Function at 0x411c46
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x59c79f
call fcn.005693c7
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x2ac], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41231d
call fcn.0042af76
test al, al
je 0x411c91
mov bl, 0x34
lodsb al, byte [esi]
ret
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x411cd2
call fcn.0042ab6b
test al, al
je 0x41231d
lodsb al, byte [esi]
into
test byte [edi + edi*4], cl
lcall 0x80c7, 0xc67cd675
cli
sub eax, ecx
bound esp, qword [ebp - 0x7f54b543]
invalid
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], ebx
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push ebx
push 0x5a06d8
call fcn.00403772
mov dword [ebp - 4], ebx
call fcn.0042ae62
test al, al
je 0x411d30
test eax, 0xc0c59a02
inc esi
ret
call fcn.0042ab6b
test al, al
je 0x411d58
or al, 0x76
ret 0x43fd
call fcn.0042a988
test al, al
je 0x411d77
xlatb
das
lodsd eax, dword [esi]
hlt
lea eax, [ebp - 0x218]
push eax
push 0x104
add al, 1
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a8]
push eax
call fcn.00413744
pop ecx
pop ecx
add byte [ecx + 0x59], bl
mov byte [ebp - 4], 1
call fcn.0042af76
xchg ecx, eax
add dword [eax], eax
test al, al
je 0x411dbd
test ecx, esi
jae 0x411ddf
pop eax
ret 0x142c
call fcn.0042aeec
test al, al
je 0x411de1
jne 0x411d61
pop esp
jo 0x411d9a
jp 0x411da3
mov edi, 0x34c392d0
pop esi
lea ebp, [ecx - 0x21e1d778]
adc dword [ecx - 0x6d434c95], ebp
outsd dx, dword [esi]
cmp al, ch
rcl dword [eax - 0x3f7bffff], 0x74
sbb dword [ecx + 0x2b44f330], esi
div byte [ecx - 0x73]
call fcn.0042aea7
test al, al
je 0x411e03
mov cl, 0x30
inc esp
sub esi, esi
jno 0x411d7f
retf 0x4df0
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x278]
push eax
call fcn.00413b17
pop ecx
pop ecx
add byte [ecx + 0x59], bl
mov byte [ebp - 4], 2
call fcn.0042a943
test al, al
je 0x411e38
mov word [eax], fs
add byte [0xb4124800], cl
retf 0x32dc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00413b17
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
push eax
call fcn.0041937c
add esp, 0xc
call fcn.0042abb0
test al, al
je 0x411e77
popfd
jae 0x411e3f
cmpsd dword [esi], dword es:[edi]
jg 0x411e14
out dx, al
pop ebx
mov dword [0x262789bf], eax
pop ss
jns 0x411ece
call fcn.0042af31
test al, al
je 0x411ea0
sysexit
pushal
jmp 0xce1a0631
call fcn.0042a943
test al, al
je 0x411ec7
mov esp, 0x47b987ca
sub dword [edx], 0xbac9c96
mov bh, 0x87
aas
pop edi
adc dh, byte [ebx]
jg 0x411eb0
xchg esi, eax
pushfd
lodsb al, byte [esi]
or esi, dword [edi + 0x125f3f87]
xor edi, dword [edi - 0xc]
sal dword [ebp + 0x70], cl
cli
insb byte es:[edi], dx
jmp 0x5db2a5b1
lea eax, [ebp - 0x260]
push eax
call fcn.0041937c
pop ecx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040383c
test eax, eax
jne 0x411f34
call fcn.0042ae1d
test al, al
je 0x411f04
wait
sti
add byte [ecx], dl
jp 0x411ea9
sbb al, 0xa4
push 0xd7e06c59
fisubr dword [esi + 0x42]
cmp word fs:[ebp - 0x218], 0
cmp word [ebp - 0x218], 0
jne 0x411f12
xor eax, eax
jmp 0x411f1f
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403772
jmp 0x411fb2
sbb bh, bh
invalid
call fcn.0042ad93
test al, al
je 0x411f5a
iretd
call fcn.0042ab6b
test al, al
je 0x411f83
xchg ebp, eax
mov al, byte [0x98402618]
loope 0x411f83
wait
mov eax, 0xa0b3b05
xchg ecx, eax
mov ch, byte [esp + edx*2 + 0x66]
dec edx
loopne 0x411f2f
arpl word [edx - 0x4e5a83b1], bp
mov edx, 0xffa3c007
mov ch, 0x54
std
invalid
push dword [ebp - 0x2ac]
lea eax, [ebp - 0x290]
push eax
call fcn.004139df
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x290]
call fcn.00403628
add dword [ebp - 0x28f73], ecx
invalid
and dword [ebp - 0x2b0], 0
call fcn.0042aeec
test al, al
je 0x411fd8
dec esi
test byte [esi], cl
pop esp
loop 0x411fa6
pop edx
push ecx
das
loopne 0x41200a
add al, 0x34
fistp word [eax + 0x200a571b]
mov dword [ecx], 0xe0a5839b
std
invalid
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x21c], 7
push eax
push 0x5a06d8
mov word [ebp - 0x230], ax
call fcn.00403772
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x230]
call fcn.004036b6
call fcn.0042ae62
test al, al
je 0x412045
std
invalid
and dword [eax - 0x5e], edi
and bl, bh
xor ch, bl
mov al, 0xa
iretd
call fcn.0042a8fe
test al, al
je 0x412067
push eax
jbe 0x412091
out 0x99, al
dec edi
fdivp st(0)
xchg edi, eax
loope 0x41206b
and eax, 0x2e15f455
bound ecx, qword [ebx + eax*8 - 0x69]
mov eax, dword [0xe850f9cd]
call fcn.0042abb0
test al, al
je 0x41208c
add byte [eax + eax*8 - 0x32a6e38c], al
and eax, 0xba6573df
pop ecx
int 0x26
and eax, 0xba6573df
dec eax
add dword [ebx], eax
mov eax, dword [0xb305832]
cmp byte [edi - 0x7a], ch
sbb al, 6
cwde
adc al, 0x2f
jno 0x4120cc
push ss
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x2a8]
push ebx
push eax
lea ecx, [ebp - 0x230]
call fcn.00408b95
mov esi, str..fcb
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00408c34
mov eax, dword [ebp - 0x2b0]
test eax, eax
jle 0x4120fd
test dword [eax - 3], ebx
invalid
cdq
push edx
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00412b1a
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.00408b95
push ebx
push 1
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 4
call fcn.00403628
std
invalid
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4121e0
call fcn.0042ab6b
test al, al
je 0x412144
or eax, 0xe5601ecc
mov dword [edx + 0x25], 0x9aa6db3c
in eax, dx
and dword [ecx + 0x5b504845], esp
push eax
pop ebx
outsb dx, byte [esi]
arpl word [ebx + 0x5158c9ac], sp
cmp eax, 0x188c9e8
add byte [eax + eax*8 + 0x5da1e74], al
xor dword [0xa30d0067], edi
pushal
hlt
call fcn.0042aa12
test al, al
je 0x41216b
fiadd dword [0x673d31]
or eax, 0x71f460a3
je 0x41213a
dec edi
je 0x41213d
invalid
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4121e0
call fcn.0042aa12
test al, al
je 0x4121b2
invalid
mov ebx, dword [ebp - 0x2b0]
cmp ebx, 0xa
jge 0x4122d7
push 0
inc ebx
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x2b0], ebx
call fcn.00403628
jmp 0x411fd8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push dword [ebp - 0x2ac]
call fcn.0057c21a
pop ecx
pop ecx
call fcn.0042acc4
test al, al
je 0x412222
add dl, bh
mov bh, 0x57
xchg ebx, eax
and bh, dl
add bl, byte gs:[esi]
sbb edx, dword [eax + 0x44143a6b]
outsd dx, dword [esi]
fadd dword [esi + ecx*2]
movsb byte es:[edi], byte [esi]
add ch, al
call fcn.0042aa57
test al, al
xor byte [eax - 0x3f7bffff], cl
je 0x412243
aas
aas
lds eax, [edi + 0x66530652]
test edx, edi
shl byte [edi + 0x352e1b2a], 1
adc dword [esi - 0x7cdd12ca], esi
bound ebp, qword [ecx + 0x18899e8]
add byte [eax + eax*8 - 0x5736e78c], al
jp 0x412223
call fcn.0042aae1
test al, al
je 0x412264
leave
test al, 0x7a
sal dword [ebx + ebx*4], cl
xor al, 0x9b
adc eax, 0x14b967b6
add eax, 0x2404ea9
push eax
jecxz 0x4122af
and dword [edi - 0x7c280d30], edx
mov ebp, 0xfffffde4
or byte [ebp - 0x22f7b], cl
dec dword [ebx + 0x5a037c35]
add byte [edi], cl
inc ebx
test eax, edx
std
invalid
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
je 0x4122a4
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 5
cmovae eax, dword [ebp - 0x230]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, dword [ebp - 0x2ac]
push ebx
call esi
test eax, eax
je 0x4122d7
call fcn.0042ac7f
test al, al
je 0x4122cc
sal ch, cl
jmp 0x412300
push 5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ebx, ebx
lea ecx, [ebp - 0x230]
xor esi, esi
push ebx
inc esi
push esi
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x260]
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x278]
call fcn.00403628
push ebx
push esi
adc edi, edi
call dword [ebx + 0x56]
lea ecx, [ebp - 0x2a8]
call fcn.00403628
push ebx
push esi
lea ecx, [ebp - 0x248]
call fcn.00403628
call fcn.00569382
ret