Function at 0x401760
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4c
mov eax, dword [0x414110]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov dword [esp + 0xc50], eax
push edi
je 0x401a40
mov esi, dword [ebp + 0x10]
test esi, esi
mov dword [esp + 0xc], 0
jne 0x4017c1
xor eax, eax
mov ecx, 0x100
lea edi, [esp + 0x850]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x850]
push eax
call fcn.00402b00
lea ecx, [esp + 0x854]
add esp, 4
mov dword [ebp + 0x10], ecx
mov esi, ecx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017c6
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
jne 0x4017de
mov dword [esp + 0xc], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401a40
test al, 0x10
jne 0x401a40
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x401806
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401810
push 3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401a40
mov byte [esp + 0x450], al
mov ecx, 0xff
lea edi, [esp + 0x451]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
test esi, esi
mov byte [esp + 0x50], 0
mov ecx, 0xff
lea edi, [esp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x4018df
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x4018d3
test al, 0x10
jne 0x4018d3
push esi
lea edx, [esp + 0x54]
push str._s.bak
push edx
call fcn.0040628e
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
push 0x5c
push esi
je 0x401888
call fcn.00405b08
add esp, 8
inc eax
jmp 0x401890
call fcn.00405b08
add esp, 8
push eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x458]
push str._s_s.bak
push ecx
call fcn.0040628e
add esp, 0x10
lea edx, [esp + 0x50]
push edx
call edi
cmp eax, 0xffffffff
je 0x4018c5
test al, 0x10
jne 0x4018c5
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x50]
push ecx
push esi
call fcn.00406260
add esp, 8
push 3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x40195d
push ebx
lea edx, [esp + 0x54]
push str._s.bak
push edx
call fcn.0040628e
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
push 0x5c
push ebx
je 0x401908
call fcn.00405b08
add esp, 8
inc eax
jmp 0x401910
call fcn.00405b08
add esp, 8
push eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x458]
push str._s_s.bak
push ecx
call fcn.0040628e
add esp, 0x10
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401949
test al, 0x10
jne 0x401949
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x50]
push ecx
push ebx
call fcn.00406260
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 8
mov al, byte [esp + 0x450]
test al, al
je 0x401a40
mov al, byte [esp + 0x50]
test al, al
je 0x401a40
lea edx, [esp + 0x50]
push edx
call edi
cmp eax, 0xffffffff
je 0x401a40
test al, 0x10
jne 0x401a40
xor ebx, ebx
push ebx
call fcn.00406a5b
mov edx, eax
xor eax, eax
mov byte [esp + 0x14], bl
mov ecx, 0xf
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x410278
push eax
call fcn.0040628e
lea eax, [esp + 0x20]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4019c7
lea edi, [esp + 0x450]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4019d8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 3
lea ecx, [esp + 0x454]
push ecx
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401a53
lea edi, [esp + 0x450]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401a11
mov eax, dword [str..bak]
mov cl, byte [0x410274]
mov edx, ebx
mov dword [edi], eax
inc ebx
cmp edx, 0xa
mov byte [edi + 4], cl
jl 0x4019f0
push 0
lea ecx, [esp + 0x54]
push ecx
call fcn.004012e0
add esp, 8
mov ecx, dword [esp + 0xc54]
call fcn.00405500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x454]
push eax
jmp 0x401a38