Function at 0x403f91
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x424702
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
push esi
push 0
push dword [ebp + 0x7c]
call fcn.0040d000
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x403ff7
push 1
push dword [ebp + 0x7c]
call fcn.0040d000
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x403ff7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x44], eax
cmp dword [ebp + 0x44], 2
je 0x403ff0
cmp dword [ebp + 0x44], 3
jne 0x403ff7
mov al, 1
jmp 0x4041fd
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40400b
mov al, 1
jmp 0x4041fd
lea ecx, [ebp + 0x48]
call fcn.00405b80
and dword [ebp - 4], 0
lea ecx, [ebp]
call fcn.00405b80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x140]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x404048
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405d34
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x2c], eax
cmp dword [ebp + 0x2c], 0
je 0x4040b6
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x34], eax
cmp dword [ebp + 0x5c], 0x10
jb 0x40406e
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x60], eax
jmp 0x404074
lea eax, [ebp + 0x48]
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x60]
add eax, dword [ebp + 0x34]
movsx eax, byte [eax - 1]
cmp eax, 0x5c
jne 0x4040b6
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x28]
dec eax
push eax
push 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp + 0x48]
call fcn.00405db0
mov dword [ebp + 0x3c], eax
push dword [ebp + 0x3c]
lea ecx, [ebp + 0x48]
call fcn.00405c2c
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00406627
cmp dword [ebp + 0x5c], 0x10
jb 0x4040ca
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x64], eax
jmp 0x4040d0
lea eax, [ebp + 0x48]
mov dword [ebp + 0x64], eax
push 1
push dword [ebp + 0x64]
call fcn.0040d000
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x4041b6
call fcn.00418330
mov esi, eax
call fcn.00418330
shl eax, 0xf
or esi, eax
push esi
push str.__tmp__08x
lea eax, [ebp - 0x24]
push eax
call fcn.0040cbc0
add esp, 0xc
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x30], eax
mov byte [ebp - 4], 2
push dword [0x42b5d4]
push 0
push dword [ebp + 0x30]
lea ecx, [ebp + 0x48]
call fcn.0040633f
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.00406627
cmp dword [ebp + 0x5c], 0x10
jb 0x40414e
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x6c], eax
jmp 0x404154
lea eax, [ebp + 0x48]
mov dword [ebp + 0x6c], eax
push 1
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x4041b6
cmp dword [ebp + 0x5c], 0x10
jb 0x40417a
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x68], eax
jmp 0x404180
lea eax, [ebp + 0x48]
mov dword [ebp + 0x68], eax
push 4
push 0
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov byte [ebp + 0x73], 1
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp]
call fcn.00406627
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x48]
call fcn.00406627
mov al, byte [ebp + 0x73]
jmp 0x4041fd
push 4
push 0
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x4041d0
mov dword [ebp + 0x40], 1
jmp 0x4041d4
and dword [ebp + 0x40], 0
mov al, byte [ebp + 0x40]
mov byte [ebp + 0x72], al
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp]
call fcn.00406627
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x48]
call fcn.00406627
mov al, byte [ebp + 0x72]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
add ebp, 0x74
leave
ret