Function at 0x4f14e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x565a2d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x2c4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x2dc]
mov dword fs:[0], eax
call fcn.004f0010
mov ebp, eax
xor ebx, ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x4f1450
push ebx
push ebx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, ebx
jne 0x4f156b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Create_wiping_thread
push str.Action:__s_tError:__d
push ebp
call fcn.0042f3c0
add esp, 0x10
xor al, al
jmp 0x4f1829
or edi, 0xffffffff
push edi
push ebx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x20], ebx
call fcn.0049eff0
mov dword [esp + 0x44], vtable.cWCStr.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2e4], ebx
xor edi, edi
jmp 0x4f15a4
mov esi, dword [esp + 0x14]
mov ecx, dword [0x5b3240]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, ebx
je 0x4f173a
cmp esi, 0x102
jne 0x4f174f
cmp byte [0x5beb7b], bl
jne 0x4f15dc
push 0xffffffffffffffff
push 0xfffffffffffffffe
call fcn.004f0810
add esp, 8
push 1
lea ecx, [esp + 0x58]
call fcn.00424330
mov edx, dword [esp + 0x2d0]
mov eax, dword [edx]
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x50]
push eax
mov byte [esp + 0x2f0], 3
call fcn.0049ea40
add esp, 0xc
test eax, eax
jne 0x4f169a
mov eax, dword [esp + 0x2d4]
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax]
jne 0x4f169a
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 4]
jne 0x4f169a
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x38]
call fcn.0049eff0
mov dword [esp + 0x30], vtable.cWCStr.0
mov eax, dword [0x5b9f28]
push 1
push 1
push 0x15e
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x2f4], 4
call fcn.004b5af0
mov ecx, dword [esp + 0x2d0]
mov edx, dword [ecx]
push eax
push edx
push str.Timeout
push str.WipeDeletedFiles
push str.Action:__s_tStatus:__s_tPath:__s_tWarning:__s
push ebp
call fcn.0042f3c0
add esp, 0x18
lea ecx, [esp + 0x30]
mov byte [esp + 0x2e4], 3
mov dword [esp + 0x30], vtable.cWCS.0
call fcn.0049ee80
jmp 0x4f16c5
mov eax, dword [esp + 0x2d0]
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x4c]
call fcn.00406a80
mov eax, dword [esp + 0x2d4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
xor edi, edi
lea ecx, [esp + 0x54]
mov byte [esp + 0x2e4], bl
call fcn.004028f0
inc edi
cmp edi, 0xa
jle 0x4f15a0
push 1
lea ecx, [esp + 0x58]
call fcn.00424330
mov eax, dword [esp + 0x2d0]
mov ecx, dword [eax]
push ecx
push str.The_allowed_waiting_period_is_expired
push str.WipeDeletedFiles
push str.Action:__s_tError:__s_tPath:__s
push ebp
mov byte [esp + 0x2f8], 1
call fcn.0042f3c0
add esp, 0x14
lea ecx, [esp + 0x54]
mov byte [esp + 0x2e4], 2
call fcn.00423910
lea ecx, [esp + 0x54]
mov byte [esp + 0x2e4], bl
call fcn.0049aa70
jmp 0x4f17f9
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x4f17f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.0049eff0
mov ebp, vtable.cWCSF.0
mov dword [esp + 0x20], ebp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x2ec], 5
call fcn.0049eff0
mov dword [esp + 0x30], ebp
push edi
push esi
lea ecx, [esp + 0x28]
push str.Wait_result_0x_X__last_error__d
push ecx
mov byte [esp + 0x2f4], 6
call fcn.00403e80
mov edx, dword [esp + 0x2c]
add esp, 0x10
push eax
push edx
lea eax, [esp + 0x38]
push str.Wait_wiping_thread__04X
push eax
call fcn.00403e80
mov ecx, dword [esp + 0x50]
add esp, 0xc
push eax
push str.Action:__s_tError:__s
push ecx
call fcn.0042f3c0
mov esi, vtable.cWCS.0
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x2e4], 5
mov dword [esp + 0x30], esi
call fcn.0049ee80
lea ecx, [esp + 0x20]
mov byte [esp + 0x2e4], bl
mov dword [esp + 0x20], esi
call fcn.0049ee80
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x18], ebx
lea ecx, [esp + 0x44]
setne bl
mov dword [esp + 0x2e4], 0xffffffff
mov dword [esp + 0x44], vtable.cWCS.0
call fcn.0049ee80
mov al, bl
mov ecx, dword [esp + 0x2dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c4]
xor ecx, esp
call fcn.0051916c
add esp, 0x2d4
ret