Function at 0x402900
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4bc088
mov eax, dword fs:[0]
push eax
sub esp, 0x6c4
mov eax, dword [0x4fcc8c]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fcc8c]
xor eax, esp
push eax
lea eax, [esp + 0x6d8]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
mov esi, ecx
call fcn.004076e0
push 1
lea ecx, [esp + 0x20]
push ecx
xor ebx, ebx
push esi
mov dword [esp + 0x6ec], ebx
call fcn.00412110
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x40298d
cmp esi, ebx
je 0x402f4b
mov eax, esi
jmp 0x402f31
lea ecx, [esp + 0x40]
push ecx
call fcn.004076e0
mov byte [esp + 0x6e0], 1
xor edx, edx
push 5
mov eax, str.alzip
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], dx
call fcn.004012c0
mov eax, esi
push eax
lea ebx, [esp + 0x44]
mov byte [esp + 0x6e4], 2
call fcn.004079c0
mov edi, 8
mov byte [esp + 0x6e0], 1
cmp dword [esp + 0x80], edi
jb 0x4029ff
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004913b3
add esp, 4
xor edx, edx
push 5
mov eax, str.alsee
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], 0
mov word [esp + 0x70], dx
call fcn.004012c0
mov eax, esi
push eax
lea ebx, [esp + 0x44]
mov byte [esp + 0x6e4], 3
call fcn.004079c0
mov byte [esp + 0x6e0], 1
cmp dword [esp + 0x80], edi
jb 0x402a5e
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004913b3
add esp, 4
xor edx, edx
push 5
mov eax, str.alftp
lea esi, [esp + 0x6c]
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], 0
mov word [esp + 0x70], dx
call fcn.004012c0
mov eax, esi
push eax
lea ebx, [esp + 0x44]
mov byte [esp + 0x6e4], 4
call fcn.004079c0
mov byte [esp + 0x6e0], 1
cmp dword [esp + 0x80], edi
jb 0x402abd
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004913b3
add esp, 4
xor ebx, ebx
push str.11.6.20.1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.0042fd20
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 4
mov dword [esp + 0x34], ebx
test eax, eax
jle 0x402eec
jmp 0x402b07
xor ebx, ebx
mov ecx, dword [esp + 0x34]
push ecx
lea eax, [esp + 0x44]
call fcn.00407920
push 0xffffffffffffffff
xor edx, edx
mov edi, 7
push ebx
lea ecx, [esp + 0xa8]
mov dword [esp + 0xc0], edi
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], dx
call fcn.00401370
mov byte [esp + 0x6e0], 5
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], eax
cmp ecx, eax
jbe 0x402b66
call fcn.004921da
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x60], edx
mov ebx, eax
cmp ecx, eax
jbe 0x402b81
call fcn.004921da
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov esi, ecx
cmp ecx, eax
jbe 0x402b8c
call fcn.004921da
mov ebp, dword [esp + 0x1c]
cmp esi, ebx
je 0x402bda
jmp 0x402ba0
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x402bb8
lea eax, [esp + 0xa4]
mov edi, dword [esp + 0xb4]
push eax
mov eax, dword [esi + 0x14]
mov ecx, esi
call fcn.00408420
test eax, eax
je 0x402bd5
add esi, 0x1c
cmp esi, ebx
jne 0x402ba0
mov edi, 7
xor ebx, ebx
cmp ebp, ebx
je 0x402be6
cmp ebp, dword [esp + 0x60]
je 0x402beb
call fcn.004921da
cmp esi, dword [esp + 0x18]
je 0x402e94
xor eax, eax
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], ax
lea ecx, [esp + 0x68]
push 0x23
push ecx
mov byte [esp + 0x6e8], 6
call fcn.0042e1e0
add esp, 8
push 9
mov eax, str.ESTSoft_
lea ecx, [esp + 0x6c]
call fcn.004017a0
push ebx
lea edx, [esp + 0xa4]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x70]
call fcn.00401880
push 0xf
mov eax, str.AuthSerial.dll
mov ecx, esi
call fcn.004017a0
mov edx, esi
lea esi, [esp + 0x58]
call fcn.00430570
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
cmp eax, ebx
jne 0x402c70
cmp ecx, ebx
je 0x402e77
mov edx, dword [esp + 0x38]
cmp eax, edx
jne 0x402c81
cmp ecx, dword [esp + 0x3c]
setbe al
jmp 0x402c84
setb al
test al, al
je 0x402e77
xor eax, eax
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], ax
mov byte [esp + 0x6e0], 7
lea ecx, [esp + 0x84]
cmp dword [0x5046b4], ebx
je 0x402cc2
call fcn.0042e2f0
jmp 0x402ccd
push 0x1a
push ecx
call fcn.0042e1e0
add esp, 8
push 9
mov eax, str.ESTSoft_
lea ecx, [esp + 0x88]
call fcn.004017a0
push ebx
lea edx, [esp + 0xa4]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x8c]
call fcn.00401880
push 0xf
mov eax, str.AuthSerial.dll
mov ecx, esi
call fcn.004017a0
mov eax, dword [esp + 0x88]
mov edi, 8
cmp dword [esp + 0x9c], edi
jae 0x402d22
lea eax, [esp + 0x88]
push ebx
push eax
call fcn.00491dcd
add esp, 8
test eax, eax
jne 0x402e5c
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], edi
jae 0x402d4b
lea eax, [esp + 0x88]
push eax
push str.Delete_File________s
lea esi, [esp + 0x20]
mov dword [esp + 0x20], str.ALCMUpdator::CheckDeleteAuthSerial
call fcn.004019a0
mov eax, dword [esp + 0x90]
add esp, 8
cmp dword [esp + 0x9c], edi
jae 0x402d7c
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402e5c
push 0x206
lea ecx, [esp + 0xc2]
push ebx
push ecx
mov word [esp + 0xc8], ax
call fcn.004982b0
add esp, 0xc
lea edx, [esp + 0xbc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40e
lea ecx, [esp + 0x2ca]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x2d0], ax
call fcn.004982b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0xc0]
push edx
push str._s_u_AuthSerial.dll
lea eax, [esp + 0x2d0]
push 0x208
push eax
call fcn.00491e56
mov eax, dword [esp + 0x9c]
add esp, 0x14
cmp dword [esp + 0x9c], edi
jae 0x402e1c
lea eax, [esp + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
lea ecx, [esp + 0x2c8]
push ecx
push eax
call esi
test eax, eax
jne 0x402e4f
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], edi
jae 0x402e49
lea eax, [esp + 0x88]
push 4
push ebx
push eax
jmp 0x402e5a
push 4
push ebx
lea edx, [esp + 0x2cc]
push edx
call esi
cmp dword [esp + 0x9c], edi
jb 0x402e7c
mov eax, dword [esp + 0x88]
push eax
call fcn.004913b3
add esp, 4
jmp 0x402e7c
mov edi, 8
cmp dword [esp + 0x80], edi
jb 0x402e99
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004913b3
add esp, 4
jmp 0x402e99
mov edi, 8
mov byte [esp + 0x6e0], 1
cmp dword [esp + 0xb8], edi
jb 0x402eba
mov edx, dword [esp + 0xa4]
push edx
call fcn.004913b3
add esp, 4
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x34]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
mov dword [esp + 0x34], ebx
jl 0x402b05
xor ebx, ebx
cmp esi, ebx
je 0x402f0c
mov ecx, dword [esp + 0x18]
push ecx
mov eax, esi
call fcn.0040d1a0
mov edx, dword [esp + 0x50]
add esp, 4
push edx
call fcn.004913b3
add esp, 4
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.004913b3
mov eax, dword [esp + 0x2c]
add esp, 4
cmp eax, ebx
je 0x402f4b
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040d1a0
mov edx, dword [esp + 0x2c]
add esp, 4
push edx
call fcn.004913b3
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.004913b3
add esp, 4
mov ecx, dword [esp + 0x6d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.004913be
add esp, 0x6d0
ret