Function at 0x4193f0
Capabilities:
Delete file
Get common file path
Get disk information
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41a649
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1770
call fcn.004159d0
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
lea esp, [esp]
cmp esi, 0x1c434
jge 0x41943e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x6fec80], 0x43f
jne 0x419484
push 0x30
lea eax, [esp + 0x104]
push ebx
push eax
mov dword [esp + 0x108], ebx
call fcn.004113a0
add esp, 0xc
push edi
lea ecx, [esp + 0x100]
push ecx
push ebx
call ebp
push ebx
lea edx, [esp + 0x384]
push edx
push 0x4045a0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
cmp esi, 0x1ea0cd05
jle 0x4194a3
cmp dword [esp + 0x18], 0xad2606
je 0x4194a3
cmp dword [esp + 0x108], 0x8c80ad0
jne 0x4194ac
inc esi
cmp esi, 0x8c797252
jb 0x419430
cmp dword [0x6fec80], 0x12
jne 0x4196c8
push 0x404670
push ebx
call fcn.00408601
push ebx
push ebx
call fcn.004081ad
push ebx
call fcn.00418fb4
add esp, 0x14
mov dword [esp + 0x48], 0x404a68
mov dword [esp + 0x58], 0x404a70
mov dword [esp + 0x178c], ebx
push 4
mov dword [esp + 0x20], 1
mov dword [esp + 0xac], 0x404a0c
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], 0x201
mov dword [esp + 0xc4], 6
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xb8], ebx
call fcn.00408b86
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x41959a
call fcn.00407c49
mov dword [esi], eax
call fcn.00407a08
push ebx
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.00407d32
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x41958f
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 0x24]
call fcn.00407d5a
jmp 0x41959c
xor esi, esi
lea eax, [esp + 0x60]
mov dword [esp + 0xe0], eax
lea edi, [esp + 0x20]
lea eax, [esp + 0xa8]
mov dword [esp + 0xd8], esi
mov dword [esp + 0xe4], ebx
call fcn.00406450
mov edi, eax
mov dword [esp + 0x178c], 3
call fcn.004072b0
mov byte [esp + 0x178c], 2
mov edi, dword [esp + 0x20]
mov ebp, eax
cmp edi, ebx
je 0x419625
push ebx
lea ecx, [esp + 0x1c]
call fcn.00407d32
mov eax, dword [edi + 4]
cmp eax, ebx
jbe 0x419603
cmp eax, 0xffffffff
jae 0x419603
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.00407d5a
cmp esi, ebx
je 0x419625
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
push 0x20
mov ecx, ebp
call eax
mov byte [esp + 0xe8], al
cmp dword [esp + 0xe0], ebx
jne 0x41966a
mov eax, dword [esp + 0xb4]
or eax, 4
and eax, 0x17
mov dword [esp + 0xb4], eax
test dword [esp + 0xb8], eax
je 0x41966a
lea ecx, [esp + 0xa8]
call fcn.00406380
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x58], 0x404a14
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x48], 0x404a1c
mov dword [esp + 0x178c], 6
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + eax + 0x4c], 0x404a64
call fcn.004071c0
mov dword [esp + 0x60], 0x404a24
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
push ebx
call fcn.00408b1e
mov eax, 0x38d6
add dword [0x6fec80], eax
mov edx, dword [0x6fec80]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x6fdb94], eax
mov dword [esp + 0x1c], 0x963510
cmp dword [0x6fec80], 3
jne 0x41971f
push 0x40467c
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [0x6fec80], 0xbc5
jne 0x4197f3
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x4046ac
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
call edi
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x388]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0
push 0
push 0
call edi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push 0x4046e8
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0x40471c
call ebp
push 0x404748
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0x4047d8
push 0x4047e4
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
push 0x4047f4
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec dword [esp + 0x1c]
jne 0x419706
mov eax, dword [0x6fec80]
xor esi, esi
test eax, eax
je 0x41983a
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
mov edi, edi
call fcn.00419080
cmp dword [0x6fec80], 0x29
jne 0x419830
push 0
push 0
push 0
push 0x404830
push 0x40488c
call edi
mov eax, dword [0x6fec80]
inc esi
cmp esi, eax
jb 0x419810
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp eax, 0x19c
jne 0x41989b
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea edx, [esp + 0x20]
push edx
call edi
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
call ebx
push 0x40489c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
push 0x4048b0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
mov ebp, 0x250b3
jmp 0x4198b0
cmp dword [0x6fec80], 0x92
jne 0x4198c5
push 0x4048e4
push 0
call esi
dec ebp
jne 0x4198b0
mov byte [0x4859b0], 0
call fcn.00418fc0
call fcn.004193c0
call fcn.00419060
call fcn.00419360
cmp dword [0x6fec80], 0xd5c
mov byte [0x4859b1], 0x73
jne 0x4199cb
lea eax, [esp + 0x130]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x18]
push ecx
call edi
push ebp
lea edx, [esp + 0xb84]
push edx
push 0x404914
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push ebp
lea eax, [esp + 0x384]
push eax
push 0x404920
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push 0x404984
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebp
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push ebp
call ebx
push 0x404994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov word [esp + 0x46], ax
xor edx, edx
lea eax, [esp + 0x38]
mov word [esp + 0x28], cx
push eax
lea ecx, [esp + 0x2c]
mov word [esp + 0x3c], dx
push ecx
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
lea eax, [esp + 0xf80]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.00419070
mov ecx, dword [esp + 0x1784]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret