Function at 0x40dcf2
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c38
call fcn.004385c0
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov esi, 0x104
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.00438df7
xor eax, eax
mov ebx, 0x7fe
push ebx
mov word [ebp - 0x1c24], ax
xor edi, edi
lea eax, [ebp - 0x1c22]
push edi
push eax
call fcn.00437ff0
xor eax, eax
push ebx
mov word [ebp - 0x1024], ax
lea eax, [ebp - 0x1022]
push edi
push eax
call fcn.00437ff0
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push edi
push eax
call fcn.00437ff0
lea eax, [esi - 4]
push eax
lea ecx, [ebp - 0x1224]
push ecx
push eax
lea ecx, [ebp - 0x1424]
push ecx
push eax
lea eax, [ebp - 0x824]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00438e66
add esp, 0x54
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00439086
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00439086
push 0x3fe
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1c24]
push 0x400
push eax
call fcn.00439103
add esp, 0x28
lea eax, [ebp - 0x1024]
push eax
push edi
push 0x451b94
lea eax, [ebp - 0x1c24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40de0c
xor eax, eax
jmp 0x40dfac
lea eax, [ebp - 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40de05
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push 0x80000082
push 2
push edi
push 3
mov esi, 0x40000000
push esi
lea eax, [ebp - 0x41c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40de05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40de05
push edi
push 0x80000082
push 2
push edi
push 3
push esi
lea eax, [ebp - 0x1024]
push eax
call ebx
mov ebx, eax
mov dword [ebp - 0x1c30], ebx
cmp ebx, 0xffffffff
je 0x40de05
cmp dword [ebp + 0x10], edi
jne 0x40de91
cmp dword [ebp + 0xc], edi
je 0x40df6a
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xffffffff
jne 0x40dea2
cmp dword [ebp + 0xc], edi
je 0x40dea2
dec dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push ebx
call esi
push 1
push ebx
call fcn.0040db55
pop ecx
pop ecx
test eax, eax
jne 0x40decd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40de05
push edi
push edi
push edi
push ebx
call esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c2c], edi
mov dword [ebp - 0x1c28], edi
cmp esi, edi
jb 0x40df6a
ja 0x40def1
cmp dword [ebp + 0x10], edi
jbe 0x40df6a
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x1c2c]
mov eax, esi
sbb eax, dword [ebp - 0x1c28]
cmp eax, edi
ja 0x40df1a
jb 0x40df10
cmp ecx, 0x10000
jae 0x40df1a
mov ebx, ecx
mov dword [ebp - 0x1c34], eax
jmp 0x40df25
mov ebx, 0x10000
mov dword [ebp - 0x1c34], edi
push ebx
push dword [ebp - 0x1c30]
call fcn.0040db55
pop ecx
pop ecx
test eax, eax
je 0x40dfbb
add dword [ebp - 0x1c2c], ebx
mov eax, dword [ebp - 0x1c28]
adc eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c28], eax
cmp eax, esi
jb 0x40def1
ja 0x40df64
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x1c2c], eax
jb 0x40def1
mov ebx, dword [ebp - 0x1c30]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1024]
push eax
lea ebx, [ebp - 0x624]
call fcn.0040f9c4
pop ecx
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40dfa9
lea eax, [ebp - 0x1024]
push eax
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40de05
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437ed4
leave
ret
push dword [ebp - 0x1c30]
jmp 0x40dec2