Function at 0x4ef0d0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ef470
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 0xb0], edx
mov eax, dword [ebp - 0x10]
call fcn.004ce370
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x110]
mov dword [ebp - 0x18], eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00406db4
xor eax, eax
mov dword [ebp - 0x14], eax
mov bl, 1
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004cedc0
xor eax, eax
push ebp
push 0x4ef409
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xbc], 0
jne 0x4ef15e
push 1
mov ecx, 0x2776
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
cmp dword [eax + 4], 0
jne 0x4ef175
mov eax, dword [ebp - 0x10]
call fcn.004e97ec
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
cmp dword [eax + 4], 0
jne 0x4ef1a7
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
jne 0x4ef1a7
push 1
mov ecx, 0x2afa
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004cedc0
test bl, bl
je 0x4ef2c5
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406db4
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xf4], 0
je 0x4ef233
mov eax, dword [ebp - 0x10]
test byte [eax + 0xf8], 0x10
jne 0x4ef233
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xf4]
mov dl, 1
call fcn.004c6f78
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00414a7c
mov eax, dword [ebp - 0x10]
test byte [eax + 0xf8], 0x20
je 0x4ef20d
mov eax, dword [ebp - 4]
call fcn.004c7520
mov eax, dword [ebp - 4]
call fcn.004c7074
test al, al
jne 0x4ef233
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x2908
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9260
call fcn.00405940
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xbc]
call fcn.00406db4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
call fcn.004e0f50
dec eax
jle 0x4ef2c5
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x78], 0
jne 0x4ef29a
lea eax, [ebp - 8]
mov edx, 0x106
call fcn.004070c4
mov eax, dword [ebp - 8]
call fcn.00406dec
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 8]
call fcn.00406dec
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00406f0c
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406db4
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
mov dl, 1
call fcn.004c6f78
push 1
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xbc]
mov eax, dword [ebp - 0x10]
call fcn.004e5028
test eax, eax
sete bl
test bl, bl
je 0x4ef2d3
mov eax, dword [ebp - 0x10]
call fcn.004ebae0
mov esi, eax
test esi, esi
jle 0x4ef3ff
xor eax, eax
push ebp
push 0x4ef3f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.004efa28
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004efe00
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 0x68
xor edx, edx
call fcn.00406d60
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x5d], 0
je 0x4ef34e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10c], 0
jne 0x4ef34e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x38]
cmp word [eax + 0x102], 0
jne 0x4ef34e
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x110], edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
mov edx, 0x2906
mov eax, dword [ebp - 0x10]
call fcn.004ce900
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0xe4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004eba78
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xb0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef3ff
mov eax, dword [ebp - 0x10]
call fcn.004ebb24
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x114]
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
call fcn.004e0f50
dec eax
jle 0x4ef3b8
mov eax, dword [ebp - 0xc]
call fcn.00406dec
push eax
call sub.kernel32.dll_DeleteFileW
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004ed560
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x5d], 0
je 0x4ef3f4
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10c], 0
jne 0x4ef3f4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x38]
cmp word [eax + 0x102], 0
jne 0x4ef3f4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x110], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ef44d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef477
lea eax, [ebp - 0x1c]
call fcn.00406d50
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406d58
ret