Function at 0x4015c3
Capabilities:
Delete file
Get common file path
Get file size
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x8a8]
sub esp, 0x928
mov eax, dword [0x4132b0]
xor eax, ebp
mov dword [ebp + 0x8a4], eax
push esi
mov esi, dword [ebp + 0x8b0]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401802
push esi
push 0x410354
push str._hs_hs_r_n
lea eax, [ebp + 0x390]
push 0x400
push eax
call fcn.004071ab
add esp, 0x14
test eax, eax
jge 0x40162c
push 0x7ec
push str.sfxhead.c
call fcn.0040242b
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x390]
push edi
push eax
call fcn.00407880
mov esi, str._Rename__r_n
lea edi, [ebp + 0x898]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebx, eax
movsb byte es:[edi], byte [esi]
lea eax, [ebp + 0x790]
mov dword [esp], 0x104
xor esi, esi
push eax
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x105
lea eax, [ebp + 0x790]
push edi
push eax
call fcn.004011f2
pop ecx
pop ecx
push str.WinInit.Ini
push edi
lea eax, [ebp + 0x790]
push eax
call fcn.00407207
test eax, eax
jge 0x4016a0
push 0x7f7
push str.sfxhead.c
call fcn.0040242b
pop ecx
pop ecx
push esi
push 0x8000080
push 4
push esi
push esi
push 0xc0000000
lea eax, [ebp + 0x790]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x401800
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push esi
push 4
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 0x80], eax
je 0x4017e2
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x4017d9
lea ecx, [ebp + 0x898]
push ecx
push eax
call fcn.00407300
cmp eax, esi
pop ecx
pop ecx
jne 0x401787
lea eax, [ebp + 0x898]
push eax
push 0x41032c
lea eax, [ebp - 0x70]
push 0x400
push eax
call fcn.004071ab
add esp, 0x10
test eax, eax
jge 0x40174c
push 0x815
push str.sfxhead.c
call fcn.0040242b
pop ecx
pop ecx
lea eax, [ebp - 0x70]
push eax
call fcn.00407880
add edi, eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebx + 0xa]
push eax
mov eax, dword [ebp - 0x74]
add eax, edi
push eax
call fcn.004071ab
add esp, 0x10
test eax, eax
jge 0x401782
push 0x818
push str.sfxhead.c
call fcn.0040242b
pop ecx
pop ecx
mov dword [ebp - 0x7c], edi
jmp 0x4017b5
push 0xa
push eax
call fcn.00407240
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4017b3
mov eax, dword [ebp - 0x74]
inc esi
sub eax, esi
add eax, edi
push eax
lea eax, [esi + ebx]
push esi
push eax
call fcn.00407510
add esp, 0xc
sub esi, dword [ebp - 0x74]
mov dword [ebp - 0x7c], esi
xor esi, esi
mov ecx, dword [ebp - 0x7c]
push ebx
lea eax, [ebp + 0x390]
push eax
mov eax, dword [ebp - 0x74]
add eax, ecx
push eax
call fcn.0040126e
add esp, 0xc
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp + 0x8a4]
xor ecx, ebp
pop esi
call fcn.00407386
add ebp, 0x8a8
leave
ret