Function at 0x45dfc0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push 5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x45dfe5
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x4ac798], 0x55004e
je 0x45e055
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
sub ecx, 0xffffffff
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push 1
push 0
push 1
push 0
push esi
call ebx
cmp eax, 0xffffffff
je 0x45e035
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45e281
push 0x400
push 0x4ac798
push esi
call edi
test eax, eax
je 0x45e281
cmp eax, 0x400
jg 0x45e281
mov edx, dword [ebp + 8]
push 0x400
push 0x4abf98
push edx
call edi
test eax, eax
je 0x45e281
cmp eax, 0x400
jg 0x45e281
push 0x4abf98
push 0x4ac798
push str._s_s_r_n
push 0x4ab798
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x3f0
mov esi, eax
push 0x4abf98
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x45e281
push str.wininit.ini
push 0x4abf98
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test eax, eax
je 0x45e281
push 0
push 0x8000080
push 4
push 0
push 0
push 0xc0000000
push 0x4abf98
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x45e281
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
je 0x45e27a
push 0
lea eax, [ebx + esi + 0xa]
push eax
push 0
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [ebp - 4], eax
je 0x45e27a
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x45e262
push str._Rename__r_n
push esi
call dword [sym.imp.MSVCR80.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x45e1e2
mov eax, str._Rename__r_n
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45e160
sub eax, edx
sar eax, 1
add eax, 1
push eax
push str._Rename__r_n
lea ecx, [esi + ebx*2]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
jne 0x45e1a5
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push edi
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add ebx, 0xa
mov eax, ebx
mov ecx, dword [ebp - 8]
push ecx
lea edx, [esi + eax*2]
push 0x4ab798
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x45e21c
mov eax, dword [ebp - 4]
push eax
call esi
push edi
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add eax, 0x14
push 0x48bb64
push eax
call dword [sym.imp.MSVCR80.dll_wcsstr]
add esp, 8
test eax, eax
je 0x45e1a8
lea ecx, [esi + ebx*2]
add eax, 2
cmp ecx, eax
jb 0x45e216
mov dx, word [ecx]
mov ebx, dword [ebp - 8]
mov word [ecx + ebx*2], dx
sub ecx, 2
cmp ecx, eax
jae 0x45e202
mov ebx, dword [ebp - 0xc]
sub eax, esi
sar eax, 1
jmp 0x45e1aa
mov ecx, dword [ebp - 4]
push ecx
call esi
test eax, eax
je 0x45e199
mov edx, dword [ebp - 8]
push 0
push 0
add ebx, edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
push edi
je 0x45e19a
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
push edi
je 0x45e19a
call esi
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret