Function at 0x41c770
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0e67
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4cc], ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00483520
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00483520
add esp, 0x18
mov dword [ebp - 0x424], 7
xor eax, eax
mov dword [ebp - 0x428], 0
lea ecx, [ebp - 0x438]
mov word [ebp - 0x438], ax
push eax
push 0x5e9978
call fcn.00402b90
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x5e9978
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 7
mov dword [ebp - 0x4b8], 0
mov word [ebp - 0x4c8], ax
call fcn.00402b90
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x5e9978
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x49c], 7
mov dword [ebp - 0x4a0], 0
mov word [ebp - 0x4b0], ax
call fcn.00402b90
mov byte [ebp - 4], 2
call fcn.00453765
test al, al
je 0x41c88e
invalid
push 0
push 0x17
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41cf38
push 7
xor eax, eax
mov dword [ebp - 0x484], 7
push 0x5ead78
lea ecx, [ebp - 0x498]
mov dword [ebp - 0x488], 0
mov word [ebp - 0x498], ax
call fcn.00402b90
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x498]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x5eba0c
push eax
call fcn.00407e80
lea eax, [ebp - 0x218]
push eax
call fcn.0045a078
add esp, 0x14
call fcn.00453a17
test al, al
je 0x41c938
pop esp
cmp byte ds:[edx + 0x1930b642], al
mov word [edi - 0x1e6e3eb4], gs
or byte [edi + 0x8df7da0], 0x62
and ebp, dword [edi - 0x18]
insd dword es:[edi], dx
outsb dx, byte [esi]
add eax, dword [eax]
call fcn.004537aa
test al, al
je 0x41c959
dec edi
lds ebp, [ecx + ebx*4 + 0x20]
sub al, 0x37
sub al, 0xc8
dec eax
fld dword [ebp + 0x3a]
mov dh, 0x66
sub byte [eax + 6], bh
cmp dl, byte [esi + 0x25]
stc
call fcn.00453834
test al, al
je 0x41c97a
lcall 0x3c16, 0x6b10a7ca
mov bl, 0x7c
mov edi, 0xee889e6d
insb byte es:[edi], dx
push ebx
sbb byte [ebp + 0x78], ah
xor ax, 0x19cb
dec eax
cmp word [ebp - 0x218], 0
jne 0x41c988
xor ecx, ecx
jmp 0x41c9a0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c991
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402b90
push 7
push 0x5ead78
lea ecx, [ebp - 0x438]
call fcn.00405d30
push 4
push 0x5eba1c
lea ecx, [ebp - 0x438]
call fcn.00405d30
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
mov eax, dword [0x67d4e4]
test eax, eax
jne 0x41ca2c
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x41ca21
mov ecx, eax
call fcn.00444f40
jmp 0x41ca23
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x67d4e4], eax
mov ecx, eax
call fcn.00474b54
push eax
lea ecx, [ebp - 0x480]
call fcn.00404170
xor eax, eax
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push eax
mov word [ebp - 0x450], ax
lea ecx, [ebp - 0x450]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x43c], 7
push eax
mov dword [ebp - 0x440], 0
call fcn.00402a70
push 0xc
push str.WnConfig.exe
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.00405d30
cmp dword [ebp - 0x46c], 8
lea edx, [ebp - 0x480]
mov edi, dword [ebp - 0x4cc]
lea ecx, [ebp - 0x450]
cmovae edx, dword [ebp - 0x480]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x43c], 8
push 0x5e9978
cmovae ecx, dword [ebp - 0x450]
cmp dword [ebp - 0x424], 8
push edx
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
push eax
mov ecx, edi
call fcn.0041c1a0
push 9
xor eax, eax
mov dword [ebp - 0x454], 7
push str.WnUpd.exe
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov word [ebp - 0x468], ax
call fcn.00402b90
mov byte [ebp - 4], 7
call fcn.004539d2
test al, al
je 0x41cb36
clc
mov cl, 0x73
pop esi
xchg dword [ebp + 0x5ef8454f], edx
scasd eax, dword es:[edi]
sbb byte [esi - 0x9251751], 0xd0
mov edi, dword [ebp - 0x4cc]
cmp dword [ebp - 0x458], 0
je 0x41cc5c
call fcn.00453c3f
test al, al
je 0x41cb62
xchg ecx, eax
lea edx, [ebx + 0xc]
fimul dword [ebp + 0x62]
rcr dword [ecx - 0x838d773], 0x27
idiv ah
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [ebp - 0x218], 0
jne 0x41cb70
xor ecx, ecx
jmp 0x41cb8f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cb80
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402b90
push 8
push 0x5eba28
lea ecx, [ebp - 0x438]
call fcn.00405d30
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
call fcn.004023e0
mov ecx, eax
call fcn.00474b54
mov edx, eax
cmp word [edx], 0
jne 0x41cbe3
xor ecx, ecx
jmp 0x41cbff
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cbf0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402b90
push 9
push str.WnUpd.exe
lea ecx, [ebp - 0x450]
call fcn.00405d30
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push 0x5e9978
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
push eax
mov ecx, edi
call fcn.0041c1a0
call fcn.00453b70
test al, al
je 0x41cc7d
adc bh, 0x96
dec eax
push ebp
lds ecx, [ebx]
in al, dx
pop ebx
mov byte [0xddd4b6c7], al
mov edx, 0x8b2540a6
sbb eax, sym.imp.KERNEL32.dll_DeleteFileW
cmp word [ebp - 0x218], 0
jne 0x41cc8b
xor ecx, ecx
jmp 0x41cca3
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cc94
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402b90
push 6
push 0x5eba3c
lea ecx, [ebp - 0x438]
call fcn.00405d30
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call ebx
mov eax, dword [0x67d4e4]
test eax, eax
jne 0x41cd17
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 8
test eax, eax
je 0x41cd0c
mov ecx, eax
call fcn.00444f40
jmp 0x41cd0e
xor eax, eax
mov byte [ebp - 4], 7
mov dword [0x67d4e4], eax
mov ecx, eax
call fcn.00474b54
mov edx, eax
cmp word [edx], 0
jne 0x41cd2a
xor ecx, ecx
jmp 0x41cd3f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cd30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x450]
call fcn.00402b90
call fcn.00453aa1
test al, al
je 0x41cd70
fidiv word [ebp - 0x27399b25]
xor al, 0x50
mov esi, 0x948357d
loop 0x41cd51
popal
je 0x41cd39
jae 0x41cd41
mov esp, 0x6d61cac8
pop es
invalid
call fcn.00453903
test al, al
je 0x41cd8e
mov dl, byte [edx + 0x56d8fde9]
mov edi, 0x6a3eede3
push esp
fsub qword [ebx + 0x35]
out 0x65, al
sbb al, 0xd5
xchg esp, eax
inc ebp
call fcn.00453a5c
test al, al
je 0x41cda9
cld
adc eax, dword [ebx]
popal
in eax, 0x8a
mov al, byte [0xe806933c]
xchg esi, eax
dec edi
int3
push 0xc
push 0x5eb8b4
lea ecx, [ebp - 0x450]
call fcn.00405d30
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
push 0x5e9978
cmovae ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push 0
cmovae eax, dword [ebp - 0x438]
push 0
push 1
push 0
push ecx
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.0041c1a0
call fcn.0045398d
test al, al
je 0x41ce1a
inc edi
mov esi, 0x14195c61
out 0xe6, al
pop ebp
jo 0x41ce7c
movsb byte es:[edi], byte [esi]
invalid
call fcn.004537aa
test al, al
je 0x41ce41
fmul qword [esi + ebx + 0x7e1426c2]
les ebp, [esp + esi*4 - 0x172f0679]
mov ah, 0x55
mov ebx, 0x396238ed
cmpsd dword [esi], dword es:[edi]
adc byte [edi], 0x10
lds esi, [ebp - 0x175eca03]
xor ebp, dword [edx + 3]
add byte [eax + eax*8 + 0x7a6a1f74], al
call fcn.00453879
test al, al
je 0x41ce69
push 0x7a
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
or eax, dword [eax + 0x11ba9919]
push ds
push ss
mov bl, 0xdf
or byte [edi + 0x55], 0x4d
imul ecx, ebx, 0xdd6d6598
or esi, dword [ecx]
pop edi
mov esi, 0x858b23fc
lodsb al, byte [esi]
sti
invalid
mov eax, dword [ebp - 0x454]
cmp eax, 8
jb 0x41ce87
inc eax
lea ecx, [ebp - 0x468]
push eax
push dword [ebp - 0x468]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x458], 0
cmp eax, 8
jb 0x41cec2
inc eax
lea ecx, [ebp - 0x450]
push eax
push dword [ebp - 0x450]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x440], 0
cmp eax, 8
jb 0x41cefd
inc eax
lea ecx, [ebp - 0x480]
push eax
push dword [ebp - 0x480]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x470], 0
cmp eax, 8
jb 0x41cf38
inc eax
lea ecx, [ebp - 0x498]
push eax
push dword [ebp - 0x498]
call fcn.00402ce0
mov eax, dword [ebp - 0x49c]
cmp eax, 8
jb 0x41cf56
inc eax
lea ecx, [ebp - 0x4b0]
push eax
push dword [ebp - 0x4b0]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4a0], 0
cmp eax, 8
jb 0x41cf91
inc eax
lea ecx, [ebp - 0x4c8]
push eax
push dword [ebp - 0x4c8]
call fcn.00402ce0
xor eax, eax
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x4b8], 0
cmp eax, 8
jb 0x41cfcc
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret