Function at 0x49d4d0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6d03
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4fefc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x90], 1
add eax, 4
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xa4]
call fcn.00461bf0
mov edi, dword [ebp - 0xa0]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xa4]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x8c], 0
push dword [ebp - 0x8c]
imul ecx
mov dword [ebp - 0x90], 9
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push edi
push esi
call fcn.00461150
mov ecx, dword [ebp - 0xa0]
add esp, 0x10
mov edi, dword [ebp - 0xa4]
mov dword [ebp - 0x90], ecx
cmp edi, ecx
je 0x49d5bd
lea eax, [edi + 0x18]
mov dword [ebp - 0x94], eax
cmp eax, ecx
je 0x49d5bd
nop dword [eax + eax]
push eax
push edi
lea esi, [eax + 0x18]
call fcn.0045eb40
mov ecx, dword [ebp - 0x90]
add esp, 8
test al, al
jne 0x49d877
mov edi, dword [ebp - 0x94]
mov eax, esi
mov dword [ebp - 0x94], eax
cmp eax, ecx
jne 0x49d590
mov eax, ecx
cmp eax, ecx
je 0x49d5fa
push eax
push ecx
push ecx
call fcn.004602b0
mov edi, dword [ebp - 0xa0]
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov esi, eax
cmp eax, edi
je 0x49d5f4
mov ecx, esi
call fcn.004b4410
add esi, 0x18
cmp esi, edi
jne 0x49d5e0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0x98]
lea ecx, [ebp - 0xa4]
add esi, 4
cmp esi, ecx
je 0x49d64c
mov ecx, esi
call fcn.004b4380
mov eax, dword [ebp - 0xa4]
mov dword [esi], eax
mov eax, dword [ebp - 0xa0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esi + 8], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x90], 1
call fcn.004b4380
push esi
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 1
call fcn.00461bf0
mov edi, dword [ebp - 0xac]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xb0]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x8c], 0
push dword [ebp - 0x8c]
imul ecx
mov dword [ebp - 0x90], 3
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push edi
push esi
call fcn.00461150
mov edi, dword [ebp - 0x98]
lea eax, [ebp - 0xb0]
add esp, 0x10
lea esi, [edi + 4]
cmp esi, eax
je 0x49d709
mov ecx, esi
call fcn.004b4380
mov eax, dword [ebp - 0xb0]
mov dword [esi], eax
mov eax, dword [ebp - 0xac]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xa8]
mov dword [esi + 8], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0xffffffff
call fcn.004b4380
push esi
lea ecx, [ebp - 0xbc]
call fcn.00461bf0
mov ecx, dword [ebp - 0xbc]
mov eax, 5
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xb8]
cmp ecx, eax
je 0x49d770
sub eax, 0x18
cmp ecx, eax
je 0x49d770
movups xmm0, xmmword [eax]
movups xmm1, xmmword [ecx]
movq xmm2, qword [ecx + 0x10]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
add ecx, 0x18
movups xmmword [eax], xmm1
movq qword [eax + 0x10], xmm2
cmp ecx, eax
jne 0x49d742
lea esi, [edi + 4]
lea eax, [ebp - 0xbc]
cmp esi, eax
je 0x49d7bc
mov ecx, esi
call fcn.004b4380
mov eax, dword [ebp - 0xbc]
mov dword [esi], eax
mov eax, dword [ebp - 0xb8]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xb4]
mov dword [esi + 8], eax
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
lea ecx, [ebp - 0xbc]
call fcn.004b4380
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
mov edi, dword [edi + 8]
mov dword [ebp - 0x94], ecx
mov ecx, edi
mov dword [ebp - 4], 2
mov esi, dword [eax + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x49ddc0
mov eax, dword [ebp - 0x94]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0
mov edx, 0xa
mov dword [ebp - 0x2c], 0
lea eax, [eax + eax*2]
cmp dword [esi + eax*8 + 0x14], 7
lea esi, [esi + eax*8]
mov edi, esi
jbe 0x49d84c
mov edi, dword [esi]
mov esi, dword [esi + 0x10]
cmp esi, 0x7ffffffe
ja 0x49de16
cmp esi, 7
ja 0x49d8d8
mov ecx, 7
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x40], xmm0
jmp 0x49d933
cmp esi, ecx
je 0x49d8d0
nop dword [eax + eax]
push esi
push edi
call fcn.0045eb40
add esp, 8
test al, al
jne 0x49d8bf
add edi, 0x18
cmp edi, esi
je 0x49d8bf
mov ecx, edi
call fcn.004b4410
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, dword [ebp - 0x90]
jne 0x49d880
mov ecx, dword [ebp - 0xa0]
lea eax, [edi + 0x18]
jmp 0x49d5bf
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x49d8eb
mov eax, 0x7ffffffe
jmp 0x49d8f1
cmp eax, 0xa
cmovb eax, edx
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0045f300
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x2c], ecx
lea ecx, [esi*2 + 2]
push ecx
push edi
push eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x2c]
add esp, 0x14
mov esi, dword [ebp - 0x30]
mov edx, 0xa
mov byte [ebp - 4], 3
test esi, esi
je 0x49dd52
cmp ecx, 7
mov dword [ebp - 0x18], 0
lea edi, [ebp - 0x40]
mov dword [ebp - 0x14], 0
cmova edi, dword [ebp - 0x40]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
cmp esi, 0x7ffffffe
ja 0x49de16
cmp esi, 7
ja 0x49d983
mov edx, 7
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
jmp 0x49d9dc
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x49d996
mov eax, 0x7ffffffe
jmp 0x49d99c
cmp eax, 0xa
cmovb eax, edx
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045f300
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x14], ecx
lea ecx, [esi*2 + 2]
push ecx
push edi
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x2c]
add esp, 0x14
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
or dword [ebp - 0x90], 1
mov byte [ebp - 4], 4
test esi, esi
jne 0x49d9f3
mov dword [ebp - 0x90], esi
jmp 0x49da5c
lea edi, [esi - 1]
cmp esi, edi
jbe 0x49de0c
movups xmm0, xmmword [ebp - 0x28]
cmp edx, 7
lea eax, [ebp - 0x28]
movd dword [ebp - 0x8c], xmm0
cmova eax, dword [ebp - 0x8c]
movzx eax, word [eax + edi*2]
cmp eax, 0x5c
je 0x49da25
cmp eax, 0x2f
jne 0x49da54
lea ecx, [esi - 1]
cmp ecx, esi
ja 0x49da44
cmp edx, 7
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x8c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x49da51
sub ecx, esi
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.004b44c0
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 3
cmp ecx, 7
jbe 0x49da9a
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49da90
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49de06
push ecx
push edx
call fcn.004bf0b8
add esp, 8
mov eax, dword [ebp - 0x94]
movups xmm0, xmmword [ebp - 0x28]
push 0
push 0x4dee00
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 0x98]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [ebp - 0x18]
mov eax, dword [eax + 4]
movq qword [ebp - 0x30], xmm0
lea ecx, [eax + ecx*8]
call fcn.004b4700
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
push 0
cmova eax, dword [ebp - 0x40]
push eax
call fcn.00477c70
add esp, 8
test al, al
je 0x49dd4f
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x88]
cmova eax, dword [ebp - 0x40]
push eax
call fcn.00462850
mov eax, dword [ebp - 0x7a]
and eax, 0xf000
cmp eax, 0x4000
jne 0x49dd3a
cmp dword [ebp - 0x2c], 7
lea edi, [ebp - 0x40]
mov esi, dword [ebp - 0x30]
xorps xmm0, xmm0
cmova edi, dword [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
cmp esi, 0x7ffffffe
ja 0x49de16
cmp esi, 7
ja 0x49db5d
mov ecx, 7
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
jmp 0x49dbb5
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x49db70
mov eax, 0x7ffffffe
jmp 0x49db7b
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045f300
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x14], ecx
lea ecx, [esi*2 + 2]
push ecx
push edi
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x14]
add esp, 0x14
cmp ecx, 7
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call fcn.0047a130
add esp, 4
test al, al
lea eax, [ebp - 0x28]
je 0x49dbea
cmp dword [ebp - 0x14], 7
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
add esp, 4
jmp 0x49dce6
mov edx, dword [ebp - 0xc4]
cmp edx, dword [ebp - 0xc0]
je 0x49dcd9
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
cmp dword [ebp - 0x14], 7
mov edi, dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x8c], eax
cmp edi, 0x7ffffffe
ja 0x49de16
cmp edi, 7
ja 0x49dc50
mov dword [edx + 0x10], edi
mov dword [edx + 0x14], 7
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
add edx, 0x18
mov dword [ebp - 0xc4], edx
jmp 0x49dce6
mov esi, edi
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x49dc78
mov eax, 0x7fffffff
mov esi, 0x7ffffffe
add eax, eax
push eax
cmp eax, 0x1000
jb 0x49dc99
call fcn.0045f350
jmp 0x49dc9e
cmp esi, 0xa
mov eax, 0xa
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x49de11
add eax, eax
jne 0x49dc69
xor ecx, ecx
jmp 0x49dca9
call sub.mfc140u.dll_operator_2
mov edx, dword [ebp - 0xc4]
mov ecx, eax
add esp, 4
lea eax, [edi*2 + 2]
mov dword [edx], ecx
push eax
push dword [ebp - 0x8c]
mov dword [edx + 0x10], edi
push ecx
mov dword [edx + 0x14], esi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0xc4]
add esp, 0xc
add edx, 0x18
mov dword [ebp - 0xc4], edx
jmp 0x49dce6
push eax
push edx
lea ecx, [ebp - 0xc8]
call fcn.0045f4e0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x49dd24
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49dd1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49de06
push ecx
push edx
call fcn.004bf0b8
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x49dd4f
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
cmova eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x49dd8d
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x49dd83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49de06
push ecx
push edx
call fcn.004bf0b8
add esp, 8
mov eax, dword [ebp - 0x98]
inc dword [ebp - 0x94]
mov edi, dword [eax + 8]
mov ecx, edi
mov esi, dword [eax + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x94], eax
jb 0x49d81b
cmp esi, edi
je 0x49ddde
mov ecx, esi
call fcn.004b4410
add esi, 0x18
cmp esi, edi
jne 0x49ddc4
mov ecx, dword [ebp - 0x98]
mov eax, dword [ecx + 4]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0xc8]
call fcn.004b4380
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf553
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.004b44b0
call fcn.004b4310
call fcn.004b4470
int3