Function at 0x4022b0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc74
mov eax, dword [0x433dc0]
xor eax, esp
mov dword [esp + 0xc70], eax
push ebx
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x45e]
mov esi, ecx
push edi
push eax
mov dword [esp + 0x1c], esi
mov word [esp + 0x464], di
call fcn.004141b0
push 0x206
lea ecx, [esp + 0x262]
push edi
push ecx
mov word [esp + 0x268], di
call fcn.004141b0
push 0x206
lea edx, [esp + 0x66]
push edi
push edx
call fcn.004141b0
push 0x206
lea eax, [esp + 0x892]
push edi
push eax
mov word [esp + 0x898], di
call fcn.004141b0
mov eax, 0x42dc3c
add esp, 0x30
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402341
sub eax, edx
sar eax, 1
mov word [esp + 0x48], di
je 0x402368
push 0x42dc3c
push 0x104
lea ecx, [esp + 0x50]
push ecx
jmp 0x402377
push 0x42e278
push 0x104
lea edx, [esp + 0x50]
push edx
call fcn.0041188b
lea eax, [esp + 0x54]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402386
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x40], 0x2e
jne 0x4023b8
lea eax, [esp + 0x48]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4023a4
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x40], di
lea eax, [esp + 0x48]
push 0x5c
push eax
call fcn.00411e30
add esp, 8
test eax, eax
jne 0x40241e
push 0x104
lea ecx, [esp + 0x86c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
lea edx, [esp + 0x86c]
push 0x104
push edx
call fcn.004119e5
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x878]
push ecx
push str._s_s
lea edx, [esp + 0x268]
push 0x104
push edx
call fcn.00411564
add esp, 0x20
jmp 0x40243d
lea eax, [esp + 0x48]
push eax
push 0x42e29c
lea ecx, [esp + 0x258]
push 0x104
push ecx
call fcn.00411564
add esp, 0x10
lea edx, [esp + 0x250]
push edx
push str._s.log
lea eax, [esp + 0x460]
push 0x104
push eax
call fcn.00411564
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x46c]
push edx
call fcn.00411f4f
add esp, 0x18
test eax, eax
je 0x402485
lea ecx, [esp + 0x458]
lea eax, [esi + 0x40]
push ecx
jmp 0x4025a7
cmp dword [esp + 0x2c], 0x7a120
jge 0x402497
lea eax, [esi + 0x40]
jmp 0x40259f
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 4
push 0x206
lea eax, [esp + 0x666]
push edi
push eax
mov word [esp + 0x66c], di
call fcn.004141b0
push 0x206
lea ecx, [esp + 0xa82]
push edi
push ecx
mov word [esp + 0xa88], di
call fcn.004141b0
add esp, 0x18
cmp esi, edi
jne 0x402503
lea edx, [esp + 0x250]
push edx
push str._s.log
lea eax, [esp + 0x668]
push 0x104
push eax
call fcn.00411564
add esp, 0x10
jmp 0x402526
push esi
lea ecx, [esp + 0x254]
push ecx
push str._s_d.log
lea edx, [esp + 0x66c]
push 0x104
push edx
call fcn.00411564
add esp, 0x14
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x664]
push ecx
call fcn.00411f4f
add esp, 8
cmp esi, 4
jne 0x402550
cmp eax, edi
jne 0x40258f
lea edx, [esp + 0x660]
push edx
call ebx
jmp 0x40258f
cmp eax, edi
jne 0x40258f
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x254]
push ecx
push str._s_d.log
lea edx, [esp + 0xa7c]
push 0x104
push edx
call fcn.00411564
lea eax, [esp + 0xa84]
push eax
lea ecx, [esp + 0x678]
push ecx
call fcn.00412286
add esp, 0x1c
sub esi, 1
jns 0x4024a2
mov eax, dword [esp + 0x10]
add eax, 0x40
lea edx, [esp + 0x458]
push edx
push 0x104
push eax
mov word [eax], di
call fcn.0041188b
mov ecx, dword [esp + 0xc88]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041141f
mov esp, ebp
pop ebp
ret