Function at 0x409691
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
call fcn.00401d5c
pop ecx
pop ecx
push dword [ebp + 8]
mov esi, eax
neg esi
lea eax, [ebp - 0x204]
sbb esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x204]
push 0x7e
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x409896
cmp dword [0x4186c0], 0
je 0x409896
lea eax, [ebp - 0x204]
push 0x5c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x409760
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call fcn.0040eab2
pop ecx
pop ecx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x204]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x40974c
push 0x414474
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0x204]
lea edi, [ebp - 0x204]
jle 0x409785
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x409794
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x4097b5
cmp byte [ebp - 0x203], 0x3a
jne 0x4097b5
movsx eax, byte [ebp - 0x204]
push eax
call fcn.0040e620
pop ecx
mov byte [ebp - 0x204], al
cmp byte [ebp - 0x204], 0x5c
jne 0x4097e6
cmp byte [ebp - 0x203], 0x5c
jne 0x4097ef
mov al, byte [ebp - 0x202]
lea edi, [ebp - 0x202]
jmp 0x4097dc
cmp al, 0x5c
je 0x4097e5
inc edi
mov al, byte [edi]
test al, al
jne 0x4097d5
cmp byte [edi], 0x5c
jne 0x4097e6
inc edi
cmp byte [edi], 0
je 0x409887
mov al, byte [edi]
cmp al, 0x5c
je 0x40988c
inc edi
mov al, byte [edi]
test al, al
jne 0x4097f1
jmp 0x409887
cmp byte [edi], 0
mov ebx, edi
je 0x409817
cmp byte [ebx], 0x5c
je 0x409817
inc ebx
cmp byte [ebx], 0
jne 0x40980c
push ebx
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x204]
push 0x17
push eax
mov byte [ebx], 0
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x40985f
lea eax, [ebp - 0x54c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x54c]
push eax
call fcn.00401d45
pop ecx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x204]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [edi], 0x5c
jne 0x40988d
inc edi
cmp byte [edi], 0
jne 0x409805
push dword [0x418b50]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4098b7
mov dword [0x418694], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
xor edi, edi
cmp dword [0x418b60], edi
mov dword [ebp - 4], eax
je 0x4098f0
cmp eax, edi
jne 0x4098f8
mov eax, dword [0x4186bc]
cmp eax, edi
je 0x409cf0
push edi
push dword [ebp + 8]
push 1
push 4
call eax
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x409cf0
cmp dword [0x418b2c], edi
je 0x409cf0
cmp esi, edi
je 0x409cf0
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x7e
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x409af7
cmp dword [0x4186c0], edi
je 0x409af7
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x4099b9
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push eax
call esi
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call fcn.0040eab2
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x104]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4099a7
push 0x414474
lea eax, [ebp - 0x104]
push eax
call ebx
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
call ebx
jmp 0x4099bf
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0x104]
lea esi, [ebp - 0x104]
jle 0x4099e4
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x4099f3
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
cmp eax, edi
je 0x409a14
cmp byte [ebp - 0x103], 0x3a
jne 0x409a14
movsx eax, byte [ebp - 0x104]
push eax
call fcn.0040e620
pop ecx
mov byte [ebp - 0x104], al
cmp byte [ebp - 0x104], 0x5c
jne 0x409a45
cmp byte [ebp - 0x103], 0x5c
jne 0x409a4a
mov al, byte [ebp - 0x102]
lea esi, [ebp - 0x102]
jmp 0x409a3b
cmp al, 0x5c
je 0x409a44
inc esi
mov al, byte [esi]
test al, al
jne 0x409a34
cmp byte [esi], 0x5c
jne 0x409a45
inc esi
cmp byte [esi], 0
je 0x409a57
mov al, byte [esi]
cmp al, 0x5c
je 0x409a5c
inc esi
mov al, byte [esi]
test al, al
jne 0x409a4c
cmp byte [esi], 0x5c
jne 0x409a5d
inc esi
cmp byte [esi], 0
je 0x409afd
cmp byte [esi], 0
mov edi, esi
je 0x409a78
cmp byte [edi], 0x5c
je 0x409a78
inc edi
cmp byte [edi], 0
jne 0x409a6d
push edi
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x104]
push 0x17
push eax
mov byte [edi], 0
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x409ac0
lea eax, [ebp - 0x54c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x54c]
push eax
call fcn.00401d45
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp + eax - 0x104]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
call ebx
cmp byte [esi], 0x5c
jne 0x409aea
inc esi
cmp byte [esi], 0
jne 0x409a66
xor edi, edi
jmp 0x409afd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x418b50]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x409cf0
xor esi, esi
lea eax, [ebp - 0x104]
push edi
inc esi
push eax
mov dword [0x418748], esi
call fcn.0040306b
mov eax, dword [0x4186c0]
cmp eax, 2
pop ecx
pop ecx
jne 0x409c0a
push pe_nt_image_headers32
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x304]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x409b78
push 0x414474
lea eax, [ebp - 0x304]
push eax
call ebx
push str.WININIT.INI
lea eax, [ebp - 0x304]
push eax
call ebx
push 1
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebx, dword [sym.imp.KERNEL32.dll__lwrite]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409bbe
push edi
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
push 0xa
mov esi, eax
push str._rename__r_n
push esi
call ebx
jmp 0x409bc8
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
cmp esi, 0xffffffff
je 0x409cf0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push str.NUL_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x304]
push eax
push esi
call ebx
jmp 0x409ce9
cmp eax, esi
jne 0x409c32
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call fcn.004029f3
pop ecx
push 4
push edi
push dword [ebp + 8]
call esi
jmp 0x409cf0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x304]
push str.del__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x104]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x409c88
push 0x414474
lea eax, [ebp - 0x104]
push eax
call ebx
push 0x4151b4
lea eax, [ebp - 0x104]
push eax
call ebx
push 1
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409cbe
push edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
jmp 0x409cc8
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
cmp esi, 0xffffffff
je 0x409cf0
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret