa30]
push eax
push 0
push 0x44dbf0
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 3
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x412d4e
call ebx
push eax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
push str.CUninstalltools::DeleteFileAsType__MoveFileEx_failed:_src___s__dst___s__err___d_
call edi
add esp, 0x10
lea eax, [ebp - 0x210]
jmp 0x412d54
lea eax, [ebp - 0xa30]
push 4
push 0
push eax
call esi
lea eax, [ebp - 0xeb0]
push eax
push dword [ebp - 0xeb8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412a70
push dword [ebp - 0xeb8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004413e6
mov esp, ebp
pop ebp
ret 8