Function at 0x408590
Capabilities:
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3ac
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 5
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x11], 0
jne 0x408b6a
mov eax, dword [edi + 0x1c]
push 5
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [edi + 0xc0]
mov dword [ebp - 4], 0
test al, al
je 0x408627
mov ecx, dword [edi + 0xc4]
push ecx
call fcn.004065b0
add esp, 4
mov byte [edi + 0xc0], al
test al, al
jne 0x408619
xor edx, edx
mov dword [edi + 0xc4], edx
mov dword [edi + 0xc8], edx
mov dword [edi + 0xcc], edx
mov dword [edi + 0xd0], edx
mov al, byte [edi + 0xc0]
test al, al
jne 0x408b15
call fcn.00406770
test al, al
jne 0x408653
call fcn.00408510
push 0
mov byte [ebp - 0x11], 1
call fcn.0046bd3b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00401dd0
test al, al
je 0x408693
push 0
call fcn.00407a50
add esp, 4
test al, al
je 0x408693
mov eax, dword [edi + 0xd4]
push eax
call fcn.004064c0
add esp, 4
test eax, eax
jne 0x40868e
mov ecx, edi
call fcn.00406d30
call fcn.00401f20
call fcn.00406ee0
call fcn.00406510
mov ecx, edi
call fcn.004076b0
mov ecx, edi
call fcn.00408210
mov ecx, edi
call fcn.00408310
mov ecx, edi
call fcn.00408400
call fcn.00405d10
test al, al
je 0x408aea
lea ecx, [ebp - 0xac]
mov byte [ebp + 0xb], 0
call sym.AOM.exe_public:_void___thiscall_AWE_Prefs::constructor_void_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sym.AOM.exe_public:_void___thiscall_AODB_PrefsTable::constructor_void_
lea ecx, [ebp - 0xac]
mov bl, 2
push ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call sym.AOM.exe_public:_enum__AODB_error_code___thiscall_AODB_PrefsTable::getFirstPref_class_AWE_Prefs__
test eax, eax
jne 0x408acf
cmp byte [ebp - 0x8f], 1
jne 0x408acf
mov edx, dword [ebp - 0x74]
lea eax, [edx - 4]
cmp eax, 0x1c
ja case.0x408717.18
xor ecx, ecx
mov cl, byte [eax + 0x408bbc]
jmp dword [ecx*4 + 0x408b80]
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 3
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x83
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 4
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x84
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 5
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x85
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 6
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x86
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 7
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x87
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 8
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x88
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 9
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x89
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xa
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x8a
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xb
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x8b
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xc
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x8c
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xd
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x8d
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xe
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x8e
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0xf
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x8f
push edx
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0x10
je 0x4089b8
lea eax, [ebp + 0xb]
push 0x90
push eax
call fcn.00408be0
jmp 0x4089ba
push 0x64
call fcn.00453048
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
test ecx, ecx
mov byte [ebp - 4], 0x11
je 0x4089b8
lea edx, [ebp + 0xb]
push 0x82
push edx
call fcn.00408be0
jmp 0x4089ba
xor eax, eax
mov byte [ebp - 4], bl
mov ebx, eax
test ebx, ebx
je 0x408acf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xb8]
cmp eax, 1
jne 0x408ac6
mov al, byte [ebp + 0xb]
test al, al
je 0x408a52
lea ecx, [ebp - 0x1b0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x1b0]
push str.AdobeWeb.log
push edx
lea eax, [ebp - 0x1b0]
push str._s_s
push eax
call fcn.00432370
mov eax, dword [edi + 0xd4]
add esp, 0x10
test eax, eax
je 0x408a26
push eax
call fcn.004057a0
add esp, 4
lea ecx, [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x1b0]
push edx
push str.AdobeWeb.log
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call fcn.00405780
mov dword [edi + 0xd4], eax
jmp 0x408a7d
mov edi, str.AdobeWeb.log
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2b4]
push 0x104
push ecx
call fcn.0040b0b0
add esp, 8
test eax, eax
jne 0x408ac6
lea edx, [ebp - 0x1b0]
lea eax, [ebp - 0x2b4]
push edx
push eax
lea ecx, [ebp - 0x3b8]
push str._s__s
push ecx
call fcn.00432370
add esp, 0x10
lea edx, [ebp - 0x3b8]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sym.AOM.exe_public:_void___thiscall_AODB_PrefsTable::destructor_void_
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0
call sym.AOM.exe_public:_void___thiscall_AWE_Prefs::destructor_void_
mov al, byte [edi + 0xc0]
test al, al
jne 0x408b41
call fcn.00406770
test al, al
jne 0x408b41
call fcn.00408510
push 0
mov byte [ebp - 0x11], 1
call fcn.0046bd3b
jmp 0x408b41
mov ecx, dword [edi + 0xc4]
lea esi, [edi + 0xc4]
push ecx
call fcn.004065b0
add esp, 4
mov byte [edi + 0xc0], al
test al, al
jne 0x408b41
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov al, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
test al, al
jne 0x408b6a
call fcn.00407040
mov eax, dword [ebp - 0x1c]
push 0
push 0x15f90
push 5
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4