Function at 0x40bd15
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov eax, 0x4233c0
call fcn.0040fb60
sub esp, 0x880
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x432378], edi
mov ebx, ecx
mov dword [ebp - 0x10], ebx
je 0x40c290
push 1
pop esi
push 0xf5c
mov dword [ebp - 0x18], esi
call fcn.0041efb2
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x40bd62
push edi
push edi
push ebx
call section..text
jmp 0x40bd64
xor eax, eax
mov edx, dword [eax]
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call dword [edx + 0xb8]
cmp eax, 2
jne 0x40bd7f
or eax, 0xffffffff
jmp 0x40c7ea
push 0x5c
call fcn.0041efb2
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, edi
mov dword [ebp - 4], esi
je 0x40bd9d
push ebx
call fcn.0040df99
mov esi, eax
jmp 0x40bd9f
xor esi, esi
or dword [ebp - 4], 0xffffffff
push ebx
push 0x89
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.0041b673
push 5
mov ecx, esi
call fcn.0041e9fb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0041c300
mov ecx, esi
call fcn.0041ed4a
cmp dword [0x42c67c], edi
je 0x40be39
mov esi, 0x42c67c
mov eax, esi
mov eax, dword [eax]
cmp word [eax], di
je 0x40be39
cmp dword [ebp - 0x18], edi
je 0x40bdf8
mov ecx, dword [ebp - 0x1c]
call fcn.0040dfc4
mov dword [ebp - 0x18], edi
push dword [esi]
lea eax, [ebp - 0x63c]
push 0x451788
push 0x42a620
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x63c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 4
mov eax, esi
cmp dword [esi], edi
jne 0x40bde1
cmp dword [ebx + 0x2028], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
jle 0x40bf6b
add ebx, 0xe4
jmp 0x40be58
xor edi, edi
cmp dword [str._EXE_], edi
mov esi, 0x42bc80
je 0x40be92
mov edi, esi
mov eax, dword [esi]
cmp word [eax], 0
je 0x40be92
push eax
call fcn.0040e8db
shl eax, 1
push eax
push dword [esi]
push dword [ebx]
call fcn.0040ef60
add esp, 0x10
test eax, eax
je 0x40be94
add edi, 0x30
mov esi, edi
cmp dword [edi], 0
jne 0x40be67
xor esi, esi
xor edi, edi
cmp esi, edi
jne 0x40bee0
cmp dword [ebp - 0x24], edi
je 0x40bf4f
cmp dword [ebp - 0x18], edi
je 0x40beb3
mov ecx, dword [ebp - 0x1c]
call fcn.0040dfc4
mov dword [ebp - 0x18], edi
push dword [ebx]
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x63c]
push 0x42a620
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40bf4f
mov eax, dword [esi + 0x28]
cmp eax, edi
jl 0x40befb
test byte [esi + 0x17], 0x80
je 0x40bef2
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4 + 0x64]
jmp 0x40befe
mov eax, dword [esi + 0x2c]
cmp eax, edi
jl 0x40bf05
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x330]
push 0x451788
push eax
call fcn.0040e743
mov eax, dword [esi + 0x10]
pop ecx
cmp eax, edi
pop ecx
je 0x40bf45
cmp word [eax], di
je 0x40bf45
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.0040e719
lea eax, [ebp - 0x330]
push 0x42a61c
push eax
call fcn.0040e719
add esp, 0x10
mov esi, dword [esi + 8]
cmp esi, edi
jl 0x40bf4f
mov dword [ebp - 0x14], esi
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
add ebx, 4
cmp ecx, dword [eax + 0x2028]
jl 0x40be56
xor edi, edi
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041ed5f
cmp esi, edi
je 0x40bf88
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x330]
push 0x451788
push eax
call fcn.0040e743
lea eax, [ebp - 0x330]
push eax
call fcn.004030ae
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x330]
cmp esi, eax
jbe 0x40c05e
cmp word [esi], di
jne 0x40bfc4
cmp word [esi - 2], 0x5c
je 0x40bfd5
push 0x42bc64
push esi
call fcn.0041ad52
pop ecx
test eax, eax
pop ecx
jne 0x40bfe6
push 0x451788
mov word [esi - 2], di
call fcn.004030ae
pop ecx
jmp 0x40bfa8
push 0x42bc5c
push esi
call fcn.0041ad52
pop ecx
test eax, eax
pop ecx
jne 0x40c010
push 0x42a61c
push 0x451788
call fcn.0040e8db
pop ecx
lea eax, [eax*2 + 0x451788]
jmp 0x40c056
lea eax, [ebp - 0x330]
push eax
call fcn.0040e8db
mov word [ebp + eax*2 - 0x330], 0x5c
lea eax, [ebp - 0x330]
push eax
call fcn.0040e8db
pop ecx
lea eax, [ebp + eax*2 - 0x330]
pop ecx
lea ecx, [ebp - 0x330]
cmp eax, ecx
jbe 0x40c051
cmp word [eax], di
jne 0x40c051
cmp word [eax - 2], 0x5c
je 0x40c05e
push 0x42a61c
push eax
call fcn.0040e743
pop ecx
pop ecx
lea eax, [ebp - 0x330]
push edi
push eax
call fcn.00403324
cmp dword [0x432160], 0x20200
pop ecx
pop ecx
lea eax, [ebp - 0x330]
push 0x104
push eax
jge 0x40c0a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x330]
push 0x42ba5c
push eax
call fcn.0040e719
pop ecx
pop ecx
jmp 0x40c101
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x330]
push 0x42ba5c
push eax
call fcn.0040e719
pop ecx
pop ecx
push 0x42ba44
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x40c101
push str.SHGetSpecialFolderPathW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40c0fa
cmp dword [0x432160], 0x30500
push 1
jge 0x40c0ec
push 2
jmp 0x40c0ee
push 0x17
lea ecx, [ebp - 0x330]
push ecx
push dword [ebx + 0x1c]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x330]
push 0x42ba0c
push eax
call fcn.0040e719
lea eax, [ebp - 0x330]
push 0x42a61c
push eax
call fcn.0040e719
add esp, 0x10
cmp dword [0x42c64c], edi
je 0x40c190
mov esi, 0x42c64c
mov eax, esi
mov eax, dword [eax]
cmp word [eax], di
je 0x40c190
push dword [esi]
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x63c]
push 0x42b9f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40c187
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 8
mov eax, esi
cmp dword [esi], edi
jne 0x40c135
lea eax, [ebp - 0x330]
push eax
call fcn.004030ae
mov esi, eax
lea eax, [ebp - 0x330]
cmp esi, eax
pop ecx
jbe 0x40c24a
cmp word [esi], di
jne 0x40c1b9
cmp word [esi - 2], 0x5c
je 0x40c1ca
push 0x42bc64
push esi
call fcn.0041ad52
pop ecx
test eax, eax
pop ecx
jne 0x40c1d0
mov word [esi - 2], di
jmp 0x40c190
push 0x42bc5c
push esi
call fcn.0041ad52
pop ecx
test eax, eax
pop ecx
jne 0x40c1fc
lea eax, [ebp - 0x330]
push 0x42a61c
push eax
call fcn.0040e8db
pop ecx
lea eax, [eax*2 + 0x451788]
jmp 0x40c242
lea eax, [ebp - 0x330]
push eax
call fcn.0040e8db
mov word [ebp + eax*2 - 0x330], 0x5c
lea eax, [ebp - 0x330]
push eax
call fcn.0040e8db
pop ecx
lea eax, [ebp + eax*2 - 0x330]
pop ecx
lea ecx, [ebp - 0x330]
cmp eax, ecx
jbe 0x40c23d
cmp word [eax], di
jne 0x40c23d
cmp word [eax - 2], 0x5c
je 0x40c24a
push 0x42a61c
push eax
call fcn.0040e743
pop ecx
pop ecx
lea eax, [ebp - 0x330]
push edi
push eax
call fcn.00403324
pop ecx
pop ecx
mov ecx, ebx
call fcn.0040cc6b
or dword [ebx + 0x60], 0xffffffff
mov dword [ebx + 0x5c], 0x1b
call fcn.0040a518
mov esi, 0x451788
push str.C:Program_Files_
push esi
call fcn.0040e743
push 0x42a61c
push esi
call fcn.0040e719
jmp 0x40c7e5
push 0xf5c
mov dword [ebp - 0x1c], 1
call fcn.0041efb2
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
push 2
cmp ecx, edi
pop esi
mov dword [ebp - 4], esi
je 0x40c2bb
push edi
push edi
push ebx
call fcn.00401074
jmp 0x40c2bd
xor eax, eax
mov edx, dword [eax]
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call dword [edx + 0xb8]
cmp eax, esi
je 0x40bd77
push 0x5c
call fcn.0041efb2
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, edi
mov dword [ebp - 4], 3
je 0x40c2f7
push dword [ebp - 0x10]
call fcn.0040df99
mov ebx, eax
jmp 0x40c2f9
xor ebx, ebx
push dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push 0x89
call fcn.0041b673
push 5
mov ecx, ebx
call fcn.0041e9fb
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0041c300
mov ecx, ebx
call fcn.0041ed4a
cmp dword [0x42c680], 0
mov edi, 0x451684
je 0x40c396
mov esi, 0x42c680
mov eax, esi
mov eax, dword [eax]
cmp byte [eax], 0
je 0x40c396
cmp dword [ebp - 0x1c], 0
je 0x40c358
mov ecx, ebx
call fcn.0040dfc4
and dword [ebp - 0x1c], 0
push dword [esi]
lea eax, [ebp - 0x434]
push edi
push 0x42a52c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x434]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 4
mov eax, esi
cmp dword [esi], 0
jne 0x40c340
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
cmp dword [ecx + 0x2028], eax
mov dword [ebp - 0x20], eax
jle 0x40c4d2
mov eax, ecx
add eax, 0x1084
mov dword [ebp - 0x18], eax
cmp dword [0x42c0a0], 0
mov esi, 0x42c0a0
je 0x40c3f5
mov edi, esi
mov eax, dword [esi]
cmp byte [eax], 0
je 0x40c3f5
push eax
call fcn.0040e860
push eax
mov eax, dword [ebp - 0x18]
push dword [esi]
push dword [eax]
call fcn.0040ef60
add esp, 0x10
test eax, eax
je 0x40c3f7
add edi, 0x30
mov esi, edi
cmp dword [edi], 0
jne 0x40c3ca
xor esi, esi
xor edi, edi
cmp esi, edi
jne 0x40c445
cmp dword [ebp - 0x14], edi
je 0x40c4b4
cmp dword [ebp - 0x1c], edi
je 0x40c415
mov ecx, ebx
call fcn.0040dfc4
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
push dword [eax]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x434]
push 0x42a52c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40c4b4
mov eax, dword [esi + 0x28]
cmp eax, edi
jl 0x40c460
test byte [esi + 0x17], 0x80
je 0x40c457
mov ecx, dword [ebp - 0x24]
add eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4 + 0x64]
jmp 0x40c463
mov eax, dword [esi + 0x2c]
cmp eax, edi
jl 0x40c46a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x128]
push 0x451684
push eax
call fcn.0040e770
mov eax, dword [esi + 0x10]
pop ecx
cmp eax, edi
pop ecx
je 0x40c4aa
cmp byte [eax], 0
je 0x40c4aa
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0040e780
lea eax, [ebp - 0x128]
push 0x42a528
push eax
call fcn.0040e780
add esp, 0x10
mov esi, dword [esi + 8]
cmp esi, edi
jl 0x40c4b4
mov dword [ebp - 0x24], esi
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x18], 4
cmp ecx, dword [eax + 0x2028]
jl 0x40c3ba
mov edi, 0x451684
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, ebx
call fcn.0041ed5f
test ebx, ebx
je 0x40c4ec
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.0040e770
lea eax, [ebp - 0x128]
push eax
call fcn.004030f6
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x128]
cmp esi, eax
jbe 0x40c5c2
cmp byte [esi], 0
jne 0x40c523
cmp byte [esi - 1], 0x5c
je 0x40c534
push 0x42bc44
push esi
call fcn.004123c0
pop ecx
test eax, eax
pop ecx
jne 0x40c547
and byte [esi - 1], 0
lea eax, [ebp - 0x128]
push eax
call fcn.004030f6
pop ecx
jmp 0x40c508
push 0x42bc3c
push esi
call fcn.004123c0
pop ecx
test eax, eax
pop ecx
jne 0x40c574
mov ebx, 0x42a528
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.0040e860
pop ecx
lea eax, [ebp + eax - 0x128]
jmp 0x40c5b8
lea eax, [ebp - 0x128]
push eax
call fcn.0040e860
mov byte [ebp + eax - 0x128], 0x5c
lea eax, [ebp - 0x128]
push eax
call fcn.0040e860
pop ecx
lea eax, [ebp + eax - 0x128]
pop ecx
lea ecx, [ebp - 0x128]
cmp eax, ecx
jbe 0x40c5b2
cmp byte [eax], 0
jne 0x40c5b2
cmp byte [eax - 1], 0x5c
je 0x40c5c2
mov ebx, 0x42a528
push ebx
push eax
call fcn.0040e770
pop ecx
pop ecx
jmp 0x40c5c7
mov ebx, 0x42a528
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004036bd
cmp dword [0x432160], 0x20200
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push 0x104
push eax
jge 0x40c60a
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x128]
push 0x42bc28
push eax
call fcn.0040e780
pop ecx
pop ecx
jmp 0x40c66e
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x128]
push 0x42bc28
push eax
call fcn.0040e780
pop ecx
pop ecx
push str.SHELL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40c66e
push str.SHGetSpecialFolderPathA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c667
cmp dword [0x432160], 0x30500
push 1
jge 0x40c656
push 2
jmp 0x40c658
push 0x17
lea ecx, [ebp - 0x128]
push ecx
mov ecx, dword [ebp - 0x10]
push dword [ecx + 0x1c]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x128]
push 0x42bbe4
push eax
call fcn.0040e780
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.0040e780
add esp, 0x10
cmp dword [0x42c664], 0
je 0x40c6fb
mov esi, 0x42c664
mov eax, esi
mov eax, dword [eax]
cmp byte [eax], 0
je 0x40c6fb
push dword [esi]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x434]
push str._s_s.lnk
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x77c]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c6f1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 8
mov eax, esi
cmp dword [esi], 0
jne 0x40c69f
lea eax, [ebp - 0x128]
push eax
call fcn.004030f6
mov esi, eax
lea eax, [ebp - 0x128]
cmp esi, eax
pop ecx
jbe 0x40c7a9
cmp byte [esi], 0
jne 0x40c723
cmp byte [esi - 1], 0x5c
je 0x40c734
push 0x42bc44
push esi
call fcn.004123c0
pop ecx
test eax, eax
pop ecx
jne 0x40c73a
and byte [esi - 1], 0
jmp 0x40c6fb
push 0x42bc3c
push esi
call fcn.004123c0
pop ecx
test eax, eax
pop ecx
jne 0x40c762
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.0040e860
pop ecx
lea eax, [ebp + eax - 0x128]
jmp 0x40c7a1
lea eax, [ebp - 0x128]
push eax
call fcn.0040e860
mov byte [ebp + eax - 0x128], 0x5c
lea eax, [ebp - 0x128]
push eax
call fcn.0040e860
pop ecx
lea eax, [ebp + eax - 0x128]
pop ecx
lea ecx, [ebp - 0x128]
cmp eax, ecx
jbe 0x40c7a0
cmp byte [eax], 0
jne 0x40c7a0
cmp byte [eax - 1], 0x5c
je 0x40c7a9
push ebx
push eax
call fcn.0040e770
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004036bd
mov esi, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, esi
call fcn.0040cc6b
or dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x5c], 0x1b
call fcn.0040a518
push 0x42b4dc
push edi
call fcn.0040e770
push ebx
push edi
call fcn.0040e780
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret