Function at 0x401cc0
Capabilities:
Delete file
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x84], edi
mov esi, ecx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x68], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x60], edi
mov byte [ebp - 0x5a], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x7c], eax
test esi, esi
je 0x401dc3
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x401d5c
call ebx
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
jle 0x401d53
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x58], esi
test esi, esi
js 0x401db5
mov esi, 0x80004005
jmp 0x401db2
push 0
push 0x401c30
push 0
push 0x65
push dword [0x41b194]
mov dword [0x41b190], esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, 0xffffffff
jne 0x401da5
call ebx
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
jle 0x401d9c
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x58], esi
test esi, esi
js 0x401db5
mov esi, 0x80004005
jmp 0x401db2
test esi, esi
jle 0x401db5
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x58], esi
mov dword [0x41b190], edi
test esi, esi
js 0x40244f
lea eax, [ebp - 0x80]
mov edx, str.MANIFEST
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00403310
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244f
mov edi, dword [ebp - 0x74]
movzx eax, byte [edi + 1]
imul eax, eax, 0x468
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x401e10
mov esi, 0x8007000e
jmp 0x40255d
movzx eax, byte [edi + 1]
lea ecx, [edi + 4]
mov edx, dword [ebp + 8]
xor bl, bl
imul eax, eax, 0xa8
add ecx, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x78], ecx
test al, al
je 0x401e8a
nop
movzx edi, bl
shl edi, 4
add edi, ecx
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x80], eax
mov eax, edx
cmp edx, 0xffffffff
jne 0x401e4e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp eax, dword [ebp - 0x80]
jne 0x401e6a
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.00401920
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x401f3d
mov eax, dword [ebp - 0x74]
inc bl
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x78]
mov al, byte [eax + 2]
cmp bl, al
jb 0x401e30
mov ebx, dword [ebp - 0x68]
mov dword [ebp - 0x70], ebx
test ebx, ebx
jne 0x401f50
xor cl, cl
mov byte [ebp - 0x59], cl
test al, al
je 0x401f50
movzx edi, cl
mov eax, edx
shl edi, 4
add edi, dword [ebp - 0x78]
mov ebx, dword [edi + 0xc]
cmp edx, 0xffffffff
jne 0x401eb3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov edx, eax
mov ecx, 4
and edx, 0x3ff
cmp cx, dx
jne 0x401f00
cmp eax, 0xc04
ja 0x401ee7
je 0x401ef5
cmp eax, 0x404
je 0x401ef5
cmp eax, 0x804
jne 0x401ee1
mov eax, 0x804
xor ecx, ecx
cmp eax, ebx
jmp 0x401f0b
cmp eax, 0x1004
je 0x401edc
cmp eax, 0x1404
jne 0x401ee1
mov eax, 0x404
xor ecx, ecx
cmp eax, ebx
jmp 0x401f0b
and ebx, 0x3ff
xor ecx, ecx
cmp dx, bx
sete cl
test ecx, ecx
je 0x401f25
lea edx, [ebp - 0x68]
mov ecx, edi
call fcn.00401920
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x401f3d
mov cl, byte [ebp - 0x59]
mov ebx, dword [ebp - 0x74]
inc cl
mov byte [ebp - 0x59], cl
cmp cl, byte [ebx + 2]
jae 0x401f48
mov edx, dword [ebp + 8]
jmp 0x401e97
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
jmp 0x40244c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
jmp 0x401f53
mov ebx, dword [ebp - 0x74]
mov edi, dword [ebp - 0x84]
test edi, edi
je 0x401f64
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor cl, cl
mov byte [ebp - 0x59], cl
cmp byte [ebx + 1], cl
jbe 0x402444
mov eax, dword [ebp - 0x64]
mov edx, 0x418808
test eax, eax
cmovne edx, eax
mov dword [ebp - 0x94], edx
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], eax
movzx eax, cl
imul eax, eax, 0xa8
push ecx
lea ecx, [ebp - 0x7c]
add eax, 4
add ebx, eax
movzx eax, byte [ebp - 0x5a]
imul eax, eax, 0x468
mov dword [ebp - 0x80], ebx
add eax, edi
mov dword [ebp - 0x68], eax
call fcn.00402d70
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244f
push 0x27
push dword [ebp - 0x68]
lea edi, [ebx + 0x8c]
push edi
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
test dword [ebx + 0xa4], 0x100
je 0x402010
mov ecx, 6
mov dword [ebp - 0x78], ecx
jmp 0x402051
cmp dword [ebp + 0x14], 7
je 0x402046
mov edx, dword [ebx + 0x9c]
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
push eax
push dword [ebx + 0xa0]
call fcn.00401780
mov esi, eax
add esp, 8
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x78], ecx
jmp 0x402049
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x40242a
inc byte [ebp - 0x5a]
mov eax, dword [ebp - 0x6c]
push 0x208
test eax, eax
je 0x402072
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x402081
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x40208f
mov esi, 0x8007000e
jmp 0x40217d
mov ecx, eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40215e
cmp eax, 0x104
jae 0x40215e
push ecx
mov edx, 0x41898c
lea ecx, [ebp - 0x64]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x402156
push 0x27
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x402156
push ecx
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x64]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x402156
push ecx
mov edx, 0x41898c
lea ecx, [ebp - 0x64]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x402156
mov edi, dword [ebp - 0x64]
mov ecx, edi
mov dword [ebp - 0x6c], edi
call fcn.00403570
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
push ecx
lea edx, [ebx + 0xc]
lea ecx, [ebp - 0x64]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x402156
mov edi, dword [ebp - 0x64]
mov edx, edi
push ecx
mov ecx, ebx
mov dword [ebp - 0x6c], edi
call fcn.004033c0
mov esi, eax
jmp 0x402180
mov edi, dword [ebp - 0x64]
mov dword [ebp - 0x6c], edi
jmp 0x402183
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x402175
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov ecx, dword [ebp - 0x68]
mov esi, edi
add ecx, 0x4e
mov dword [ebp - 0x64], 1
mov edx, 0x104
sub esi, ecx
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4021bf
movzx eax, word [esi + ecx]
test ax, ax
je 0x4021bf
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4021a1
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
mov dword [ebp - 0x58], esi
je 0x40244c
cmp dword [ebp - 0x70], eax
je 0x4022f3
test byte [ebx + 0xa4], 0x80
je 0x4022f3
push ecx
mov edx, str._TRANSFORMS_
lea ecx, [ebp - 0x7c]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov eax, dword [ebx + 0xa4]
test al, 4
je 0x402299
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x8c]
push ecx
and eax, 1
mov ecx, ebx
push eax
call fcn.00401680
mov esi, eax
add esp, 8
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov ecx, dword [ebp - 0x70]
call fcn.00403230
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x70], 0
test edx, edx
je 0x4022dd
movzx eax, word [edx]
test ax, ax
je 0x4022dd
mov edi, 0x5c
mov ecx, eax
mov esi, edx
lea ebx, [edi - 0x2d]
cmp di, cx
je 0x402286
cmp bx, cx
je 0x402286
mov eax, 0x3a
cmp ax, cx
jne 0x402289
lea edx, [esi + 2]
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x402272
jmp 0x4022d7
mov eax, dword [ebp - 0x70]
mov edx, eax
movzx eax, word [eax]
test ax, ax
je 0x4022dd
mov edi, 0x5c
mov ecx, eax
mov esi, edx
lea ebx, [edi - 0x2d]
cmp di, cx
je 0x4022c6
cmp bx, cx
je 0x4022c6
mov eax, 0x3a
cmp ax, cx
jne 0x4022c9
lea edx, [esi + 2]
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4022b2
mov ebx, dword [ebp - 0x80]
mov edi, dword [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00402f30
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov eax, dword [ebx + 0xa4]
test al, 4
je 0x402397
lea ecx, [ebp - 0x88]
and eax, 1
push ecx
push eax
mov edx, edi
mov ecx, ebx
call fcn.00401580
mov esi, eax
add esp, 8
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
mov esi, dword [ebp - 0x68]
mov ecx, 0x104
mov edi, dword [ebp - 0x88]
add esi, 0x256
mov dword [ebp - 0x64], 0
mov edx, edi
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x402362
movzx eax, word [edx]
test ax, ax
je 0x402362
mov word [esi], ax
add edx, 2
add esi, 2
sub ecx, 1
jne 0x402342
lea eax, [esi - 2]
test ecx, ecx
cmovne eax, esi
xor edx, edx
mov esi, 0x8007007a
mov word [eax], dx
xor eax, eax
test ecx, ecx
cmovne esi, eax
mov dword [ebp - 0x58], esi
je 0x40244c
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x460], 1
mov eax, dword [ebx + 0xa4]
mov edx, eax
mov ecx, eax
test al, 8
jne 0x4023af
mov esi, 3
test al, 0x10
je 0x4023b5
mov esi, 0x43
jmp 0x4023b5
mov esi, dword [ebp - 0x90]
mov eax, ecx
lea edx, [ebx + 0xc]
mov ebx, dword [ebp - 0x68]
and eax, 0x200
push eax
and ecx, 0x10
push ecx
push esi
push dword [ebp - 0x78]
mov ecx, ebx
push dword [ebp - 0x84]
push dword [ebp - 0x7c]
push edi
call fcn.004010a0
mov esi, eax
add esp, 0x1c
mov dword [ebp - 0x58], esi
test esi, esi
js 0x40244c
cmp esi, 1
jne 0x402410
cmp dword [ebx + 0x460], 0
je 0x40241a
lea edi, [ebx + 0x256]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov word [edi], ax
mov dword [ebx + 0x460], eax
jmp 0x40241a
mov dword [ebx + 0x464], 1
cmp dword [ebp - 0x64], 0
je 0x40242a
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov cl, byte [ebp - 0x59]
mov ebx, dword [ebp - 0x74]
inc cl
mov edx, dword [ebp - 0x94]
mov byte [ebp - 0x59], cl
cmp cl, byte [ebx + 1]
jb 0x401f90
test esi, esi
jns 0x4024dd
mov edi, dword [ebp - 0x60]
cmp esi, 0x80070bc2
je 0x4024dd
cmp esi, 0x80070bc3
je 0x4024dd
cmp esi, 0x80070669
je 0x4024dd
mov al, byte [ebp - 0x5a]
test al, al
je 0x4024dd
mov esi, dword [ebp - 0x84]
add edi, 0x256
movzx ebx, al
cmp dword [edi + 0x20e], 0
je 0x4024ab
push 0
push 1
push 3
push 7
push esi
push 0
push 0
lea ecx, [edi - 0x256]
xor edx, edx
call fcn.004010a0
add esp, 0x1c
cmp word [edi], 0
je 0x4024b8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [edi - 0x208], 0
lea eax, [edi - 0x208]
je 0x4024cf
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 0x468
sub ebx, 1
jne 0x402485
mov esi, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x4024eb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x402510
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402516
call edi
jmp 0x402516
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x402533
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x402533
call edi
test ebx, ebx
je 0x402557
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402563
call ebx
jmp 0x402563
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x40257f
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x40257f
call ebx
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x40259b
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x40259b
call ebx
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4025b4
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x4025b4
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403614
mov esp, ebp
pop ebp
ret