Function at 0x405cf0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x106bc
call fcn.00410f10
mov eax, dword [0x411014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x401684
lea eax, [ebp - 0x106a8]
mov dword [ebp - 0x106bc], edx
xor ebx, ebx
mov dword [ebp - 0x106b4], ecx
push 0x8000
push eax
mov dword [ebp - 0x106b0], ebx
mov dword [ebp - 0x106ac], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea edi, [ebp - 0x106a0]
mov esi, 0x411498
push 0x20
pop edx
push 9
pop ecx
movzx eax, word [esi]
cmp ax, dx
je 0x405d5c
cmp ax, cx
jne 0x405d61
add esi, 2
jmp 0x405d4f
push 0x2f
pop edx
cmp ax, dx
jne 0x405d86
cmp word [esi + 2], 0x41
jne 0x405d86
movzx eax, word [esi + 4]
push 0x20
pop edx
cmp ax, dx
je 0x405d81
cmp ax, cx
jne 0x405d86
mov bl, 1
add esi, 6
push 0x3d
pop eax
push eax
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x405da1
mov eax, 0x401690
jmp 0x406299
movzx eax, word [esi]
lea edx, [ebp - 0x106a0]
push 0x3d
mov dword [ebp - 0x106b8], edx
pop edx
cmp ax, dx
je 0x405ddb
mov ecx, eax
mov word [edi], cx
lea eax, [ebp - 0x6a8]
add edi, 2
cmp edi, eax
jae 0x4062fe
add esi, 2
movzx eax, word [esi]
mov ecx, eax
cmp ax, dx
jne 0x405dba
test bl, bl
je 0x4060c3
movzx eax, word [edi - 2]
cmp eax, 0x2a
je 0x4060bb
push 0x2f
pop esi
cmp ax, si
je 0x4060bb
cmp eax, 0x25
je 0x4060bb
cmp eax, 0x2b
je 0x4060bb
cmp eax, 0x2d
je 0x4060bb
cmp eax, 0x26
je 0x4060bb
cmp eax, 0x5e
je 0x4060bb
cmp eax, 0x7c
je 0x4060bb
push 0x3e
pop edx
lea ecx, [edi - 4]
cmp ax, dx
jne 0x405e42
cmp word [ecx], dx
je 0x405e4f
push 0x3c
pop edx
cmp ax, dx
jne 0x405e51
cmp word [ecx], dx
jne 0x405e51
mov edi, ecx
push 0x3d
pop edx
push 0x22
pop eax
cmp word [ebp - 0x106a0], ax
jne 0x405e6c
lea eax, [ebp - 0x1069e]
mov dword [ebp - 0x106b8], eax
mov word [edi], dx
lea eax, [ebp - 0x6a8]
add edi, 2
cmp edi, eax
jae 0x4062fe
push 0x401694
mov esi, 0x106
lea eax, [ebp - 0x218]
push esi
push eax
lea eax, [ebp - 0x106b0]
xor ebx, ebx
push eax
mov dword [ebp - 0x106b0], ebx
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv_s]
add esp, 0x10
test eax, eax
jne 0x405eb6
cmp dword [ebp - 0x106b0], ebx
jne 0x405ecc
push 0x40169c
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x6a8]
push eax
push ebx
push 0x4016a0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405f04
lea eax, [ebp - 0x218]
push eax
push 0x43c
push dword [0x4216a4]
call fcn.004053f6
add esp, 0xc
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov esi, dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 0xc
push 0x20
pop eax
push eax
lea eax, [ebp - 0x218]
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x405fab
lea eax, [ebp - 0x218]
push 0x22
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x405fab
lea ebx, [ebp - 0x218]
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x405f51
sub ebx, ecx
lea eax, [ebp - 0x218]
sar ebx, 1
lea esi, [ebx + ebx]
push esi
push eax
lea eax, [ebp - 0x216]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ebx, [ebx*2 + 4]
push 0x22
pop eax
mov word [ebp - 0x218], ax
mov word [ebp + esi - 0x216], ax
cmp ebx, 0x20c
jae 0x406302
xor eax, eax
mov word [ebp + ebx - 0x218], ax
xor ebx, ebx
push dword [ebp - 0x106bc]
mov edx, dword [ebp - 0x106b4]
lea ecx, [ebp - 0x218]
call fcn.00405bd5
test eax, eax
jne 0x4062fe
push 0x20
pop eax
push eax
lea eax, [ebp - 0x218]
push 0x4016a8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfsopen]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x405ffe
lea eax, [ebp - 0x218]
push eax
push 0x41c
push ebx
call fcn.004053f6
add esp, 0xc
push esi
lea eax, [ebp - 0x298]
push 0x40
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
add esp, 0xc
test eax, eax
jne 0x40602a
lea eax, [ebp - 0x218]
push eax
push 0x41d
push ebx
call fcn.004053f6
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
cmp eax, 0xffffffff
jne 0x40604c
lea eax, [ebp - 0x218]
push eax
push 0x424
push ebx
call fcn.004053f6
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
pop ecx
cmp eax, 0xffffffff
jne 0x406074
lea eax, [ebp - 0x218]
push eax
push 0x421
push ebx
call fcn.004053f6
add esp, 0xc
lea ecx, [ebp - 0x298]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40607d
sub ecx, edx
sar ecx, 1
inc ecx
lea eax, [edi + ecx*2]
lea ecx, [ebp - 0x6a8]
cmp eax, ecx
ja 0x4062fe
lea eax, [ebp - 0x298]
push eax
mov eax, ecx
sub eax, edi
sar eax, 1
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x406255
add edi, 0xfffffffe
jmp 0x405e54
movzx eax, word [esi]
test ax, ax
je 0x40624e
push 0x25
pop edx
mov ecx, eax
mov dword [ebp - 0x106b4], edx
push 0x5e
pop eax
add esi, 2
cmp cx, ax
jne 0x4060fc
movzx eax, word [esi]
test ax, ax
je 0x406240
mov word [edi], ax
add esi, 2
jmp 0x40622f
cmp cx, dx
jne 0x40622c
movzx eax, word [esi]
lea ecx, [ebp - 0x4a0]
mov ebx, eax
cmp ax, dx
je 0x406146
mov edx, eax
movzx ebx, dx
test dx, dx
je 0x406146
mov word [ecx], dx
lea eax, [ebp - 0x29e]
add ecx, 2
cmp ecx, eax
je 0x4062fe
add esi, 2
movzx eax, word [esi]
mov edx, eax
mov ebx, eax
cmp ax, word [ebp - 0x106b4]
jne 0x406117
xor eax, eax
add esi, 2
mov word [ecx], ax
test bx, bx
je 0x4062a8
lea eax, [ebp - 0x4a0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x106ac]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
mov edx, dword [ebp - 0x106ac]
add esp, 0xc
test edx, edx
je 0x4061d0
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x106b0]
jne 0x406180
sub ecx, ebx
lea eax, [ebp - 0x6a8]
sar ecx, 1
lea ebx, [edi + ecx*2]
cmp ebx, eax
jae 0x4062fe
sub eax, edi
push edx
sar eax, 1
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov edi, ebx
push dword [ebp - 0x106ac]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
push 0x25
mov dword [ebp - 0x106ac], eax
pop edx
jmp 0x406240
lea ecx, [ebp - 0x4a0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4061d9
sub ecx, edx
lea eax, [ebp - 0x6a8]
sar ecx, 1
lea ebx, [ecx + 2]
lea ebx, [edi + ebx*2]
cmp ebx, eax
jae 0x4062fe
push 0x25
pop eax
mov word [edi], ax
lea eax, [ebp - 0x4a0]
push eax
add edi, 2
lea eax, [ebp - 0x6a8]
sub eax, edi
sar eax, 1
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov edi, ebx
push 0x25
pop edx
mov word [ebx - 2], dx
jmp 0x406240
mov word [edi], cx
lea eax, [ebp - 0x6a8]
add edi, 2
cmp edi, eax
jae 0x4062fe
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4060da
xor ebx, ebx
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x106a8]
push eax
push 0x8000
push 0x411490
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [ebp - 0x106b8]
add esp, 0xc
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x106a8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x406283
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x411490]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410365
leave
ret
lea ecx, [ebp - 0x4a0]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4062b3
sub ecx, edx
lea eax, [ebp - 0x6a8]
sar ecx, 1
lea esi, [ecx + 1]
lea esi, [edi + esi*2]
cmp esi, eax
jae 0x4062fe
push 0x25
pop eax
mov word [edi], ax
lea eax, [ebp - 0x4a0]
push eax
add edi, 2
lea eax, [ebp - 0x6a8]
sub eax, edi
sar eax, 1
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov edi, esi
jmp 0x406250
xor eax, eax
jmp 0x406299
call fcn.00410495
int3