Function at 0x41d450
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebx + eax*2]
mov esi, edx
movzx eax, word [ecx]
test ax, ax
je 0x41d485
sub ecx, edx
mov word [edx], ax
add edx, 2
movzx eax, word [ecx + edx]
test ax, ax
jne 0x41d476
movzx eax, word [edx - 2]
lea ecx, [edx - 2]
add eax, 0x2800
mov dword [esp + 0x18], 0x3ff
cmp ax, word [esp + 0x18]
cmova ecx, edx
mov edx, dword [ebp + 0x14]
xor eax, eax
mov word [ecx], ax
sub ecx, esi
sar ecx, 1
mov dword [esp + 0x1c], ecx
mov ecx, edx
and ecx, 0x400
cmp dword [edi + 0x694], 7
mov dword [esp + 0x14], ecx
jne 0x41d4e3
mov eax, dword [edi + 0x6a0]
and eax, 0x1800
or eax, 0
je 0x41d4e3
mov eax, dword [edi + 0x874]
mov esi, 1
jmp 0x41d4f7
mov eax, dword [edi + 0x874]
xor esi, esi
mov dword [esp + 0x18], 1
test eax, eax
jne 0x41d507
mov dword [esp + 0x18], 0
test eax, eax
je 0x41d62b
mov dword [esp + 0x10], ebx
test dl, 1
je 0x41d520
push 0x80
push ebx
call dword [sym.imp.KERNEL30.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x14]
test esi, esi
je 0x41d5a1
test ecx, ecx
jne 0x41d5a1
mov edx, dword [ebp + 0x18]
mov eax, edx
mov ecx, dword [ebp + 0x1c]
or eax, ecx
je 0x41d580
push ecx
push ecx
push edx
push ebx
mov ecx, edi
call fcn.0041d8d0
mov ecx, dword [edi + 0xb60]
test eax, eax
jne 0x41d578
add dword [ecx + 0xe0], 1
push eax
adc dword [ecx + 0xe4], eax
mov ecx, edi
mov eax, dword [edi + 0x85c]
lea eax, [ebx + eax*2]
push eax
push str.WriteRandomData_delete_
call fcn.0041a620
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
add dword [ecx + 0x28], 1
adc dword [ecx + 0x2c], 0
push dword [esp + 0x1c]
push dword [ebp + 0xc]
push dword [edi + 0x848]
push ebx
call fcn.0041d700
test eax, eax
je 0x41d5a1
mov edx, dword [edi + 0x848]
mov dword [esp + 0x10], edx
mov edx, dword [edi + 0x7a0]
mov ecx, dword [esp + 0x10]
call fcn.0045cf00
test eax, eax
jne 0x41d66f
mov ebx, dword [esp + 0x18]
lea esi, [edi + 0xfdc]
test ebx, ebx
je 0x41d5cd
push esi
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
mov eax, dword [edi + 0xb60]
mov ecx, dword [ebp + 0x18]
add dword [eax + 0xf8], 1
adc dword [eax + 0xfc], 0
mov eax, dword [edi + 0xb60]
add dword [eax + 0x100], ecx
mov ecx, dword [ebp + 0x1c]
adc dword [eax + 0x104], ecx
test ebx, ebx
je 0x41d604
push esi
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
mov eax, dword [edi + 0x85c]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [ecx + eax*2]
mov ecx, edi
push eax
push str.DeleteFile
call fcn.0041a620
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test esi, esi
je 0x41d673
test ecx, ecx
jne 0x41d673
mov eax, dword [edi + 0xb60]
add dword [eax + 0x28], 1
adc dword [eax + 0x2c], ecx
mov eax, dword [edi + 0x6a0]
and eax, 0x1000
or eax, ecx
lea eax, [ecx + 3]
jne 0x41d655
lea eax, [ecx + 1]
push dword [ebp + 0x1c]
mov esi, dword [edi + 0xb60]
push dword [ebp + 0x18]
push 0
push eax
call fcn.00488190
add dword [esi + 0x40], eax
adc dword [esi + 0x44], edx
mov ecx, dword [esp + 0x14]
cmp dword [edi + 0x864], 0
je 0x41d6ab
push 0
push dword [ebp + 0x1c]
xor eax, eax
test ecx, ecx
push dword [ebp + 0x18]
setne al
push dword [ebp + 0x24]
push dword [ebp + 0x20]
lea eax, [eax*8 + 0x20]
push ecx
push eax
mov eax, dword [edi + 0x85c]
mov ecx, edi
lea eax, [ebx + eax*2]
push eax
call fcn.00417da0
mov ebx, dword [esp + 0x18]
lea esi, [edi + 0xfdc]
test ebx, ebx
je 0x41d6c0
push esi
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
mov eax, dword [edi + 0xb60]
mov ecx, dword [ebp + 0x18]
add dword [eax + 0x60], 1
adc dword [eax + 0x64], 0
mov eax, dword [edi + 0xb60]
add dword [eax + 0x68], ecx
mov ecx, dword [ebp + 0x1c]
adc dword [eax + 0x6c], ecx
test ebx, ebx
je 0x41d6eb
push esi
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x20