Function at 0x40549b
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [0x42cc30], 3
jl 0x405522
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
push edi
call esi
test eax, eax
je 0x4057f7
cmp dword [ebp + 0xc], 0
je 0x4057fb
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041bb30
lea eax, [ebp - 0x44c]
push eax
call fcn.0041c080
mov byte [ebp + eax - 0x44d], 0x5f
lea eax, [ebp - 0x44c]
push eax
push dword [ebp + 0xc]
call fcn.00404d6e
add esp, 0x14
lea eax, [ebp - 0x44c]
push 4
push edi
push eax
call esi
jmp 0x4057fe
mov esi, 0x104
lea eax, [ebp - 0x348]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x4055aa
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.0041bb30
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x4055aa
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4055aa
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.0041bb00
pop ecx
test eax, eax
pop ecx
je 0x40558e
and byte [eax], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00405453
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0
je 0x4055f4
lea eax, [ebp - 0x104]
push eax
call fcn.0041c080
mov esi, eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.0041bb30
lea eax, [ebp - 0x654]
mov byte [ebp + esi - 0x655], 0x5f
push eax
push dword [ebp + 0xc]
call fcn.00404d6e
lea eax, [ebp - 0x654]
add esp, 0x14
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x550]
mov esi, str.WININIT.INI
push eax
push 0
lea eax, [ebp - 0x348]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4057f7
lea eax, [ebp - 0x348]
push esi
push eax
call fcn.00405453
lea eax, [ebp - 0x550]
push 0x4274c0
push eax
call fcn.0041c744
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4057f7
lea eax, [ebp - 0x348]
push 0x4274bc
push eax
call fcn.0041c744
mov edi, eax
pop ecx
test edi, edi
pop ecx
mov esi, 0x100
je 0x4056b0
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041c6cd
add esp, 0xc
test eax, eax
je 0x4056b0
push 8
lea eax, [ebp - 0x208]
push str._rename_
push eax
call fcn.004231f0
add esp, 0xc
test eax, eax
je 0x4056b0
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041c68a
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041c6cd
add esp, 0x14
jmp 0x405672
push ebx
push str._rename__n
call fcn.0041c68a
cmp dword [ebp + 0xc], 0
pop ecx
pop ecx
jne 0x405717
cmp dword [0x42cc30], 0
je 0x40576b
lea eax, [ebp - 0xa3c]
push str.NUL
push eax
call fcn.0041bb30
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.0041bb40
lea eax, [ebp - 0xa3c]
push 0x427498
push eax
call fcn.0041bb40
lea eax, [ebp - 0xa3c]
push ebx
push eax
call fcn.0041c68a
add esp, 0x20
jmp 0x40576b
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.0041bb30
lea eax, [ebp - 0xa3c]
push 0x427494
push eax
call fcn.0041bb40
push dword [ebp + 0xc]
lea eax, [ebp - 0xa3c]
push eax
call fcn.0041bb40
lea eax, [ebp - 0xa3c]
push 0x427498
push eax
call fcn.0041bb40
lea eax, [ebp - 0xa3c]
push ebx
push eax
call fcn.0041c68a
add esp, 0x28
test edi, edi
je 0x4057a4
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041c6cd
add esp, 0xc
test eax, eax
je 0x4057a4
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041c68a
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041c6cd
add esp, 0x14
jmp 0x405780
push ebx
call fcn.0041c634
test edi, edi
pop ecx
je 0x4057d4
push edi
call fcn.0041c634
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
lea eax, [ebp - 0x348]
push eax
call esi
test eax, eax
jne 0x4057d4
lea eax, [ebp - 0x550]
push eax
call esi
jmp 0x4057f7
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [ebp + 0xc], 0
jne 0x4057fb
cmp dword [0x42cc30], 0
jne 0x4057fb
xor eax, eax
jmp 0x4057fe
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret