Function at 0x63afac
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x63b4e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x63aff1
mov eax, dword [ebp - 8]
call fcn.0063c468
mov eax, dword [ebp - 8]
add eax, 4
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004047c4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x633738]
call fcn.00633c78
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 8]
mov dword [ebx + 0xec], eax
mov dword [ebx + 0xe8], fcn.0063b5c8
mov eax, dword [ebp - 8]
mov dword [ebx + 0xf4], eax
mov dword [ebx + 0xf0], 0x63b638
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10c], eax
mov dword [ebx + 0x108], 0x63bd2c
mov eax, dword [ebp - 8]
mov dword [ebx + 0x124], eax
mov dword [ebx + 0x120], 0x63bd74
lea eax, [ebx + 0x5c]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x38]
call fcn.00406edc
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x55]
mov edx, dword [ebp - 8]
mov ebx, dword [edx + 4]
mov byte [ebx + 0x58], al
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x68]
mov byte [ebx + 0x128], al
lea eax, [ebx + 0xb0]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x3c]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
lea eax, [ebp - 0xc]
mov ecx, 0x63b500
call fcn.004072b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.00637838
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
cmp byte [eax + 0x128], 0
je 0x63b0c8
mov dword [eax + 0x70], 2
jmp 0x63b0d1
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x30]
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 8]
cmp byte [eax + 0x56], 2
jne 0x63b109
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 4]
mov dword [ebx + 0x70], 1
mov eax, dword [ebx + 0xe4]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe4]
call fcn.00471794
test al, al
je 0x63b25b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
call fcn.00471794
test al, al
je 0x63b25b
xor eax, eax
push ebp
push 0x63b186
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
mov dl, 1
mov eax, dword [0x48b468]
call fcn.00491df0
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov dword [edx + 0x8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63b347
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe4]
call fcn.00471794
test al, al
je 0x63b287
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe4]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
xor eax, eax
push ebp
push 0x63b2c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
mov dl, 1
mov eax, dword [0x48b468]
call fcn.00491df0
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov dword [edx + 0x8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63b347
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x56]
cmp al, 2
jne 0x63b3f1
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd9], 2
lea eax, [ebx + 0xc4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x60]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xc8
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x64]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xbc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x58]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xc0
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x5c]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xcc
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xd4
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xd0
xor edx, edx
call fcn.00406edc
jmp 0x63b4c1
cmp al, 1
jne 0x63b4c1
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 4]
mov byte [ebx + 0xd9], 2
lea eax, [ebx + 0xb4]
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xb8
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xc4
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xc8
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x5c]
mov eax, dword [ebp - 8]
lea edx, [eax + 0x58]
mov eax, 0x63b5bc
call fcn.0063acdc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xbc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x58]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xc0
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x5c]
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xcc
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xd4
xor edx, edx
call fcn.00406edc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, 0xd0
xor edx, edx
call fcn.00406edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63b4eb
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00406ed4
lea eax, [ebp - 4]
call fcn.00406ecc
ret