Function at 0x402a40
Capabilities:
Delete file
Get common file path
Get file size
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x8a8]
sub esp, 0x928
mov eax, dword [0x40fc70]
push 4
push 0
push dword [ebp + 0x8b0]
mov dword [ebp + 0x8a4], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x402c68
push dword [ebp + 0x8b0]
lea eax, [ebp + 0x390]
push 0x40c588
push str._hs_hs_r_n
push 0x400
push eax
call fcn.0040aa91
add esp, 0x14
test eax, eax
jge 0x402aa3
push 0x733
jmp 0x402bdd
push ebx
push esi
lea eax, [ebp + 0x390]
push edi
push eax
call fcn.00406ea0
mov esi, str._Rename__r_n
lea edi, [ebp + 0x898]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebx, eax
movsb byte es:[edi], byte [esi]
lea eax, [ebp + 0x790]
mov dword [esp], 0x104
xor esi, esi
push eax
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x105
lea eax, [ebp + 0x790]
push edi
push eax
call fcn.00401f30
pop ecx
pop ecx
push str.WinInit.Ini
push edi
lea eax, [ebp + 0x790]
push eax
call fcn.0040aae9
test eax, eax
jge 0x402b11
push 0x73e
jmp 0x402bdd
push esi
push 0x8000080
push 4
push esi
push esi
push 0xc0000000
lea eax, [ebp + 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x402c65
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push esi
push 4
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 0x80], eax
je 0x402c47
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x402c3e
lea ecx, [ebp + 0x898]
push ecx
push eax
call fcn.00407340
cmp eax, esi
pop ecx
pop ecx
jne 0x402bec
lea eax, [ebp + 0x898]
push eax
push 0x40c560
lea eax, [ebp - 0x70]
push 0x400
push eax
call fcn.0040aa91
add esp, 0x10
test eax, eax
jge 0x402bb3
push 0x75c
jmp 0x402bdd
lea eax, [ebp - 0x70]
push eax
call fcn.00406ea0
add edi, eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebx + 0xa]
push eax
mov eax, dword [ebp - 0x74]
add eax, edi
push eax
call fcn.0040aa91
add esp, 0x10
test eax, eax
jge 0x402be7
push 0x75f
push str.sfxhead.c
call fcn.00401dfc
mov dword [ebp - 0x7c], edi
jmp 0x402c1a
push 0xa
push eax
call fcn.00407280
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x402c18
mov eax, dword [ebp - 0x74]
inc esi
sub eax, esi
add eax, edi
push eax
lea eax, [esi + ebx]
push esi
push eax
call fcn.00406f30
add esp, 0xc
sub esi, dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
xor esi, esi
mov ecx, dword [ebp - 0x7c]
push ebx
lea eax, [ebp + 0x390]
push eax
mov eax, dword [ebp - 0x74]
add eax, ecx
push eax
call fcn.00401148
add esp, 0xc
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8a4]
call fcn.00406c7b
add ebp, 0x8a8
leave
ret