Function at 0x423e70
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c719
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x458ac0]
xor eax, ebp
mov dword [ebp - 0x5c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00431400
push eax
lea ecx, [ebp - 0x168]
call fcn.00429f10
mov dword [ebp - 4], 0
call fcn.00431400
push eax
lea ecx, [ebp - 0x170]
call fcn.00429f10
mov byte [ebp - 4], 1
mov byte [ebp - 0x164], 0
push 0x103
push 0
lea eax, [ebp - 0x163]
push eax
call fcn.0043b2d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x423f09
cmp dword [ebp - 0x14], 0x104
jb 0x423f5a
mov byte [ebp - 0x281], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x170]
sub edx, 0x10
mov dword [ebp - 0x2b4], edx
mov ecx, dword [ebp - 0x2b4]
call fcn.00421da3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x168]
sub eax, 0x10
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x2b8]
call fcn.00421da3
mov al, byte [ebp - 0x281]
jmp 0x424b70
push 0x104
lea ecx, [ebp - 0x27c]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x423f80
cmp dword [ebp - 0x14], 0x104
jb 0x423fd1
mov byte [ebp - 0x282], 0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x170]
sub edx, 0x10
mov dword [ebp - 0x2bc], edx
mov ecx, dword [ebp - 0x2bc]
call fcn.00421da3
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x168]
sub eax, 0x10
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x2c0]
call fcn.00421da3
mov al, byte [ebp - 0x282]
jmp 0x424b70
lea ecx, [ebp - 0x164]
test ecx, ecx
jne 0x423fe7
mov dword [ebp - 0x2c4], 0
jmp 0x423ffc
lea edx, [ebp - 0x164]
push edx
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x168]
call fcn.00421470
mov edx, 0x44e574
test edx, edx
jne 0x42402a
mov dword [ebp - 0x2c8], 0
jmp 0x42403d
push 0x44e574
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
push eax
push 0x44e574
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov ecx, 0x44e774
test ecx, ecx
jne 0x424069
mov dword [ebp - 0x2cc], 0
jmp 0x42407c
push 0x44e774
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2cc], eax
mov edx, dword [ebp - 0x2cc]
push edx
push 0x44e774
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov eax, 0x44e770
test eax, eax
jne 0x4240a8
mov dword [ebp - 0x2d0], 0
jmp 0x4240bb
push 0x44e770
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x2d0]
push ecx
push 0x44e770
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov edx, 0x44e76c
test edx, edx
jne 0x4240e7
mov dword [ebp - 0x2d4], 0
jmp 0x4240fa
push 0x44e76c
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
push eax
push 0x44e76c
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov ecx, 0x44e768
test ecx, ecx
jne 0x424126
mov dword [ebp - 0x2d8], 0
jmp 0x424139
push 0x44e768
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2d8], eax
mov edx, dword [ebp - 0x2d8]
push edx
push 0x44e768
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov eax, 0x44e764
test eax, eax
jne 0x424165
mov dword [ebp - 0x2dc], 0
jmp 0x424178
push 0x44e764
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x2dc]
push ecx
push 0x44e764
lea ecx, [ebp - 0x168]
call fcn.00429fb0
mov edx, 0x44e760
test edx, edx
jne 0x4241a4
mov dword [ebp - 0x2e0], 0
jmp 0x4241b7
push 0x44e760
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
push eax
push 0x44e760
lea ecx, [ebp - 0x168]
call fcn.00429fb0
push 0x44e75c
lea ecx, [ebp - 0x168]
push ecx
lea edx, [ebp - 0x288]
push edx
call fcn.00429c10
add esp, 0xc
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f4], eax
mov byte [ebp - 4], 2
push 0x44e758
mov ecx, dword [ebp - 0x3f4]
push ecx
lea edx, [ebp - 0x28c]
push edx
call fcn.00429c10
add esp, 0xc
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2e4]
push ecx
lea ecx, [ebp - 0x170]
call fcn.00421c20
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28c]
sub edx, 0x10
mov dword [ebp - 0x2e8], edx
mov ecx, dword [ebp - 0x2e8]
call fcn.00421da3
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x288]
sub eax, 0x10
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
call fcn.00421da3
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x168]
call fcn.00429f60
neg eax
sbb eax, eax
neg eax
movzx edx, al
test edx, edx
je 0x424507
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x280]
call fcn.004210d0
mov byte [ebp - 4], 4
mov ecx, 0x44e574
test ecx, ecx
jne 0x4242cc
mov dword [ebp - 0x2f8], 0
jmp 0x4242df
push 0x44e574
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2f8], eax
mov edx, dword [ebp - 0x2f8]
push edx
push 0x44e574
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov eax, 0x44e754
test eax, eax
jne 0x42430b
mov dword [ebp - 0x2fc], 0
jmp 0x42431e
push 0x44e754
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x2fc], eax
mov ecx, dword [ebp - 0x2fc]
push ecx
push 0x44e754
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov edx, 0x44e4c4
test edx, edx
jne 0x42434a
mov dword [ebp - 0x300], 0
jmp 0x42435d
push 0x44e4c4
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
push eax
push 0x44e4c4
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov ecx, 0x44e750
test ecx, ecx
jne 0x424389
mov dword [ebp - 0x304], 0
jmp 0x42439c
push 0x44e750
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x304], eax
mov edx, dword [ebp - 0x304]
push edx
push 0x44e750
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov eax, 0x44e74c
test eax, eax
jne 0x4243c8
mov dword [ebp - 0x308], 0
jmp 0x4243db
push 0x44e74c
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
push ecx
push 0x44e74c
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov edx, 0x44e748
test edx, edx
jne 0x424407
mov dword [ebp - 0x30c], 0
jmp 0x42441a
push 0x44e748
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
push eax
push 0x44e748
lea ecx, [ebp - 0x280]
call fcn.00429fb0
mov ecx, 0x44e744
test ecx, ecx
jne 0x424446
mov dword [ebp - 0x310], 0
jmp 0x424459
push 0x44e744
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x310], eax
mov edx, dword [ebp - 0x310]
push edx
push 0x44e744
lea ecx, [ebp - 0x280]
call fcn.00429fb0
push 4
push 0
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
mov ecx, dword [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x314], edx
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 4
push 0
mov edx, dword [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x280]
call fcn.00421430
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
cmp eax, 1
jne 0x424507
mov eax, dword [ebp - 0x168]
push eax
lea ecx, [ebp - 0x27c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
call fcn.00431400
push eax
lea ecx, [ebp - 0x10]
call fcn.00429f10
mov byte [ebp - 4], 5
mov edx, 0x44e740
test edx, edx
jne 0x42452e
mov dword [ebp - 0x320], 0
jmp 0x424541
push 0x44e740
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
push eax
push 0x44e740
lea ecx, [ebp - 0x10]
call fcn.00421470
mov ecx, 0x44e73c
test ecx, ecx
jne 0x42456a
mov dword [ebp - 0x324], 0
jmp 0x42457d
push 0x44e73c
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x324], eax
mov edx, dword [ebp - 0x324]
push edx
push 0x44e73c
lea ecx, [ebp - 0x10]
call fcn.00429fb0
mov eax, 0x44e574
test eax, eax
jne 0x4245a6
mov dword [ebp - 0x328], 0
jmp 0x4245b9
push 0x44e574
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
push ecx
push 0x44e574
lea ecx, [ebp - 0x10]
call fcn.00429fb0
push 0xe
push str.34AC53A09BDC7C
lea edx, [ebp - 0x290]
push edx
call fcn.0042a650
add esp, 0xc
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x334], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx]
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 0x330]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00429fb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x290]
call fcn.00421430
push SysReAllocString
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x294], esp
push 0x44e728
call fcn.004210d0
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
mov dword [ebp - 0x404], edx
mov byte [ebp - 4], 7
push ecx
mov eax, esp
mov dword [ebp - 0x298], esp
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x10
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x344]
push edx
call fcn.00421ce0
add esp, 4
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
add eax, 0x10
mov ecx, dword [ebp - 0x34c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x34c]
mov dword [ebp - 0x408], edx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00422490
mov dword [ebp - 0x40c], eax
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x29c], esp
push 0x44e728
call fcn.004210d0
mov dword [ebp - 0x410], eax
lea ecx, [ebp - 0x58]
call fcn.00422b50
call fcn.00431400
push eax
lea ecx, [ebp - 0x174]
call fcn.00429f10
mov byte [ebp - 4], 9
mov eax, str.SOFTWAREMicroso
test eax, eax
jne 0x42471b
mov dword [ebp - 0x358], 0
jmp 0x42472e
push str.SOFTWAREMicroso
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x358], eax
mov ecx, dword [ebp - 0x358]
push ecx
push str.SOFTWAREMicroso
lea ecx, [ebp - 0x174]
call fcn.00421470
mov edx, str.ftWi
test edx, edx
jne 0x42475a
mov dword [ebp - 0x35c], 0
jmp 0x42476d
push str.ftWi
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
push eax
push str.ftWi
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov ecx, str.ndowsCurren
test ecx, ecx
jne 0x424799
mov dword [ebp - 0x360], 0
jmp 0x4247ac
push str.ndowsCurren
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x360], eax
mov edx, dword [ebp - 0x360]
push edx
push str.ndowsCurren
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov eax, 0x44e6f8
test eax, eax
jne 0x4247d8
mov dword [ebp - 0x364], 0
jmp 0x4247eb
push 0x44e6f8
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
push ecx
push 0x44e6f8
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov edx, str.rsionR
test edx, edx
jne 0x424817
mov dword [ebp - 0x368], 0
jmp 0x42482a
push str.rsionR
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
push eax
push str.rsionR
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov ecx, str.un_ru
test ecx, ecx
jne 0x424856
mov dword [ebp - 0x36c], 0
jmp 0x424869
push str.un_ru
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x36c]
push edx
push str.un_ru
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov eax, 0x44e6e4
test eax, eax
jne 0x424895
mov dword [ebp - 0x370], 0
jmp 0x4248a8
push 0x44e6e4
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
push ecx
push 0x44e6e4
lea ecx, [ebp - 0x174]
call fcn.00429fb0
mov edx, 0x44e6e0
test edx, edx
jne 0x4248d4
mov dword [ebp - 0x374], 0
jmp 0x4248e7
push 0x44e6e0
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
push eax
push 0x44e6e0
lea ecx, [ebp - 0x174]
call fcn.00429fb0
push reloc.OLEAUT32.dll_SysReAllocString
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2a0], esp
push 0x44e4c3
call fcn.004210d0
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x418], ecx
mov byte [ebp - 4], 0xa
push ecx
mov edx, esp
mov dword [ebp - 0x2a4], esp
mov dword [ebp - 0x390], edx
mov eax, dword [ebp - 0x174]
sub eax, 0x10
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x388]
push ecx
call fcn.00421ce0
add esp, 4
mov dword [ebp - 0x38c], eax
mov edx, dword [ebp - 0x38c]
add edx, 0x10
mov eax, dword [ebp - 0x390]
mov dword [eax], edx
mov ecx, dword [ebp - 0x390]
mov dword [ebp - 0x41c], ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x34]
call fcn.00422490
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x16c]
call fcn.00421ba0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x38]
call fcn.00421ba0
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x2a8]
push edx
lea ecx, [ebp - 0x34]
call fcn.00422ad0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x16c]
call fcn.00421c20
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2a8]
call fcn.00421430
lea ecx, [ebp - 0x27c]
test ecx, ecx
jne 0x4249f9
mov dword [ebp - 0x3b0], 0
jmp 0x424a0e
lea edx, [ebp - 0x27c]
push edx
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00421470
mov edx, 0x44e6dc
test edx, edx
jne 0x424a39
mov dword [ebp - 0x3b4], 0
jmp 0x424a4c
push 0x44e6dc
call fcn.0043b390
add esp, 4
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
push eax
push 0x44e6dc
lea ecx, [ebp - 0x38]
call fcn.00429fb0
mov ecx, dword [0x45bf8c]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x3b8], edx
mov eax, dword [ebp - 0x3b8]
push eax
mov ecx, dword [0x45bf8c]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00429fb0
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.00429dd0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x424af4
push ecx
mov edx, esp
mov dword [ebp - 0x2ac], esp
mov dword [ebp - 0x3d4], edx
mov eax, dword [ebp - 0x38]
sub eax, 0x10
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
push ecx
call fcn.00421ce0
add esp, 4
mov dword [ebp - 0x3d0], eax
mov edx, dword [ebp - 0x3d0]
add edx, 0x10
mov eax, dword [ebp - 0x3d4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x34]
call fcn.00422b50
mov byte [ebp - 0x2ad], 1
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x38]
call fcn.00421430
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x16c]
call fcn.00421430
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x34]
call fcn.00422790
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x174]
call fcn.00421430
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00422790
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00421430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.00421430
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.00421430
mov al, byte [ebp - 0x2ad]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
xor ecx, ebp
call fcn.0043b34a
mov esp, ebp
pop ebp
ret