Function at 0x411c46
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x59c79f
call fcn.005693c7
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x2ac], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41231d
call fcn.0042af76
test al, al
je 0x411c91
and dword [eax], ecx
jecxz 0x411cc9
invalid
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x411cd2
call fcn.0042ab6b
test al, al
je 0x41231d
fadd qword [ecx + 0x41d1e0bb]
sbb eax, 0x82f07ffd
popal
push es
das
cmpsb byte gs:[esi], byte es:[edi]
fstp qword [esi]
or ah, byte [ebx - 0x79]
lodsd eax, dword [esi]
adc eax, 0xd48f00cb
mov byte [0xe98a9b10], al
wait
mov ch, cl
dec ebx
push es
add byte [eax], al
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], ebx
pop es
add byte [eax], al
add byte [ebx], dh
ror byte [ecx - 0x23763], 0xff
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push ebx
push 0x5a06d8
call fcn.00403772
mov dword [ebp - 4], ebx
call fcn.0042ae62
test al, al
je 0x411d30
cmc
call 0x799e76c1
out 0x8f, eax
loop 0x411ccb
test eax, 0x507dbdcf
pushfd
dec ebp
call fcn.0042ab6b
test al, al
je 0x411d58
test byte [edx - 0x58], dh
mov dl, 0x66
sbb esi, dword [edx]
cmpsb byte [esi], byte es:[edi]
aaa
mov eax, 0x3e5ca061
mov word [esi + edx*4 - 0x37b167be], ds
cmp dword [edi - 0x75], esp
clc
mov al, 0xe8
iretd
call fcn.0042a988
test al, al
je 0x411d77
ror bh, 1
out dx, al
stosd dword es:[edi], eax
push ebx
scasd eax, dword es:[edi]
les ebx, [ebx + edi*8]
jno 0x411cef
mul dword [edi + esi*4 + 0x1f]
adc ah, al
xchg edx, eax
mov eax, dword [0x858d2938]
call 0x51411d7b
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a8]
push eax
call fcn.00413744
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.0042af76
test al, al
je 0x411dbd
xchg esp, eax
dec esp
xchg edx, eax
xor edi, esp
aam 0x79
insd dword es:[edi], dx
or cl, byte [edi - 0x75db0bdb]
call 0xfc606c2c
call fcn.0042aeec
test al, al
je 0x411de1
adc byte [edx + 0x34130e0a], dh
cmp al, 0xd5
aad 0xb8
sub esp, dword [ebx + 0x2c]
dec ecx
enter 0x39ab, 0x65
in eax, dx
cmp dword [ebp - 0x13], esp
sbb al, 0xed
rol cl, 1
sub al, 0x35
or eax, edx
call fcn.0042aea7
test al, al
je 0x411e03
cli
call 0x674a9870
mov al, byte [0x8cd2b970]
pop eax
call 0x9583ddd2
out dx, eax
cmpsb byte [esi], byte es:[edi]
sub dword [ecx + 0x7441cd06], esi
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x278]
push eax
call fcn.00413b17
pop ecx
pop ecx
mov byte [ebp - 4], 2
call fcn.0042a943
test al, al
je 0x411e38
cdq
aam 0xb
cmp dword [eax], eax
shl byte [ecx + 0x455f1bbd], cl
jne 0x411dd6
mov byte [0x5cc494d1], al
adc eax, 0xfde8858d
invalid
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00413b17
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
push eax
call fcn.0041937c
add esp, 0xc
call fcn.0042abb0
test al, al
je 0x411e77
inc esi
inc ebp
cld
add edx, dword [eax - 0x18]
and dword [ebp], esi
add byte [ebx + 0x4de80cc4], al
lea eax, [ecx]
add byte [eax + eax*8 + 0xdbe1074], al
aam 0xbb
scasb al, byte es:[edi]
mov esi, 0xaebbd40d
cmpxchg cl, dh
mov ecx, dword [ecx + 0x7b9a20c5]
lcall 1, 0x90b5e8c3
call fcn.0042af31
test al, al
je 0x411ea0
pushfd
dec ecx
mov ecx, 0x501d6c77
push ds
sar byte [ebx + 0xa], cl
jp 0x411e50
fcmovb st(0), st(1)
mov ebp, 0x17782a83
xchg edx, eax
and dword [0x52e74c1b], eax
test al, 0x18
into
sub dword [eax + ebp*8 + 0x18a9e], esi
call fcn.0042a943
test al, al
je 0x411ec7
inc esi
loopne 0x411e8d
retf 0xb19e
lea eax, [ebp - 0x260]
push eax
call fcn.0041937c
pop ecx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040383c
test eax, eax
jne 0x411f34
lea esp, [eax - 0x17000003]
push esi
sbb edi, edi
inc dword [ebp - 0x17b58a40]
pop dword cs:[ecx]
add byte [eax + eax*8 + 0x5a031174], al
jmp 0x753befbb
call fcn.0042ae1d
test al, al
je 0x411f04
add ebx, dword [edx - 0x17]
rcl eax, 0xfa
je 0x411f19
mov dl, 0xf9
invalid
adc al, 0x79
cmp word [ebp - 0x218], 0
jne 0x411f12
xor eax, eax
jmp 0x411f1f
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403772
jmp 0x411fb2
test eax, ebp
std
invalid
call fcn.0042ad93
test al, al
je 0x411f5a
mov byte [0x17d888c8], ch
push esp
loopne 0x411edc
in eax, dx
pop ebp
bound eax, qword [ecx + ebx*4 + 0x33]
test byte [edx - 0x19], 0x41
jecxz 0x411f88
sub bh, bl
jg 0x411f02
sbb bl, byte [edx + ebx*2 - 0x73f317a1]
add dword [eax], eax
call fcn.0042ab6b
test al, al
je 0x411f83
jecxz 0x411f21
pushfd
fsub st(0), st(0)
aaa
dec esi
aam 0x6d
push 0xa3a3ec28
mov dword [0x593d7567], eax
in eax, dx
xor ch, byte [eax + 0x29c4e1d1]
enter 0xffffffffffffa96e, 0xffffffffffffffe4
adc bh, dh
push dword [ebp - 0x2ac]
dec dword [ebp - 0x28f7b]
call dword [eax - 0x18]
dec edx
sbb al, byte [eax]
add byte [ecx + 0x59], bl
lea eax, [ebp - 0x290]
push eax
call int.004139df
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x290]
call fcn.00403628
and dword [ebp - 0x2b0], 0
call fcn.0042aeec
test al, al
je 0x411fd8
jns 0x411f89
inc edx
mov ebp, 0xe0b88c37
mov dword cs:[edi + ebp + 0x4c], edi
xchg edi, eax
je 0x412031
xor eax, 0x269d3cb5
dec ecx
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x21c], 7
push eax
push 0x5a06d8
mov word [ebp - 0x230], ax
call fcn.00403772
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x230]
call fcn.004036b6
call fcn.0042ae62
test al, al
je 0x412045
xchg edi, eax
loop 0x412069
add byte [edx + 0x47], 5
push esp
cdq
jb 0x412051
pop ds
push edi
hlt
call fcn.0042a8fe
test al, al
je 0x412067
sbb edx, dword [esi - 0x6c1e4eae]
mov cl, 0xe1
xchg ebx, eax
jge 0x412093
rol dword [ecx], 0x20
ficomp dword [ecx - 0x6d]
lds esp, [eax - 0x64941f92]
test dword [ebp - 0x17b1ce39], ecx
inc esp
call fcn.0042abb0
test al, al
je 0x41208c
mov eax, dword [ecx]
add byte [eax + eax*8 + 0x4ef41c74], al
sbb al, 0x74
add eax, 0x17f0fe5
dec edi
dec eax
sub dh, byte [ebx - 0x165e4e03]
or ebx, dword [ecx + 0x3eb95f1e]
rol dword [ebx], 0xf7
dec edi
xchg ecx, eax
hlt
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x2a8]
push ebx
push eax
lea ecx, [ebp - 0x230]
call fcn.00408b95
mov esi, str..fcb
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00408c34
mov eax, dword [ebp - 0x2b0]
test eax, eax
jle 0x4120fd
std
invalid
cdq
push edx
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00412b1a
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.00408b95
push ebx
push 1
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 4
call fcn.00403628
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4121e0
call fcn.0042ab6b
test al, al
je 0x412144
lahf
inc ebp
cmp al, 0x8f
and bh, byte [esi]
mov dl, 0xd8
push ds
inc edi
movsb byte es:[edi], byte [esi]
in al, 0xa2
int1
or byte [0x89bed3f], dh
mov cl, 0x7f
xchg ebx, eax
aam 0x4b
and eax, 0x88c9e8e0
add dword [eax], eax
call fcn.0042aa12
test al, al
je 0x41216b
scasd eax, dword es:[edi]
jg 0x4120fd
xchg byte [ecx + 0x14], ch
and edi, dword [edi + 0xf86d3a0]
lodsb al, byte [esi]
pushfd
adc eax, 0x8ba4ee85
loope 0x412186
pop ebp
mov ch, 0xc3
cwde
mov eax, dword [0xa3e87fd5]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4121e0
call fcn.0042aa12
test al, al
je 0x4121b2
pop eax
mul byte [esi]
hlt
mov ebx, dword [ebp - 0x2b0]
cmp ebx, 0xa
jge 0x4122d7
add byte [edx], ch
push 0
inc ebx
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x2b0], ebx
call fcn.00403628
jmp 0x411fd8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push dword [ebp - 0x2ac]
call fcn.0057c21a
pop ecx
pop ecx
call fcn.0042acc4
test al, al
je 0x412222
xchg esi, eax
jp 0x4121c0
mov ss, word [edi + 0x3f5c9c65]
sbb edi, dword [edx]
ret
call fcn.0042aa57
test al, al
je 0x412243
dec ecx
pop es
int3
call fcn.0042aae1
test al, al
je 0x412264
rol edx, 1
mov byte [ebx], al
sbb dword [ebx - 0x37], esi
inc esp
jp 0x412264
arpl word [edi + 0x73], si
xchg edi, eax
dec ebx
sbb dword [esi], 0xffffff9e
add dword [esi - 0x4ae427b4], eax
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
je 0x4122a4
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, dword [ebp - 0x2ac]
push ebx
call esi
test eax, eax
je 0x4122d7
call fcn.0042ac7f
test al, al
je 0x4122cc
adc byte [eax], 0x92
xchg edx, eax
cmp edi, dword [ecx]
inc esp
mov al, 0x72
or al, 0x90
sbb eax, 0x246d91a8
sub bh, byte [esi + 0x6a]
add eax, 0xff53006a
adc eax, sym.imp.KERNEL32.dll_MoveFileExW
push 5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ebx, ebx
lea ecx, [ebp - 0x230]
xor esi, esi
push ebx
inc esi
push esi
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x260]
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x278]
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x2a8]
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.00403628
call fcn.00569382
ret