Function at 0x100416f9
Capabilities:
Delete directory

Disassembly:
push 0x26c
mov eax, 0x10164a63
call fcn.10163f4b
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], esi
push 0x208
lea eax, [ebp - 0x224]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x250], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebp - 4], 1
xor dl, dl
mov ecx, ebx
call fcn.10040d92
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x270]
call fcn.1003ef5c
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x244]
test edi, edi
js 0x10041b51
cmp dword [ebp - 0x248], esi
je 0x10041787
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x248], esi
push esi
lea eax, [ebp - 0x248]
mov edx, 0x2001f
push eax
push esi
mov ecx, ebx
call fcn.10113657
mov dword [ebp - 0x244], eax
test eax, eax
jns 0x100417ec
mov ecx, dword [0x101923c0]
cmp ecx, 0x101923c0
je 0x100417d4
test byte [ecx + 0x44], 1
je 0x100417d4
push eax
push dword [ecx + 0x3c]
mov edx, 0x1001938c
push dword [ecx + 0x38]
push 0x27
pop ecx
call fcn.100401e4
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x258]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x10041b8a
mov ecx, dword [ebp - 0x248]
lea edx, [ebp - 0x224]
push 0x104
call fcn.10113524
mov dword [ebp - 0x244], eax
test eax, eax
jns 0x10041852
mov ecx, dword [0x101923c0]
cmp ecx, 0x101923c0
je 0x1004183a
test byte [ecx + 0x44], 1
je 0x1004183a
push eax
push dword [ecx + 0x3c]
mov edx, 0x1001938c
push dword [ecx + 0x38]
push 0x28
pop ecx
call fcn.100401e4
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x25c]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x10041b8a
lea ecx, [ebp - 0x248]
call fcn.10040f0d
lea ecx, [eax - 1]
mov dword [ebp - 0x250], ecx
mov edx, ecx
lea ecx, [ebp - 0x248]
call fcn.10040f66
lea ecx, [ebp - 0x270]
call fcn.1003efeb
mov dword [ebp - 4], esi
jmp 0x10041912
test edi, edi
jns 0x10041983
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x100418d5
test byte [eax + 0x44], 1
je 0x100418d5
push edi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x2a
pop ecx
call fcn.100401e4
push edi
lea ecx, [ebp - 0x260]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x10041b8a
cmp edi, 0x80070002
jne 0x100418a7
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10041b36
test byte [eax + 0x44], 4
je 0x10041b36
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x29
pop ecx
call fcn.10040085
jmp 0x10041b36
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x100419c1
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10041b36
test byte [eax + 0x44], 4
je 0x10041b36
push ecx
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x2b
pop ecx
call fcn.100400e3
jmp 0x10041b36
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x100419e7
test byte [eax + 0x44], 4
je 0x100419e7
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x2c
pop ecx
call fcn.10040085
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], esi
push eax
lea ecx, [ebp - 0x270]
call fcn.1003ef5c
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x244]
test edi, edi
jns 0x10041a4b
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10041a33
test byte [eax + 0x44], 1
je 0x10041a33
push edi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x2d
pop ecx
call fcn.100401e4
push edi
lea ecx, [ebp - 0x264]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
jmp 0x10041b8a
xor eax, eax
mov dword [ebp - 0x22c], 7
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x230], esi
mov word [ebp - 0x240], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10041a6d
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.10045aa5
push esi
push esi
push ecx
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 5
xor ecx, ecx
call fcn.1006009b
push esi
push 1
lea ecx, [ebp - 0x240]
call fcn.10045ee3
mov ecx, dword [ebp - 0x248]
call fcn.10041652
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10041b09
mov dl, 1
lea ecx, [ebp - 0x224]
call fcn.1005fa5c
test eax, eax
jns 0x10041b09
mov ecx, dword [0x101923c0]
cmp ecx, 0x101923c0
je 0x10041b09
test byte [ecx + 0x44], 1
je 0x10041b09
push eax
push ebx
lea eax, [ebp - 0x224]
push eax
push dword [ecx + 0x3c]
push dword [ecx + 0x38]
push 0x2e
pop ecx
call fcn.10040147
cmp dword [ebp - 0x248], 0
je 0x10041b2b
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
mov dword [ebp - 0x248], esi
call fcn.100410d2
lea ecx, [ebp - 0x270]
call fcn.1003efeb
cmp dword [ebp - 0x248], 0
je 0x10041b4b
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10163e9d
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x10041b77
test byte [eax + 0x44], 1
je 0x10041b77
push edi
push dword [eax + 0x3c]
mov edx, 0x1001938c
push dword [eax + 0x38]
push 0x26
pop ecx
call fcn.100401e4
push edi
lea ecx, [ebp - 0x254]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3