Function at 0x402e59
Capabilities:
Delete file
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
mov eax, dword [0x462284]
push eax
call fcn.0043a0f4
add esp, 4
cmp dword [0x45e03c], 0
je 0x402e98
mov eax, dword [0x462284]
push eax
push 0x9a3940
push str._r_nINIT01RR:_IPATH__s_._d
call fcn.00452380
add esp, 0xc
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x4b4], eax
push str._r_nSET_REMOVE_AT_REBOOT_FOR__some_files_may_not_be_present_:_r_n
call fcn.00452380
add esp, 4
mov eax, 0x45f960
mov ecx, 0x45f964
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45f968
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45f97c
call fcn.00452380
add esp, 8
mov eax, 0x45f984
mov ecx, 0x45f988
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45f98c
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45f9a0
call fcn.00452380
add esp, 8
mov eax, 0x45f9a8
mov ecx, 0x45f9ac
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45f9b0
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45f9c4
call fcn.00452380
add esp, 8
mov eax, 0x45f9cc
mov ecx, 0x45f9d0
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45f9d4
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45f9e8
call fcn.00452380
add esp, 8
mov eax, 0x45f9f0
mov ecx, 0x45f9f4
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45f9f8
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fa0c
call fcn.00452380
add esp, 8
mov eax, 0x45fa14
mov ecx, 0x45fa18
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sCPT_X64A.new
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fa30
call fcn.00452380
add esp, 8
mov eax, 0x45fa38
mov ecx, 0x45fa3c
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sCPT_X64A.exe
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fa54
call fcn.00452380
add esp, 8
mov eax, 0x45fa5c
mov ecx, 0x45fa60
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push 0x45fa64
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fa74
call fcn.00452380
add esp, 8
mov eax, 0x45fa7c
mov ecx, 0x45fa80
mov edx, dword [ebp - 0x4b4]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sINVENTRY.EXE
push 0x378
lea eax, [ebp - 0x378]
push eax
call fcn.00452660
add esp, 0x14
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fa98
call fcn.00452380
add esp, 8
push 0x138
lea eax, [ebp - 0x4b0]
push eax
push 0x45faa0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [0x462284], 0
je 0x403379
lea edi, [ebp - 0x4b0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x378]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str._sysnativedriversSTLWA_64.SYS
lea edi, [ebp - 0x378]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45facc
call fcn.00452380
add esp, 8
lea edi, [ebp - 0x4b0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x378]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str._sysnativedriversSTBW_K64.SYS
lea edi, [ebp - 0x378]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45faf4
call fcn.00452380
add esp, 8
jmp 0x403456
lea edi, [ebp - 0x4b0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x378]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str._system32driversSTVISTA.SYS
lea edi, [ebp - 0x378]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fb1c
call fcn.00452380
add esp, 8
lea edi, [ebp - 0x4b0]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x378]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str._system32driversSTBW_K32.SYS
lea edi, [ebp - 0x378]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 4
push 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x378]
push eax
push 0x45fb44
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret