Function at 0x4faec0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ae4d1
mov eax, dword fs:[0]
push eax
sub esp, 0x578
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 4], 0
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x4faf38
movzx ecx, byte [ebp + 0x2d]
test ecx, ecx
jne 0x4faf1c
movzx edx, byte [ebp + 0x2e]
test edx, edx
jne 0x4faf1c
mov dword [ebp - 0x37c], 1
jmp 0x4faf26
mov dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x36c]
mov cl, byte [ebp - 0x37c]
mov byte [eax + 0x251], cl
lea edx, [ebp - 0x250]
push edx
mov ecx, dword [ebp - 0x36c]
call fcn.004fe1e0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x36c]
add eax, 0xec
push eax
lea ecx, [ebp - 0x298]
call fcn.004190c0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x36c]
cmp dword [ecx + 0x26c], 0
jne 0x4faf93
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov edx, dword [ebp - 0x36c]
mov dword [edx + 0x26c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov edx, dword [ebp - 0x36c]
mov dword [edx + 0x264], eax
mov ecx, dword [ebp - 0x36c]
add ecx, 0x1ac
call fcn.00419090
movzx eax, al
test eax, eax
je 0x4fb0ad
mov ecx, dword [ebp - 0x36c]
movzx edx, byte [ecx + 0x248]
push edx
mov eax, dword [ebp - 0x36c]
add eax, 0xa4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3f8], esp
push eax
call fcn.004190c0
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x41c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x36c]
add edx, 0x17c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x424], esp
push edx
call fcn.004190c0
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x36c]
add ecx, 0x164
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x434], esp
push ecx
mov ecx, edx
call fcn.004190c0
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x538]
push eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x36c]
call fcn.00508af0
mov dword [ebp - 0x390], eax
mov ecx, dword [ebp - 0x390]
mov dword [ebp - 0x398], ecx
mov edx, dword [ebp - 0x398]
push edx
mov ecx, dword [ebp - 0x36c]
add ecx, 0x1ac
call fcn.00415700
lea ecx, [ebp - 0x538]
call fcn.00419eb0
push 0x34
lea ecx, [ebp - 0x2cc]
call fcn.0045a4e0
mov eax, dword [ebp - 0x36c]
add eax, 0x1ac
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00517910
mov byte [ebp - 4], 5
push 0x34
lea ecx, [ebp - 0x334]
call fcn.0045a4e0
mov ecx, dword [ebp - 0x36c]
movzx edx, byte [ecx + 0x248]
push edx
mov eax, dword [ebp - 0x36c]
add eax, 0x17c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x444], esp
push eax
call fcn.004190c0
mov dword [ebp - 0x3a0], eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x478], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x36c]
add edx, 0x134
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push edx
call fcn.004190c0
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x488], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x36c]
add ecx, 0x11c
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x490], esp
push ecx
mov ecx, edx
call fcn.004190c0
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x36c]
add ecx, 0xa4
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x468], esp
push ecx
mov ecx, edx
call fcn.004190c0
mov dword [ebp - 0x3e8], eax
lea eax, [ebp - 0x334]
push eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x36c]
call fcn.005087e0
mov dword [ebp - 0x470], eax
mov byte [ebp - 4], 9
push 0x34
lea ecx, [ebp - 0x368]
call fcn.0045a4e0
sub esp, 0x2c
mov ecx, esp
mov dword [ebp - 0x3f0], esp
lea edx, [ebp + 8]
push edx
call fcn.0043b380
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x368]
push eax
mov ecx, dword [ebp - 0x36c]
call fcn.004fc370
mov dword [ebp - 0x3dc], eax
mov byte [ebp - 4], 0xa
push 0x34
lea ecx, [ebp - 0x300]
call fcn.0045a4e0
lea ecx, [ebp - 0x300]
call fcn.00517880
mov byte [ebp - 4], 0xb
push 0x6defa0
lea ecx, [ebp - 0x4a8]
call fcn.00419d50
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x300]
push ecx
lea edx, [ebp - 0x4a8]
push edx
lea ecx, [ebp - 0x2cc]
call fcn.005189f0
movzx eax, al
test eax, eax
jne 0x4fb26e
mov dword [ebp - 0x378], 1
jmp 0x4fb278
mov dword [ebp - 0x378], 0
mov cl, byte [ebp - 0x378]
mov byte [ebp - 0x371], cl
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4a8]
call fcn.00419eb0
movzx edx, byte [ebp - 0x371]
test edx, edx
je 0x4fb37b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x474], esp
push 0x6dee77
call fcn.00419d50
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x400], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x36c]
add ecx, 0x194
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x45c], esp
push ecx
mov ecx, edx
call fcn.004190c0
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x584]
push eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x36c]
call fcn.005089f0
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c8], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x3c8]
push edx
lea ecx, [ebp - 0x300]
call fcn.00517bd0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x584]
call fcn.00517b50
push 0x6defb8
lea ecx, [ebp - 0x508]
call fcn.00419d50
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x508]
push ecx
lea ecx, [ebp - 0x2cc]
call fcn.00519070
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x508]
call fcn.00419eb0
push 0x6defc4
lea ecx, [ebp - 0x4c0]
call fcn.00419d50
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x4c0]
push edx
push 0x784f84
lea ecx, [ebp - 0x334]
call fcn.005192c0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4c0]
call fcn.00419eb0
push 0x6defdc
lea ecx, [ebp - 0x4d8]
call fcn.00419d50
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x4d8]
push ecx
lea ecx, [ebp - 0x2cc]
call fcn.00519070
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4d8]
call fcn.00419eb0
push 0x6defe0
lea ecx, [ebp - 0x4f0]
call fcn.00419d50
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x368]
push edx
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.00519070
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x4f0]
call fcn.00419eb0
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x2cc]
call fcn.00518000
mov byte [ebp - 4], 0x13
mov byte [ebp - 0x36d], 0
push 0x6df084
lea edx, [ebp - 0x250]
push edx
call fcn.0041ba80
add esp, 8
movzx eax, al
test eax, eax
jne 0x4fb4aa
push 0x6df094
lea ecx, [ebp - 0x250]
push ecx
call fcn.0041ba80
add esp, 8
movzx edx, al
test edx, edx
jne 0x4fb4aa
mov eax, dword [ebp - 0x36c]
movzx ecx, byte [eax + 0x61]
test ecx, ecx
je 0x4fb49a
mov edx, dword [ebp - 0x36c]
cmp dword [edx + 0x64], 0
jne 0x4fb4aa
call fcn.004f4460
movzx eax, al
test eax, eax
je 0x4fb7a4
lea ecx, [ebp - 0x298]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004190c0
mov byte [ebp - 4], 0x14
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x484], esp
push 0x6df0b4
call fcn.00419d50
mov dword [ebp - 0x3d0], eax
mov edx, dword [ebp - 0x3d0]
mov dword [ebp - 0x410], edx
mov byte [ebp - 4], 0x15
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x464], esp
push 0x6df0bc
call fcn.00419d50
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x550]
push ecx
mov byte [ebp - 4], 0x14
call fcn.004ea1b0
add esp, 0x38
mov dword [ebp - 0x3d8], eax
mov edx, dword [ebp - 0x3d8]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x380]
push eax
lea ecx, [ebp - 0x238]
call fcn.00415700
lea ecx, [ebp - 0x550]
call fcn.00419eb0
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.004f3350
add esp, 8
mov byte [ebp - 4], 0x16
push 8
lea ecx, [ebp - 0x220]
call fcn.00413f70
lea ecx, [ebp - 0x220]
call fcn.0051e1a0
mov byte [ebp - 4], 0x17
push 0x6dee85
lea ecx, [ebp - 0x268]
call fcn.0041b040
push eax
lea ecx, [ebp - 0x220]
call fcn.0051e1f0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0066eb10
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4fb5ff
push 0x6df0d8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x6df0f0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x220]
call fcn.0051e240
push 0x6df11c
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x520]
push eax
call fcn.004f3350
add esp, 8
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x3b4], ecx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x3b4]
call fcn.0041b040
push eax
lea ecx, [ebp - 0x220]
call fcn.0051e240
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x520]
call fcn.00419320
lea ecx, [ebp - 0x220]
call fcn.0051e2d0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x47c], esp
lea edx, [ebp - 0x238]
push edx
call fcn.004190c0
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 0x19
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x46c], esp
lea edx, [ebp - 0x250]
push edx
call fcn.004190c0
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 0x1a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44c], esp
lea edx, [ebp - 0x280]
push edx
call fcn.004190c0
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0x1b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x450], esp
push 0x784ec4
call fcn.004190c0
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp - 0x438], ecx
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x36c]
add edx, 0x74
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x458], esp
push edx
call fcn.004190c0
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x36c]
call fcn.00508ef0
mov byte [ebp - 0x370], al
mov al, byte [ebp - 0x370]
mov byte [ebp - 0x36d], al
call fcn.004f4460
movzx ecx, al
test ecx, ecx
jne 0x4fb772
lea ecx, [ebp - 0x268]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x220]
call fcn.0051e1d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x268]
call fcn.00419320
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x238]
call fcn.00419eb0
jmp 0x4fb895
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x460], esp
push 0x6dee86
call fcn.00419d50
mov dword [ebp - 0x3a4], eax
mov edx, dword [ebp - 0x3a4]
mov dword [ebp - 0x448], edx
mov byte [ebp - 4], 0x1d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3e0], esp
lea eax, [ebp - 0x250]
push eax
call fcn.004190c0
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3e4], ecx
mov byte [ebp - 4], 0x1e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3ec], esp
lea edx, [ebp - 0x280]
push edx
call fcn.004190c0
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3f4], eax
mov byte [ebp - 4], 0x1f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x3fc], esp
push 0x784ec4
call fcn.004190c0
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x384]
mov dword [ebp - 0x404], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x36c]
add edx, 0x74
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40c], esp
push edx
call fcn.004190c0
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x36c]
call fcn.00508ef0
mov byte [ebp - 0x36e], al
mov al, byte [ebp - 0x36e]
mov byte [ebp - 0x36d], al
mov cl, byte [ebp - 0x36d]
mov byte [ebp - 0x36f], cl
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x280]
call fcn.00419eb0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x300]
call fcn.00517b50
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x368]
call fcn.00517b50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x334]
call fcn.00517b50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2cc]
call fcn.00517b50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x298]
call fcn.00419eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.00419eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b360
mov al, byte [ebp - 0x36f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 0x2c