Function at 0x401040
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x53c
cmp dword [0x411530], 0
push ebx
push esi
push edi
push ebp
je 0x401076
mov eax, dword [esp + 0x554]
mov edi, dword [esp + 0x550]
push eax
push edi
call fcn.00401000
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x53c
ret
mov edi, dword [esp + 0x550]
push 0x4117ec
push edi
call fcn.0040d2f0
add esp, 8
test eax, eax
je 0x4010a7
lea eax, [esp + 0x114]
push 0x104
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
call esi
jmp 0x4010d1
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x114]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x448]
push 0x104
mov ecx, dword [esp + 0x558]
push eax
push ecx
call esi
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x10]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp byte [esp + ecx + 0xe], 0x5c
je 0x401140
mov edi, 0x411844
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x10]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x218]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.WININIT.INI
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x10]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TEMPINIT.INI
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x218]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
lea ecx, [esp + 0x10]
push 0x411824
push ecx
call fcn.004095f0
add esp, 8
mov edi, eax
test edi, edi
push 0x411820
jne 0x401253
lea eax, [esp + 0x14]
push eax
call fcn.004095f0
add esp, 8
mov esi, eax
test esi, esi
je 0x401389
push str._Rename__n
push esi
call fcn.00409510
lea eax, [esp + 0x450]
lea ecx, [esp + 0x11c]
add esp, 8
push eax
push ecx
push str._s_s_n
push esi
call fcn.00409510
add esp, 0x10
push esi
call fcn.004094a0
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x53c
ret
lea eax, [esp + 0x21c]
push eax
call fcn.004095f0
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x40127d
push edi
call fcn.004094a0
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x53c
ret
xor ebp, ebp
lea eax, [esp + 0x31c]
push edi
push 0x12c
push eax
call fcn.00409550
add esp, 0xc
test eax, eax
je 0x40132d
test ebp, ebp
je 0x4012b9
lea eax, [esp + 0x31c]
push eax
push 0x411808
push ebx
call fcn.00409510
add esp, 0xc
jmp 0x40127f
lea eax, [esp + 0x31c]
push 8
push str._Rename_
push eax
call fcn.0040d380
add esp, 0xc
test eax, eax
jne 0x401312
mov ebp, 1
lea eax, [esp + 0x31c]
push eax
push 0x411808
push ebx
call fcn.00409510
lea eax, [esp + 0x454]
lea ecx, [esp + 0x120]
add esp, 0xc
push eax
push ecx
push str._s_s_n
push ebx
call fcn.00409510
add esp, 0x10
jmp 0x40127f
lea eax, [esp + 0x31c]
push eax
push 0x411808
push ebx
call fcn.00409510
add esp, 0xc
jmp 0x40127f
test ebp, ebp
jne 0x40135d
push str._n_Rename__n
push ebx
call fcn.00409510
lea eax, [esp + 0x450]
lea ecx, [esp + 0x11c]
add esp, 8
push eax
push ecx
push str._s_s_n
push ebx
call fcn.00409510
add esp, 0x10
push edi
call fcn.004094a0
add esp, 4
push ebx
call fcn.004094a0
lea eax, [esp + 0x14]
add esp, 4
push eax
call esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x53c
ret