Function at 0x424a9d
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5646ee
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x5c0490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x454]
mov ebx, ecx
push str.DeleteDriverFileStd
push eax
mov dword [ebp - 0x438], ebx
call fcn.00401190
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x218]
push 0
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x434], 1
call fcn.00541d20
add esp, 0xc
test ebx, ebx
jne 0x424597
push ebx
push str.return___08x
lea edx, [ebp - 0x454]
push 2
push edx
call fcn.00401410
add esp, 0x10
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
xor eax, eax
jmp 0x424d70
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00541d20
mov ecx, dword [ebx + 8]
add esp, 0xc
lea edi, [ebp - 0x420]
call fcn.00424dc0
lea ecx, [ebp - 0x44c]
call fcn.0044a6ce
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 1
call fcn.0044a765
mov esi, dword [ebx + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
test eax, eax
je 0x424611
lea esp, [esp]
mov ecx, dword [ebp - 0x444]
push esi
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0044abdf
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
test eax, eax
jne 0x4245f0
call fcn.00448c3f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42462b
push 0x80004005
call fcn.00404160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 2
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x42464c
xor eax, eax
jmp 0x424660
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424651
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.00405470
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.0053dda2
add esp, 8
test eax, eax
jne 0x424687
or ecx, 0xffffffff
jmp 0x42468d
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.004103e0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0044ab55
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4246e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x4246ee
xor eax, eax
jmp 0x424702
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4246f3
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.00405470
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.0053dda2
add esp, 8
test eax, eax
jne 0x424729
or ecx, 0xffffffff
jmp 0x42472f
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.004103e0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0044ab55
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424785
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x18]
test edx, edx
jne 0x424790
xor eax, eax
jmp 0x4247a4
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424795
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.00405470
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.0053dda2
add esp, 8
test eax, eax
jne 0x4247cb
or ecx, 0xffffffff
jmp 0x4247d1
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.004103e0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0044ab55
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424827
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x424832
xor eax, eax
jmp 0x424846
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424837
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.00405470
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.0053dda2
add esp, 8
test eax, eax
jne 0x42486d
or ecx, 0xffffffff
jmp 0x424873
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.004103e0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0044ab55
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4248c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x428], 0
test ecx, ecx
jle 0x424d10
mov eax, dword [ebp - 0x428]
test eax, eax
js 0x424d91
cmp eax, ecx
jge 0x424d91
mov ecx, dword [ebp - 0x448]
mov esi, dword [ecx + eax*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x424926
cmp eax, dword [esi - 0x10]
jne 0x424926
lea ebx, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42495e
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x424d8c
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.0053d708
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0x430], ebx
push 0x5c
push ebx
mov byte [ebp - 4], 7
call fcn.0053dda2
add esp, 8
test eax, eax
jne 0x42497f
or edi, 0xffffffff
jmp 0x424985
sub eax, ebx
sar eax, 1
mov edi, eax
lea ecx, [ebp - 0x420]
push ecx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
mov eax, dword [ebx - 0xc]
jne 0x4249ed
sub eax, edi
push eax
lea edx, [ebp - 0x468]
push edx
lea ecx, [ebp - 0x430]
call fcn.004103e0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push 0x594b70
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x424a37
sub eax, edi
push eax
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x430]
call fcn.004103e0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x424a43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x438]
push ecx
push ebx
call fcn.00424f10
add esp, 8
test eax, eax
jne 0x424ccf
push 0x20
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x434], eax
test eax, eax
jne case.0x424a96.4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x1e
ja case.0x424a96.4
movzx ecx, byte [eax + 0x424da0]
jmp dword [ecx*4 + 0x424d98]
mov dword [ebp - 0x434], 1
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
je 0x424b23
mov eax, dword [ebp - 0x438]
mov eax, dword [eax]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x430]
call fcn.004103e0
mov edx, dword [eax]
push edx
push esi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push 0x5991f0
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x424b85
mov ecx, dword [ebp - 0x438]
mov eax, dword [ecx]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x430]
call fcn.004103e0
mov eax, dword [eax]
push eax
push esi
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push str._s_d_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424b91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x20
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00404f00
push 3
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 8
call fcn.004103e0
mov byte [ebp - 4], 9
mov ecx, dword [eax]
mov esi, dword [ebp - 0x42c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x424c48
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x424c38
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x424c38
push eax
call fcn.00406410
mov dword [ebp - 0x46c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x424c27
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x46c]
add ecx, 0x10
mov dword [ebp - 0x42c], ecx
jmp 0x424c48
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00405470
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x424c6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x42c]
push 0x5985d0
push ecx
call fcn.0053d3bf
add esp, 8
test eax, eax
je 0x424c9e
mov edx, dword [ebp - 0x42c]
push 0x5985d8
push edx
call fcn.0053d3bf
add esp, 8
test eax, eax
jne 0x424ca9
lea ecx, [ebp - 0x218]
call fcn.00420110
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424ccf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424cef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x428], eax
cmp eax, ecx
jl 0x4248e1
mov esi, dword [ebp - 0x424]
mov edi, dword [ebp - 0x434]
push edi
push str.return___08x
lea ecx, [ebp - 0x454]
push 2
push ecx
call fcn.00401410
lea eax, [esi - 0x10]
add esp, 0x10
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x424d4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0
call fcn.0044a9bb
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053ca73
mov esp, ebp
pop ebp
ret
call fcn.00405640
call fcn.004490bd
mov edi, edi
popfd
dec edx
inc edx
add byte [edi + 0x424a], ah
add byte [ecx], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
int3