Function at 0x417ca0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x424
mov eax, dword [0x4630e0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
or eax, 0xffffffff
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x224]
push eax
push 0x104
mov dword [esp + 0x14], 0
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x120]
push ecx
push 0
push 0x453c40
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x124]
push ecx
call fcn.00415130
add esp, 8
test eax, eax
je 0x417d36
push 0xab
call fcn.0040ab70
mov ebx, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0xc], 1
jmp 0x41805c
mov esi, 1
cmp dword [esp + 0x14], esi
jge 0x417d5b
push 0xac
call fcn.0040ab70
mov ebx, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0xc], esi
jmp 0x41805c
push 0x4000
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x417d8f
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0043b76b
add esp, 0x424
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x417da0
cmp dword [0x46507c], 0
mov eax, 0x453c30
jne 0x417db3
mov eax, 0x453c20
push 0
push eax
mov eax, dword [0x4652d8]
push 0x460010
push 0
lea edx, [esp + 0x30]
push edx
push str.Repackaged_EXE_File_Name
push esi
push eax
call fcn.00407130
add esp, 0x20
test eax, eax
jne 0x417ed4
lea ecx, [esp + 0x20]
push 0x2e
push ecx
call fcn.0043afd0
add esp, 8
test eax, eax
je 0x417e15
cmp dword [0x46507c], 0
mov ecx, 0x453c00
jne 0x417e04
mov ecx, 0x453bfc
push ecx
add eax, 1
push eax
call fcn.0044fb2e
add esp, 8
test eax, eax
je 0x417e61
cmp dword [0x46507c], 0
mov eax, 0x453bf4
jne 0x417e28
mov eax, 0x453bec
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417e30
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x417e42
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
push 0x104
lea edx, [esp + 0x330]
push edx
push 0
call ebp
test eax, eax
je 0x417ea1
lea eax, [esp + 0x32c]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.0044fb2e
add esp, 8
test eax, eax
jne 0x417ea1
push 0xad
call fcn.0040ab70
add esp, 4
jmp 0x417da0
lea edx, [esp + 0x20]
push edx
call fcn.0040a420
add esp, 4
test eax, eax
je 0x417edd
push 3
push str.This_file_already_exists._OK_to_overwrite_it_
call fcn.00406270
add esp, 8
cmp eax, 7
je 0x417da0
cmp eax, 6
je 0x417edd
mov byte [esp + 0x20], 0
mov dword [esp + 0x10], esi
jmp 0x41805b
lea eax, [esp + 0x20]
push 0x1000
push eax
call fcn.0040a330
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
jge 0x417f04
mov dword [esp + 0x10], 2
jmp 0x41805b
mov edi, dword [0x465074]
test edi, edi
mov ebp, 2
jg 0x417f27
mov ecx, dword [0x460004]
push ebp
push 0
push ecx
call fcn.0040a3a0
add esp, 0xc
mov edi, eax
mov edx, dword [0x460004]
push 0
push 0
push edx
call fcn.0040a3a0
add esp, 0xc
test eax, eax
je 0x417f47
mov dword [esp + 0x10], ebp
jmp 0x41805b
test edi, edi
je 0x417f8a
jmp 0x417f50
cmp edi, 0x4000
mov esi, edi
jl 0x417f5f
mov esi, 0x4000
mov eax, dword [0x460004]
push esi
push ebx
push eax
call fcn.0040a3c0
add esp, 0xc
cmp eax, esi
jne 0x417fa6
mov ecx, dword [esp + 0x14]
push esi
push ebx
push ecx
call fcn.0040a3f0
add esp, 0xc
cmp eax, esi
jne 0x417fa6
sub edi, esi
jne 0x417f50
lea edx, [esp + 0x124]
push 0
push edx
call fcn.0040a330
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x1c], edi
jge 0x417faf
mov dword [esp + 0x10], ebp
jmp 0x41805b
push 0x4000
push ebx
push edi
call fcn.0040a3c0
mov esi, eax
add esp, 0xc
cmp esi, 1
jl 0x417ff6
mov eax, dword [esp + 0x14]
push esi
push ebx
push eax
call fcn.0040a3f0
add esp, 0xc
cmp eax, esi
jne 0x417fa6
cmp esi, 0x4000
jl 0x417ff6
push 0x4000
push ebx
push edi
call fcn.0040a3c0
mov esi, eax
add esp, 0xc
cmp esi, 1
jge 0x417fc5
push edi
call fcn.0040a380
or esi, 0xffffffff
xor edi, edi
add esp, 4
xor eax, eax
cmp dword [0x464ad8], edi
mov dword [esp + 0x1c], esi
jle 0x41803e
xor ecx, ecx
jmp 0x418020
mov edx, dword [0x464c00]
mov dword [ecx + edx + 0x918], edi
add eax, 1
add ecx, 0x1008
cmp eax, dword [0x464ad8]
jl 0x418020
mov eax, dword [esp + 0x14]
push eax
call fcn.0040a380
add esp, 4
cmp eax, edi
mov dword [esp + 0x14], esi
je 0x41805b
mov dword [esp + 0x10], 1
pop ebp
test ebx, ebx
je 0x41807a
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jle 0x41808c
push eax
call fcn.0040a380
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
jle 0x41809e
push eax
call fcn.0040a380
add esp, 4
cmp byte [esp + 0x120], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
je 0x4180b8
lea ecx, [esp + 0x120]
push ecx
call esi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4180d9
lea edx, [esp + 0x1c]
push edx
call esi
cmp edi, 2
jne 0x4180d9
push 0xae
call fcn.0040ab70
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043b76b
add esp, 0x424
ret