Function at 0x40a7c0
Capabilities:
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45f30e
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x478354]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x478354]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor ebx, ebx
push 0x104
lea eax, [esp + 0x159]
push ebx
push eax
mov byte [esp + 0x160], bl
call fcn.0043e300
add esp, 0xc
push 0x104
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, 0xf
lea eax, [esp + 0x154]
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40a851
sub eax, edx
push eax
lea edx, [esp + 0x158]
push edx
lea ecx, [esp + 0x98]
call fcn.004056b0
push 7
push str.d7pcfg
lea eax, [esp + 0x98]
mov dword [esp + 0x270], ebx
call fcn.00407c90
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x288], 1
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xb8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00405fd0
call fcn.0040efe0
mov ecx, dword [esp + 0x8c]
add esp, 0x20
cmp ecx, ebx
mov esi, 0x10
jne 0x40a917
cmp dword [esp + 0x70], esi
jb 0x40a8f1
mov eax, dword [esp + 0x5c]
push eax
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40b083
mov ecx, dword [esp + 0x94]
push ecx
jmp 0x40b07b
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x40a925
lea eax, [esp + 0x5c]
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004096b0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x274], 2
call fcn.00405fd0
cmp dword [esp + 0x8c], esi
jb 0x40a95e
mov eax, dword [esp + 0x78]
push eax
call fcn.0043bef7
add esp, 4
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
mov dword [esp + 0x148], ecx
mov byte [esp + 0x14c], bl
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0xdc]
mov byte [esp + 0x270], 5
call fcn.0041d760
test al, al
jne 0x40aacf
cmp dword [esp + 0x144], esi
jb 0x40aa59
mov ecx, dword [esp + 0x130]
push ecx
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0x114], esi
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40aa87
mov edx, dword [esp + 0x100]
push edx
call fcn.0043bef7
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040bfa0
lea esi, [esp + 0xd4]
call fcn.00439bb0
lea esi, [esp + 0x1c]
mov byte [esp + 0x268], 1
call fcn.00425530
mov esi, 0x10
jmp 0x40a8de
mov byte [esp + 0x17], bl
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
push 0x464183
push 0x464180
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x274], 6
call fcn.004268a0
mov ecx, eax
call fcn.00426fd0
test al, al
je 0x40ac77
push 0x46418f
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.004268a0
cmp byte [eax + 8], 4
jne 0x40ac77
push 0x46419a
push str.createtime
lea ecx, [esp + 0x24]
push ecx
call fcn.004268a0
mov ecx, eax
call fcn.004270e0
test al, al
je 0x40ac77
push 0x464183
push 0x464180
lea edx, [esp + 0x24]
push edx
call fcn.004268a0
mov esi, eax
call fcn.004259b0
push 0x46418f
mov edi, eax
push str.processname
lea eax, [esp + 0x24]
push eax
call fcn.004268a0
mov ecx, eax
call fcn.004256a0
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40abb0
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.004056b0
push 0x46419a
push str.createtime
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x274], 7
call fcn.004268a0
mov esi, eax
call fcn.00425dc0
mov ebp, edx
lea edx, [esp + 0xac]
mov ecx, edi
mov esi, eax
call fcn.00409a90
test al, al
je 0x40ac5c
cmp edi, dword [esp + 0xc8]
jne 0x40ac5c
mov ecx, dword [esp + 0xb0]
mov edi, 0x10
cmp dword [esp + 0xc4], edi
jae 0x40ac24
lea ecx, [esp + 0xb0]
cmp dword [esp + 0x8c], edi
mov eax, dword [esp + 0x78]
jae 0x40ac35
lea eax, [esp + 0x78]
push ecx
push eax
call fcn.0045328b
add esp, 8
test eax, eax
jne 0x40ac61
cmp esi, dword [esp + 0xcc]
jne 0x40ac61
cmp ebp, dword [esp + 0xd0]
jne 0x40ac61
mov byte [esp + 0x17], 1
jmp 0x40ac61
mov edi, 0x10
cmp dword [esp + 0x8c], edi
jb 0x40ac77
mov edx, dword [esp + 0x78]
push edx
call fcn.0043bef7
add esp, 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 0x4641a1
push str.files
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x274], 9
call fcn.004268a0
cmp byte [eax + 8], 6
jne 0x40ae4b
push 0x4641a1
push str.files
lea ecx, [esp + 0x24]
push ecx
xor edi, edi
call fcn.004268a0
mov ecx, eax
call fcn.00426200
test eax, eax
jbe 0x40ae4b
push 0x4641a1
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.004268a0
push edi
push eax
call fcn.004266f0
push 0x4641a8
push str.file
push eax
call fcn.004268a0
cmp byte [eax + 8], 4
jne 0x40ae25
push 0x4641a1
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.004268a0
push edi
push eax
call fcn.004266f0
push 0x4641a8
push str.file
push eax
call fcn.004268a0
mov ecx, eax
call fcn.004256a0
mov esi, eax
mov ecx, esi
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea ebp, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40ad60
sub ecx, ebp
push ecx
push esi
lea ecx, [esp + 0x7c]
call fcn.004056b0
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x3c]
mov byte [esp + 0x26c], 0xa
call fcn.004058c0
push 0x4641a1
push str.files
lea edx, [esp + 0x24]
push edx
call fcn.004268a0
push edi
push eax
call fcn.004266f0
push 0x4641b2
push str.HANDLE
push eax
call fcn.004268a0
mov ecx, eax
call fcn.00426fd0
test al, al
je 0x40ae06
push 0x4641a1
push str.files
lea eax, [esp + 0x24]
push eax
call fcn.004268a0
push edi
push eax
call fcn.004266f0
push 0x4641b2
push str.HANDLE
push eax
call fcn.004268a0
mov esi, eax
call fcn.004259b0
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x4c]
mov dword [esp + 0x1c], eax
call fcn.0040bda0
mov byte [esp + 0x268], 9
cmp dword [esp + 0x8c], 0x10
jb 0x40ae25
mov edx, dword [esp + 0x78]
push edx
call fcn.0043bef7
add esp, 4
push 0x4641a1
push str.files
lea eax, [esp + 0x24]
push eax
add edi, 1
call fcn.004268a0
mov ecx, eax
call fcn.00426200
cmp edi, eax
jb 0x40acda
cmp byte [esp + 0x17], bl
je 0x40ae61
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x48]
call fcn.00409ca0
xor edi, edi
xor ebp, ebp
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x40aeb7
mov ecx, dword [esp + 0x40]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x40aeb7
cmp dword [esi + ebp + 0x18], 0x10
jb 0x40aea4
mov esi, dword [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40ae65
lea esi, [esi + ebp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 1
add ebp, 0x1c
jmp 0x40ae65
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x40aecc
push eax
call fcn.0043bef7
mov esi, dword [esp + 0x40]
add esp, 4
cmp esi, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov ebp, 0xf
je 0x40af20
mov edi, dword [esp + 0x40]
cmp esi, edi
je 0x40af17
add esi, 0x18
lea esp, [esp]
cmp dword [esi], 0x10
jb 0x40af01
mov eax, dword [esi - 0x14]
push eax
call fcn.0043bef7
add esp, 4
mov dword [esi], ebp
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea ecx, [esi - 0x18]
cmp ecx, edi
jne 0x40aef0
mov esi, dword [esp + 0x3c]
push esi
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
jb 0x40af46
mov edx, dword [esp + 0xb0]
push edx
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0x144], 0x10
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
jb 0x40af75
mov eax, dword [esp + 0x130]
push eax
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0x114], 0x10
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov byte [esp + 0x130], bl
jb 0x40afa4
mov ecx, dword [esp + 0x100]
push ecx
call fcn.0043bef7
add esp, 4
lea esi, [esp + 0xe8]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.0040bfa0
lea esi, [esp + 0xd4]
call fcn.00439bb0
mov byte [esp + 0x268], 1
mov ecx, dword [esp + 0x24]
movsx eax, cl
cmp eax, 4
je 0x40b004
add eax, 0xfffffffa
cmp eax, 1
ja 0x40b019
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov esi, ecx
je 0x40b019
call fcn.004272d0
push esi
call fcn.0043bef7
jmp 0x40b016
test ecx, 0x100
je 0x40b019
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043c93b
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40b03e
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x424f00
push ecx
push 4
push eax
call fcn.0043c090
push esi
call fcn.0043c771
add esp, 4
mov esi, 0x10
cmp dword [esp + 0x70], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jb 0x40b05e
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043bef7
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x40b083
mov eax, dword [esp + 0x94]
push eax
call fcn.0043bef7
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0043b82a
add esp, 0x258
ret