Function at 0x41be20
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527cb8
mov eax, dword fs:[0]
push eax
sub esp, 0x6cc
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6d0], ebx
mov dword [ecx], 0
mov ecx, eax
call fcn.00404470
test al, al
jne 0x41c2b3
mov ecx, esi
call fcn.00404470
test al, al
jne 0x41c2b3
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x41c2b3
push esi
call fcn.00488f70
add esp, 4
test al, al
je 0x41c29b
lea ecx, [ebp - 0x6cc]
call fcn.00491260
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x69c]
call fcn.00402ac0
mov byte [ebp - 4], 1
mov eax, dword [0x58c9dc]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x58c9dc
test eax, eax
je 0x41bef3
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
mov ecx, 0x58c9e0
call fcn.00404470
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test al, al
jne 0x41bf43
push 0x58c9e0
call fcn.00402db0
lea ecx, [ebp - 0x69c]
add esp, 4
cmp ecx, eax
je 0x41c007
mov ecx, 0x58c9e0
call fcn.00402ae0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x41bf3a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x41bffc
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e42f0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x41c1f0
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004e42f0
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x41bfe5
test eax, eax
je 0x41bfe5
add eax, eax
cmp eax, 0x412
jae 0x41c2d1
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.00402d60
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x41bffb
lea eax, [ebp - 0x220]
push eax
call fcn.00402d60
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x69c]
call fcn.00402b50
mov byte [ebp - 4], 1
mov eax, dword [0x58c9dc]
test eax, eax
je 0x41c01b
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x63c], 0
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.0048a2f0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
push 0xb
call fcn.00403390
push eax
mov ecx, esi
call fcn.00403390
push eax
call edi
test eax, eax
jne 0x41c0f7
lea ecx, [ebp - 0x66c]
xor bl, bl
call fcn.00402ac0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x66c]
mov ecx, esi
call fcn.004aba40
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp - 0x6b4]
call fcn.00402ac0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x6b4]
lea ecx, [ebp - 0x654]
call fcn.004aba40
test al, al
jne 0x41c0b9
test bl, bl
je 0x41c123
push 0xb
lea ecx, [ebp - 0x6b4]
call fcn.00403390
push eax
lea ecx, [ebp - 0x66c]
call fcn.00403390
push eax
call edi
test eax, eax
je 0x41c123
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6b4]
call fcn.00402a60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.00402a60
push 4
push 0
lea ecx, [ebp - 0x654]
call fcn.00403390
push eax
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x654]
call fcn.00402a60
mov ebx, dword [ebp - 0x6d0]
jmp 0x41c20e
lea ecx, [ebp - 0x654]
call fcn.004ab440
cmp eax, 0xffffffff
je 0x41c1bb
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x684]
call fcn.00404520
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x684]
call fcn.004ab800
test al, al
je 0x41c1ac
lea edx, [ebp - 0x684]
lea ecx, [ebp - 0x654]
call fcn.004ab4e0
test al, al
je 0x41c1ac
lea edx, [ebp - 0x654]
mov ecx, esi
call fcn.004ab4e0
lea ecx, [ebp - 0x684]
test al, al
je 0x41c1a1
call fcn.004ab5f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x684]
call fcn.00402a60
jmp 0x41c0d9
lea edx, [ebp - 0x654]
call fcn.004ab4e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x684]
call fcn.00402a60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6b4]
call fcn.00402a60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.00402a60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x654]
call fcn.00402a60
mov ebx, dword [ebp - 0x6d0]
jmp 0x41c20e
mov byte [ebp - 4], 1
mov eax, dword [0x58c9dc]
test eax, eax
je 0x41c204
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
push esi
call fcn.00488f70
add esp, 4
test al, al
je 0x41c27a
mov ecx, ebx
call fcn.00489610
test al, al
je 0x41c27a
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x66c]
push ebx
push eax
call fcn.0048a2f0
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x66c]
push 1
call fcn.00403390
push eax
mov ecx, esi
call fcn.00403390
push eax
call edi
push 4
push 0
lea ecx, [ebp - 0x66c]
call fcn.00403390
push eax
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x66c]
call fcn.00402a60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x69c]
call fcn.00402a60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6cc]
call fcn.00402a60
push dword [ebp - 0x6d4]
mov ecx, dword [ebp - 0x6d8]
mov edx, esi
call fcn.0041baa0
add esp, 4
jmp 0x41c2b5
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret
call fcn.004e20a1
int3