Function at 0x4021b0
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42a17a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
mov eax, dword [0x437144]
push ebx
push ebp
mov dword [esp + 0x534], eax
mov eax, dword [esp + 0x548]
mov ecx, dword [eax]
push esi
push edi
mov dword [esp + 0x34], ecx
call fcn.0041e7dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
xor ebx, ebx
lea ecx, [esp + 0x38]
mov dword [esp + 0x548], ebx
call fcn.00405649
mov eax, dword [esp + 0x554]
push ebx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x550], 1
call fcn.004056de
cmp eax, ebx
je 0x402816
nop
lea ecx, [esp + 0x38]
call fcn.00405426
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], eax
call fcn.0040560c
test eax, eax
jne 0x40280c
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00405928
mov byte [esp + 0x548], 2
call fcn.0041e7dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xb0]
push ecx
push edx
mov byte [esp + 0x554], 3
mov dword [esp + 0x5c], 0x124
call fcn.0041c510
lea eax, [esp + 0xac]
push eax
call fcn.0040f0b5
add esp, 4
push eax
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401630
mov edx, dword [esp + 0x38]
push 0x10
lea ecx, [esp + 0x3c]
call dword [edx + 0x38]
test eax, eax
je 0x40232a
mov ebp, dword [esp + 0x550]
cmp dword [ebp + 0x1c], ebx
mov esi, dword [esp + 0x18]
je 0x402322
push esi
call fcn.00404dd0
push str..
call fcn.0040f0b5
add esp, 8
push eax
push str..
lea ecx, [esp + 0x1c]
call fcn.00401b10
mov eax, dword [esp + 0x558]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push ebp
call fcn.004021b0
add esp, 0xc
cmp eax, 3
je 0x402a0e
lea eax, [esi - 0x10]
jmp 0x4027c7
mov ebp, dword [esp + 0x18]
push ebp
call fcn.00404dd0
add esp, 4
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.00426cee
mov eax, dword [eax + 4]
push 0x3ee
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.00401fd0
mov edx, dword [esp + 0x14]
mov eax, dword [eax]
push edx
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x554], 4
call fcn.00401d50
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x548], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4023a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0xc
call fcn.0041ed3d
mov edi, dword [esp + 0x24]
mov esi, eax
mov dword [esi], 0x10000001
mov dword [esi + 4], ebx
mov eax, dword [edi - 0xc]
lea eax, [eax + eax + 2]
push eax
call fcn.0041ed6d
push edi
push eax
mov dword [esi + 8], eax
call fcn.0040f0f5
mov ecx, dword [esp + 0x44]
add esp, 0x10
push ebx
push esi
push 0x465
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4023f0
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x4027c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
mov esi, eax
lea eax, [esp + 0x24]
push eax
push 0x400
push esi
push ebx
push 0x1100
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40270b
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
push eax
lea ecx, [esp + 0x14]
call fcn.00401f30
lea ecx, [esp + 0x10]
mov byte [esp + 0x548], 5
call fcn.00401cd0
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
lea ecx, [edx - 0x10]
lea esi, [eax - 0x10]
cmp ecx, esi
je 0x4024be
mov eax, dword [esi + 0xc]
cmp eax, ebx
lea edi, [esi + 0xc]
jl 0x4024ac
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4024ac
push ecx
call fcn.00401410
add esp, 4
mov ebp, eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4024a3
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
lea eax, [ebp + 0x10]
mov dword [esp + 0x10], eax
jmp 0x4024be
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00401630
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [eax]
xor ecx, ecx
cmp dx, bx
mov esi, eax
je 0x402537
lea esp, [esp]
cmp dx, 0xa
jne 0x4024de
cmp ecx, ebx
jne 0x4024e0
mov ecx, esi
jmp 0x4024e0
xor ecx, ecx
mov dx, word [esi + 2]
add esi, 2
cmp dx, bx
jne 0x4024d0
cmp ecx, ebx
je 0x402537
sub ecx, eax
sar ecx, 1
mov esi, ecx
mov ecx, dword [eax - 4]
mov edx, 1
sub edx, ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x402517
push esi
lea ecx, [esp + 0x14]
call fcn.004013c0
mov eax, dword [esp + 0x10]
cmp esi, ebx
jl 0x402a1c
cmp esi, dword [eax - 8]
jg 0x402a1c
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x10]
mov word [eax + esi*2], bx
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [eax]
xor ecx, ecx
cmp dx, bx
mov esi, eax
je 0x4025ac
cmp dx, 0xd
jne 0x402553
cmp ecx, ebx
jne 0x402555
mov ecx, esi
jmp 0x402555
xor ecx, ecx
mov dx, word [esi + 2]
add esi, 2
cmp dx, bx
jne 0x402545
cmp ecx, ebx
je 0x4025ac
sub ecx, eax
sar ecx, 1
mov esi, ecx
mov ecx, dword [eax - 4]
mov edx, 1
sub edx, ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x40258c
push esi
lea ecx, [esp + 0x14]
call fcn.004013c0
mov eax, dword [esp + 0x10]
cmp esi, ebx
jl 0x402a1c
cmp esi, dword [eax - 8]
jg 0x402a1c
mov dword [eax - 0xc], esi
mov ecx, dword [esp + 0x10]
mov word [ecx + esi*2], bx
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [eax]
xor ecx, ecx
cmp dx, bx
mov esi, eax
je 0x402627
lea ebx, [ebx]
cmp dx, 0x2e
jne 0x4025ce
cmp ecx, ebx
jne 0x4025d0
mov ecx, esi
jmp 0x4025d0
xor ecx, ecx
mov dx, word [esi + 2]
add esi, 2
cmp dx, bx
jne 0x4025c0
cmp ecx, ebx
je 0x402627
sub ecx, eax
sar ecx, 1
mov esi, ecx
mov ecx, dword [eax - 4]
mov edx, 1
sub edx, ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x402607
push esi
lea ecx, [esp + 0x14]
call fcn.004013c0
mov eax, dword [esp + 0x10]
cmp esi, ebx
jl 0x402a1c
cmp esi, dword [eax - 8]
jg 0x402a1c
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x10]
mov word [edx + esi*2], bx
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [eax]
xor ecx, ecx
cmp dx, bx
mov esi, eax
je 0x402699
cmp dx, 0x3002
jne 0x402644
cmp ecx, ebx
jne 0x402646
mov ecx, esi
jmp 0x402646
xor ecx, ecx
mov dx, word [esi + 2]
add esi, 2
cmp dx, bx
jne 0x402635
cmp ecx, ebx
je 0x402699
sub ecx, eax
sar ecx, 1
mov esi, ecx
mov ecx, dword [eax - 4]
mov edx, 1
sub edx, ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x40267d
push esi
lea ecx, [esp + 0x14]
call fcn.004013c0
mov eax, dword [esp + 0x10]
cmp esi, ebx
jl 0x402a1c
cmp esi, dword [eax - 8]
jg 0x402a1c
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x10]
mov word [eax + esi*2], bx
call fcn.00426cee
mov eax, dword [eax + 4]
push 0x3ef
lea ecx, [esp + 0x30]
push ecx
mov ecx, eax
call fcn.00401fd0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push edx
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x558], 6
call fcn.00401d50
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x548], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
jmp 0x402746
call fcn.00426cee
mov eax, dword [eax + 4]
push 0x3f0
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call fcn.00401fd0
mov edx, dword [esp + 0x14]
mov eax, dword [eax]
push esi
push edx
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x558], 7
call fcn.00401d50
mov eax, dword [esp + 0x40]
add esp, 0x10
add eax, 0xfffffff0
mov byte [esp + 0x548], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402768
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0xc
call fcn.0041ed3d
mov edi, dword [esp + 0x24]
mov esi, eax
mov dword [esi], 0x10000000
mov dword [esi + 4], 0x22
mov eax, dword [edi - 0xc]
lea eax, [eax + eax + 2]
push eax
call fcn.0041ed6d
push edi
push eax
mov dword [esi + 8], eax
call fcn.0040f0f5
mov ecx, dword [esp + 0x44]
add esp, 0x10
push ebx
push esi
push 0x465
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 3
je 0x402a26
cmp eax, 4
mov ebp, dword [esp + 0x18]
je 0x4023f0
lea eax, [ebp - 0x10]
mov byte [esp + 0x548], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4027e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x548], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40280c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp dword [esp + 0x28], ebx
jne 0x402230
lea ecx, [esp + 0x38]
call fcn.00405356
mov eax, dword [esp + 0x550]
cmp dword [eax + 0x18], ebx
je 0x402b68
mov ebp, dword [esp + 0x554]
push ebp
lea ecx, [esp + 0x1c]
call fcn.00401f30
mov byte [esp + 0x548], 8
call fcn.0041e7dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x2f8]
push ecx
push edx
mov byte [esp + 0x554], 9
mov dword [esp + 0x34], 0x124
call fcn.0041c510
lea eax, [esp + 0x2f4]
push eax
call fcn.0040f0b5
add esp, 4
push eax
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401630
lea edx, [esp + 0x6c]
push edx
call fcn.0041c160
call fcn.0041e7dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x558]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x24]
push str.._s_x_
push edx
mov byte [esp + 0x558], 0xa
call fcn.00401d50
add esp, 0x10
lea ecx, [esp + 0x54]
call fcn.00405649
mov esi, dword [esp + 0x14]
push 0
mov bl, 0xb
push esi
lea ecx, [esp + 0x5c]
mov byte [esp + 0x550], bl
call fcn.004056de
test eax, eax
je 0x402ae0
lea ecx, [esp + 0x54]
call fcn.00405426
lea ecx, [esp + 0x54]
mov dword [esp + 0x24], eax
call fcn.0040560c
test eax, eax
jne 0x402ad4
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x58]
call fcn.00405928
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54c], 0xc
call fcn.00401c20
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x548], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402975
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401d20
mov edx, dword [eax]
movzx eax, word [ebp]
push edx
push eax
lea ecx, [esp + 0x20]
push str._c:_s
push ecx
mov byte [esp + 0x558], 0xd
call fcn.00401d50
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x548], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4029d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
push eax
call fcn.00405020
add esp, 4
test eax, eax
jne 0x402ad0
mov edx, dword [esp + 0x54]
push 0x10
lea ecx, [esp + 0x58]
call dword [edx + 0x38]
test eax, eax
mov esi, dword [esp + 0x14]
je 0x402abb
push esi
call fcn.00404e40
add esp, 4
jmp 0x402ad4
lea ecx, [esp + 0x38]
call fcn.00405356
lea eax, [esi - 0x10]
jmp 0x402a36
push 0x80070057
call fcn.00401060
lea ecx, [esp + 0x38]
call fcn.00405356
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x548], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x548], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x548], 0
call fcn.0040566f
lea eax, [edi - 0x10]
mov dword [esp + 0x548], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ab1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 3
jmp 0x402ba3
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402ad4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x402912
lea ecx, [esp + 0x54]
call fcn.00405356
lea ecx, [esp + 0x54]
mov byte [esp + 0x548], 0xa
call fcn.0040566f
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x548], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov byte [esp + 0x548], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x548], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x548], 0
call fcn.0040566f
lea eax, [edi - 0x10]
mov dword [esp + 0x548], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402b9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x540]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x530]
pop ebx
call fcn.0040f58c
add esp, 0x53c
ret