Function at 0x40e550
Capabilities:
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46575e
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x47f344]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47f344]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor ebx, ebx
push 0x104
lea eax, [esp + 0x159]
push ebx
push eax
mov byte [esp + 0x160], bl
call fcn.00442eb0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, 0xf
lea eax, [esp + 0x154]
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40e5e1
sub eax, edx
push eax
lea edx, [esp + 0x158]
push edx
lea ecx, [esp + 0x98]
call fcn.00406e20
push 7
push str.d7pcfg
lea eax, [esp + 0x98]
mov dword [esp + 0x270], ebx
call fcn.00408d20
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x288], 1
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xb8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00407c00
call fcn.004128c0
mov ecx, dword [esp + 0x8c]
add esp, 0x20
cmp ecx, ebx
mov esi, 0x10
jne 0x40e6a7
cmp dword [esp + 0x70], esi
jb 0x40e681
mov eax, dword [esp + 0x5c]
push eax
call fcn.0043e445
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ee13
mov ecx, dword [esp + 0x94]
push ecx
jmp 0x40ee0b
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x40e6b5
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x78]
push edx
call fcn.0040d440
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x274], 2
call fcn.00407c00
cmp dword [esp + 0x8c], esi
jb 0x40e6ee
mov eax, dword [esp + 0x78]
push eax
call fcn.0043e445
add esp, 4
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
mov dword [esp + 0x148], ecx
mov byte [esp + 0x14c], bl
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0xdc]
mov byte [esp + 0x270], 5
call fcn.00422270
test al, al
jne 0x40e85f
cmp dword [esp + 0x144], esi
jb 0x40e7e9
mov ecx, dword [esp + 0x130]
push ecx
call fcn.0043e445
add esp, 4
cmp dword [esp + 0x114], esi
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40e817
mov edx, dword [esp + 0x100]
push edx
call fcn.0043e445
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040fc90
lea esi, [esp + 0xd4]
call fcn.0043b880
lea esi, [esp + 0x1c]
mov byte [esp + 0x268], 1
call fcn.00429810
mov esi, 0x10
jmp 0x40e66e
mov byte [esp + 0x17], bl
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
push 0x46a567
push 0x46a564
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x274], 6
call fcn.0042ab80
mov ecx, eax
call fcn.0042b2b0
test al, al
je 0x40ea07
push 0x46a573
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.0042ab80
cmp byte [eax + 8], 4
jne 0x40ea07
push 0x46a57e
push str.createtime
lea ecx, [esp + 0x24]
push ecx
call fcn.0042ab80
mov ecx, eax
call fcn.0042b3c0
test al, al
je 0x40ea07
push 0x46a567
push 0x46a564
lea edx, [esp + 0x24]
push edx
call fcn.0042ab80
mov esi, eax
call fcn.00429c90
push 0x46a573
mov edi, eax
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.0042ab80
mov ecx, eax
call fcn.00429980
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40e940
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.00406e20
push 0x46a57e
push str.createtime
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x274], 7
call fcn.0042ab80
mov esi, eax
call fcn.0042a0a0
mov ebp, edx
lea edx, [esp + 0xac]
mov ecx, edi
mov esi, eax
call fcn.0040d820
test al, al
je 0x40e9ec
cmp edi, dword [esp + 0xc8]
jne 0x40e9ec
mov ecx, dword [esp + 0xb0]
mov edi, 0x10
cmp dword [esp + 0xc4], edi
jae 0x40e9b4
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x8c], edi
mov eax, dword [esp + 0x78]
jae 0x40e9c5
lea eax, [esp + 0x78]
push ecx
push eax
call fcn.00456e88
add esp, 8
test eax, eax
jne 0x40e9f1
cmp esi, dword [esp + 0xcc]
jne 0x40e9f1
cmp ebp, dword [esp + 0xd0]
jne 0x40e9f1
mov byte [esp + 0x17], 1
jmp 0x40e9f1
mov edi, 0x10
cmp dword [esp + 0x8c], edi
jb 0x40ea07
mov edx, dword [esp + 0x78]
push edx
call fcn.0043e445
add esp, 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 0x46a585
push str.files
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x274], 9
call fcn.0042ab80
cmp byte [eax + 8], 6
jne 0x40ebdb
push 0x46a585
push str.files
lea ecx, [esp + 0x24]
push ecx
xor edi, edi
call fcn.0042ab80
mov ecx, eax
call fcn.0042a4e0
test eax, eax
jbe 0x40ebdb
push 0x46a585
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.0042ab80
push edi
push eax
call fcn.0042a9d0
push 0x46a58c
push str.file
push eax
call fcn.0042ab80
cmp byte [eax + 8], 4
jne 0x40ebb5
push 0x46a585
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.0042ab80
push edi
push eax
call fcn.0042a9d0
push 0x46a58c
push str.file
push eax
call fcn.0042ab80
mov ecx, eax
call fcn.00429980
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40eaf0
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.00406e20
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x3c]
mov byte [esp + 0x26c], 0xa
call fcn.004074e0
push 0x46a585
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.0042ab80
push edi
push eax
call fcn.0042a9d0
push 0x46a596
push str.HANDLE
push eax
call fcn.0042ab80
mov ecx, eax
call fcn.0042b2b0
test al, al
je 0x40eb96
push 0x46a585
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.0042ab80
push edi
push eax
call fcn.0042a9d0
push 0x46a596
push str.HANDLE
push eax
call fcn.0042ab80
mov esi, eax
call fcn.00429c90
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x4c]
mov dword [esp + 0x1c], eax
call fcn.0040fb30
mov byte [esp + 0x268], 9
cmp dword [esp + 0x8c], 0x10
jb 0x40ebb5
mov edx, dword [esp + 0x78]
push edx
call fcn.0043e445
add esp, 4
push 0x46a585
push str.files
lea eax, [esp + 0x24]
push eax
add edi, 1
call fcn.0042ab80
mov ecx, eax
call fcn.0042a4e0
cmp edi, eax
jb 0x40ea6a
cmp byte [esp + 0x17], bl
je 0x40ebf1
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x48]
call fcn.0040da30
xor edi, edi
xor ebp, ebp
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x40ec47
mov ecx, dword [esp + 0x40]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x40ec47
cmp dword [esi + ebp + 0x18], 0x10
jb 0x40ec34
mov esi, dword [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40ebf5
lea esi, [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40ebf5
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40ec5c
push eax
call fcn.0043e445
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov ebp, 0xf
je 0x40ecb0
mov edi, dword [esp + 0x40]
cmp esi, edi
je 0x40eca7
add esi, 0x18
lea esp, [esp]
cmp dword [esi], 0x10
jb 0x40ec91
mov eax, dword [esi - 0x14]
push eax
call fcn.0043e445
add esp, 4
mov dword [esi], ebp
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea ecx, [esi - 0x18]
cmp ecx, edi
jne 0x40ec80
mov esi, dword [esp + 0x3c]
push esi
call fcn.0043e445
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jb 0x40ecd6
mov edx, dword [esp + 0xb0]
push edx
call fcn.0043e445
add esp, 4
cmp dword [esp + 0x144], 0x10
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
jb 0x40ed05
mov eax, dword [esp + 0x130]
push eax
call fcn.0043e445
add esp, 4
cmp dword [esp + 0x114], 0x10
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40ed34
mov ecx, dword [esp + 0x100]
push ecx
call fcn.0043e445
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040fc90
lea esi, [esp + 0xd4]
call fcn.0043b880
mov byte [esp + 0x268], 1
mov ecx, dword [esp + 0x24]
movsx eax, cl
cmp eax, 4
je 0x40ed94
add eax, 0xfffffffa
cmp eax, 1
ja 0x40eda9
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov esi, ecx
je 0x40eda9
call fcn.0042b5b0
push esi
call fcn.0043e445
jmp 0x40eda6
test ecx, 0x100
je 0x40eda9
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043fe16
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40edce
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x4291e0
push ecx
push 4
push eax
call fcn.0043ef65
push esi
call fcn.0043ebec
add esp, 4
mov esi, 0x10
cmp dword [esp + 0x70], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jb 0x40edee
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043e445
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40ee13
mov eax, dword [esp + 0x94]
push eax
call fcn.0043e445
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043e436
add esp, 0x258
ret