Function at 0x419640
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0b66
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x6540b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0x14], 0
mov dword [ebp - 0x8a0], 1
xor ecx, ecx
mov word [ebp - 0x650], cx
push 0x206
push 0
lea edx, [ebp - 0x64e]
push edx
call fcn.00448340
add esp, 0xc
xor eax, eax
mov word [ebp - 0x38], ax
xor ecx, ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov dword [ebp - 0x22], ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov word [ebp - 0x12], cx
push 0x5a78d4
lea ecx, [ebp - 0x888]
call fcn.00402780
mov dword [ebp - 4], 0
push 0x5a78f0
lea ecx, [ebp - 0x870]
call fcn.00402780
mov byte [ebp - 4], 1
push 0x5a78f8
lea ecx, [ebp - 0x870]
call fcn.004042c0
push 0x5a7900
lea ecx, [ebp - 0x870]
call fcn.004042c0
push 0xd0
lea ecx, [ebp - 0x888]
call fcn.00402810
push eax
push str._s_d
lea edx, [ebp - 0x38]
push edx
call fcn.00409340
add esp, 0x10
lea ecx, [ebp - 0x870]
call fcn.00402810
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.0044f640
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x650]
push edx
call fcn.0045088b
add esp, 8
lea eax, [ebp - 0x650]
push eax
push 1
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0xc], 0
jne 0x419bb2
mov dword [ebp - 0x890], 0x5afc
mov dword [ebp - 0x8a0], 0
lea ecx, [ebp - 0x8f0]
call fcn.00443fba
mov byte [ebp - 4], 2
push 0x10000000
push str.Everyone
lea ecx, [ebp - 0x8f0]
call fcn.00444014
push 0x10000000
push str.ALL_APPLICATION_PACKAGES
lea ecx, [ebp - 0x8f0]
call fcn.00444014
lea eax, [ebp - 0x650]
push eax
mov ecx, dword [ebp - 0x890]
push ecx
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.0044442a
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x419ba3
xor ecx, ecx
mov word [ebp - 0x858], cx
push 0x206
push 0
lea edx, [ebp - 0x856]
push edx
call fcn.00448340
add esp, 0xc
xor eax, eax
mov word [ebp - 0x448], ax
push 0x206
push 0
lea ecx, [ebp - 0x446]
push ecx
call fcn.00448340
add esp, 0xc
xor edx, edx
mov word [ebp - 0x240], dx
push 0x206
push 0
lea eax, [ebp - 0x23e]
push eax
call fcn.00448340
add esp, 0xc
lea ecx, [ebp - 0x858]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x38]
push edx
push 0x5a795c
push 0x5a7970
lea eax, [ebp - 0x858]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x448]
push ecx
call fcn.00409340
add esp, 0x18
lea ecx, [ebp - 0x870]
call fcn.00402810
push eax
lea edx, [ebp - 0x240]
push edx
call fcn.0044f640
add esp, 8
push str.TEMP__
lea eax, [ebp - 0x240]
push eax
call fcn.0045088b
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.0045088b
add esp, 8
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0x14], 1
lea ecx, [ebp - 0x240]
push ecx
push 1
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x419ba3
lea ecx, [ebp - 0x240]
push ecx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x419ba3
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
lea ecx, [ebp - 0x448]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0xffffffff
jne 0x4199d3
mov dword [ebp - 0x8b0], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.00444003
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402740
mov eax, dword [ebp - 0x8b0]
jmp 0x419d28
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x890]
push eax
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.0044442a
push eax
mov ecx, dword [ebp - 0x898]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x88c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
jne 0x419b96
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x89c]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0x5a79bc
push 0x5a79d0
lea eax, [ebp - 0x858]
push eax
push str._s_s_s_s_d
lea ecx, [ebp - 0x448]
push ecx
call fcn.00409340
add esp, 0x1c
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
lea edx, [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0xffffffff
jne 0x419ac6
mov dword [ebp - 0x8b4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.00444003
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402740
mov eax, dword [ebp - 0x8b4]
jmp 0x419d28
mov eax, dword [ebp - 0x89c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x870]
call fcn.00402810
push eax
push 0x5a7a08
lea edx, [ebp - 0x240]
push edx
call fcn.00409340
add esp, 0x14
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x890]
push ecx
push 0
push 4
lea ecx, [ebp - 0x8f0]
call fcn.0044442a
push eax
mov edx, dword [ebp - 0x894]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0xc], 0
jne 0x419b76
mov dword [ebp - 0x8b8], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.00444003
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402740
mov eax, dword [ebp - 0x8b8]
jmp 0x419d28
push 5
push 0
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x894]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x419ba3
mov edx, dword [ebp - 0x898]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8f0]
call fcn.00444003
mov dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x88c]
cmp dword [eax + 0xc], 0
je 0x419c84
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x88c]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x88c]
cmp dword [edx + 0x10], 0
je 0x419c67
mov dword [ebp - 0x8a4], 1
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x28], edx
cmp dword [ebp - 0x8a0], 0
jne 0x419c2f
mov eax, dword [ebp - 0x88c]
mov ecx, dword [eax + 0x28]
call fcn.004175a0
mov dword [ebp - 0x8bc], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402740
mov eax, dword [ebp - 0x8bc]
jmp 0x419d28
mov ecx, dword [ebp - 0x88c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x88c]
mov dword [eax + 0xc], 0
cmp dword [ebp - 0x8a4], 0
jne 0x419cf7
push 0x5afc
call fcn.00435965
add esp, 4
mov dword [ebp - 0x8a8], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x8a8], 0
je 0x419cc0
mov ecx, dword [ebp - 0x8a8]
call fcn.0041e470
mov dword [ebp - 0x8ac], eax
jmp 0x419cca
mov dword [ebp - 0x8ac], 0
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x8c0], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x88c]
mov eax, dword [ebp - 0x8c0]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp - 0x88c]
mov ecx, dword [ecx + 0x28]
call fcn.004175a0
mov dword [ebp - 0x8c4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x870]
call fcn.00402740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.00402740
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00435ba5
mov esp, ebp
pop ebp
ret