Function at 0x4197a0
Capabilities:
Get common file path
Get disk information
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41d2d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa2c
push ebx
push ebp
mov ebp, dword [esp + 0xd4]
push esi
xor esi, esi
push edi
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x1c]
xor edi, edi
cmp edi, 0x1c3da
jge 0x4197ea
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
cmp edi, 0x1ea0c8af
jle 0x419802
cmp ebx, 0xad26ce
je 0x419802
cmp ebp, 0x8c9c050
jne 0x41980b
inc edi
cmp edi, 0x8c2ca62a
jb 0x4197d8
cmp dword [0x6d29f0], 0x12
jne 0x419bfa
push esi
push esi
push esi
call fcn.00409697
add esp, 0xc
push 0x404060
push esi
call fcn.0040a1a9
push esi
push esi
push esi
push 0x459720
call fcn.00409e62
push esi
push esi
call fcn.004095e0
push esi
call fcn.00409d27
add esp, 0x24
push esi
push esi
call fcn.00409beb
mov dword [esp + 0x30], 0x404270
mov dword [esp + 0x40], 0x404278
mov dword [esp + 0xa4c], esi
push 4
mov dword [esp + 0x24], 1
mov dword [esp + 0x94], 0x404214
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0xc4], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x201
mov dword [esp + 0xac], 6
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa0], esi
call fcn.0040a5db
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x419918
call fcn.00408dcd
mov dword [edi], eax
call fcn.00408b8c
push esi
lea ecx, [esp + 0x28]
mov ebp, eax
call fcn.00408f93
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
jae 0x41990d
inc eax
mov dword [ebp + 4], eax
lea ecx, [esp + 0x24]
call fcn.00408fbb
jmp 0x41991a
xor edi, edi
lea eax, [esp + 0x40]
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc0], eax
lea edi, [esp + 0x14]
lea eax, [esp + 0x88]
mov dword [esp + 0xc4], esi
call fcn.00405400
mov edi, eax
mov dword [esp + 0xa44], 3
call fcn.004082d0
mov byte [esp + 0xa44], 2
mov ebp, dword [esp + 0x14]
mov ebx, eax
cmp ebp, esi
je 0x4199a3
push esi
lea ecx, [esp + 0x20]
call fcn.00408f93
mov eax, dword [ebp + 4]
cmp eax, esi
jbe 0x419981
cmp eax, 0xffffffff
jae 0x419981
dec eax
mov dword [ebp + 4], eax
mov edi, dword [ebp + 4]
neg edi
sbb edi, edi
not edi
lea ecx, [esp + 0x1c]
and edi, ebp
call fcn.00408fbb
cmp edi, esi
je 0x4199a3
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x18]
push 0x20
mov ecx, ebx
call eax
mov byte [esp + 0xc8], al
cmp dword [esp + 0xc0], esi
jne 0x4199e8
mov eax, dword [esp + 0x94]
or eax, 4
and eax, 0x17
mov dword [esp + 0x94], eax
test dword [esp + 0x98], eax
je 0x4199e8
push esi
lea ecx, [esp + 0x8c]
call fcn.00405320
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x38], 0x40421c
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], 0x404224
mov dword [esp + 0xa44], 6
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x40]
mov ebp, 0x40426c
push ecx
mov dword [esp + eax + 0x2c], ebp
call fcn.00406f00
mov edi, 0x40422c
mov dword [esp + 0x40], edi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
push 0x40406c
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0xa4c], 8
call fcn.004055e0
push 0x404070
lea eax, [esp + 0x3c]
push eax
call fcn.004055e0
push esi
push esi
call fcn.00409ce7
push esi
push esi
call fcn.00409ce7
push esi
call fcn.00409bb1
add esp, 0x14
push esi
push esi
call fcn.0040a2f6
push esi
call fcn.0040a27c
add esp, 0xc
push esi
call fcn.0040a567
add esp, 4
push esi
push esi
push esi
call fcn.0040a42d
add esp, 0xc
push esi
push esi
push esi
push esi
push esi
call fcn.0040941b
add esp, 0x14
push esi
push esi
push esi
call fcn.0040a158
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x94]
add esp, 0xc
mov dword [esp + 0x14], ecx
mov dword [esp + eax + 0x28], ebp
mov dword [esp + 0xa44], 9
test byte [esp + 0x80], 1
lea ecx, [esp + 0x40]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x40], edi
je 0x419b01
mov edx, dword [esp + 0x50]
mov eax, dword [edx]
push eax
call fcn.0040a271
add esp, 4
mov eax, dword [esp + 0x50]
mov dword [eax], esi
mov ecx, dword [esp + 0x60]
mov dword [ecx], esi
mov edx, dword [esp + 0x70]
mov dword [edx], esi
mov eax, dword [esp + 0x54]
mov dword [eax], esi
mov ecx, dword [esp + 0x64]
mov dword [ecx], esi
mov edx, dword [esp + 0x74]
mov dword [edx], esi
and dword [esp + 0x80], 0xfffffffe
mov dword [esp + 0x7c], esi
mov dword [esp + 0x40], 0x4041d4
mov byte [esp + 0xa44], 0xa
mov eax, dword [esp + 0x78]
mov ebx, eax
cmp eax, esi
je 0x419b96
mov ebp, dword [eax]
cmp ebp, esi
je 0x419b8d
push esi
lea ecx, [esp + 0x20]
call fcn.00408f93
mov eax, dword [ebp + 4]
cmp eax, esi
jbe 0x419b6b
cmp eax, 0xffffffff
jae 0x419b6b
dec eax
mov dword [ebp + 4], eax
mov edi, dword [ebp + 4]
neg edi
sbb edi, edi
not edi
lea ecx, [esp + 0x1c]
and edi, ebp
call fcn.00408fbb
cmp edi, esi
je 0x419b8d
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
push ebx
call fcn.0040a271
add esp, 4
lea ecx, [esp + 0x44]
mov byte [esp + 0xa44], 9
call fcn.00408fec
mov dword [esp + 0xa44], 0xffffffff
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x28], 0x404224
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
mov dword [esp + eax + 0x38], 0x40421c
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x88]
mov dword [esp + edx + 0x28], 0x404214
push eax
mov dword [esp + 0x8c], 0x4041cc
call fcn.00408ac2
add esp, 4
mov eax, 0x3a02
add dword [0x6d29f0], eax
mov ecx, dword [0x6d29f0]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov ebp, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x6d1904], eax
mov dword [esp + 0x18], 0x963510
jmp 0x419c40
cmp dword [0x6d29f0], 0xbc5
jne 0x419cd1
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
lea edx, [esp + 0x20]
push edx
call esi
push 0
lea eax, [esp + 0x18]
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x404074
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0x40408c
push 0x4040cc
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec dword [esp + 0x18]
jne 0x419c40
mov eax, dword [0x6d29f0]
xor esi, esi
test eax, eax
je 0x419d1a
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea esp, [esp]
call fcn.00419480
cmp dword [0x6d29f0], 0x29
jne 0x419d10
push 0
push 0
push 0
push 0x4040dc
push 0x404104
call edi
mov eax, dword [0x6d29f0]
inc esi
cmp esi, eax
jb 0x419cf0
cmp eax, 0x584
jne 0x419d75
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0x404128
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x404150
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
lea eax, [esp + 0x23c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, 0x25883
cmp dword [0x6d29f0], 0x15a
jne 0x419d93
lea ecx, [esp + 0x1c]
push ecx
call edi
dec esi
jne 0x419d80
mov byte [0x459720], 0
call fcn.004193c0
call fcn.00419770
call fcn.00419460
call fcn.00419570
cmp dword [0x6d29f0], 0xd5c
mov byte [0x459721], 0x73
jne 0x419e23
lea edx, [esp + 0xf8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
lea ecx, [esp + 0x23c]
push ecx
push 0x40415c
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x40416c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
lea edx, [esp + 0x638]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0xa3c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret