Function at 0x42120a
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x475280]
xor eax, esp
mov dword [esp + 0xb0], eax
and dword [esp + 0x20], 0
mov eax, edx
push ebx
push esi
mov dword [esp + 0x24], eax
lea edx, [esp + 0x1c]
and al, 1
xor ebx, ebx
and dword [esp + 0x1c], ebx
movzx esi, al
neg esi
push edi
sbb esi, esi
and esi, 0xfffffff9
add esi, 7
mov dword [esp + 0x38], esi
call fcn.00422bac
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x421710
push ebx
push 0x2200000
push 3
push ebx
push esi
push 0x10180
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x4216b4
push 0x34
lea eax, [esp + 0x74]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [esp + 0x48]
xor eax, eax
xor esi, esi
and dword [esp + 0x14], eax
test byte [esp + 0x28], 0x20
push 0xa
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], esi
je 0x4212da
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov edx, edi
push eax
call fcn.00423fdc
mov esi, dword [esp + 0x10]
test eax, eax
js 0x4212da
mov eax, dword [esp + 0x14]
jmp 0x4212dd
xor eax, eax
inc eax
test eax, eax
jne 0x421318
push esi
push edi
push 0x4048d0
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x14
test esi, esi
je 0x42130e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, 0x2a9
jmp 0x4216a8
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x421687
push 0x28
lea eax, [esp + 0x4c]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x421687
push 0x28
lea eax, [esp + 0x4c]
mov dword [esp + 0x6c], 0x2000
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x421676
push 6
pop ecx
mov esi, 0x40493c
mov byte [esp + 0x1b], 1
lea edi, [esp + 0xa4]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x3c], ecx
test ecx, ecx
je 0x4213c1
movzx eax, word [ecx]
cmp eax, 0x61
jb 0x4213a3
cmp eax, 0x7a
jbe 0x4213ad
cmp eax, 0x41
jb 0x4213c1
cmp eax, 0x5a
ja 0x4213c1
cmp word [ecx + 2], 0x3a
jne 0x4213c1
mov edi, dword [esp + 0x1c]
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
jmp 0x4213db
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0xa4]
mov ecx, edi
call fcn.00423d6b
test eax, eax
je 0x42151d
call fcn.004211a8
test eax, eax
je 0x42151d
cmp dword [esp + 0x98], 1
jbe 0x42151d
push 0x10000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x421500
mov eax, dword [esp + 0x10]
test eax, eax
je 0x421426
mov ecx, dword [esp + 0x20]
jmp 0x42142c
mov ecx, edi
mov dword [esp + 0x3c], edi
neg eax
mov edx, 0x8000
sbb eax, eax
and eax, 0xffffffd2
add eax, 0x30
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004209b1
mov eax, dword [esp + 0x10]
mov ecx, 0x8000
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], ecx
lea eax, [esi + eax*2]
mov esi, dword [0x475b04]
push eax
mov dword [esp + 0x38], eax
mov ecx, esi
lea eax, [esp + 0x24]
push eax
push 0
push edi
call dword [0x47744c]
call esi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x421519
and dword [esp + 0x1c], ebx
push dword [esp + 0x3c]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4214f6
mov eax, dword [esp + 0x30]
push dword [esp + 0x34]
mov esi, dword [0x475b08]
mov ecx, esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x18]
call dword [0x47744c]
call esi
test eax, eax
jne 0x42148c
mov esi, dword [esp + 0x14]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x1c], ebx
jne 0x42151d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov dword [esp + 0x14], esi
jmp 0x42151d
mov dword [esp + 0x1c], 1
jmp 0x4214ce
push 0x404958
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0xc
jmp 0x42151d
mov esi, dword [esp + 0x14]
push 0xd
push 1
lea eax, [esp + 0x23]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [esp + 0x30], eax
test eax, eax
jns 0x421590
push 0x40
push 4
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 1
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x421590
cmp eax, 0xc0000003
jne 0x42156c
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
push ebx
push edi
push 0x4049c8
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x14
jmp 0x421598
mov dword [esp + 0x2c], 1
test esi, esi
je 0x4216a8
xor edx, edx
mov ecx, esi
call fcn.00422bac
test byte [esp + 0x28], 4
mov esi, eax
jne 0x4215e2
push dword [esp + 0x14]
push 0x404a28
push 0x4000000
push 0x475b0c
call fcn.00420a7f
push esi
push 0x404a80
push 0x4000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x20
push 0
push 0x2200000
push 3
push 0
push dword [esp + 0x48]
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [esp + 0x38], ecx
cmp ecx, 0xffffffff
je 0x42164d
mov eax, dword [esp + 0x70]
push 0x28
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x4c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
jne 0x421643
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x404ae8
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x14
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x421661
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4216a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push edi
push 0x404b68
jmp 0x421696
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push edi
push 0x404bf0
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x14
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x421700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4216e7
test dword [esp + 0x28], 0x20
jne 0x4216e7
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x421700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push edi
push 0x404c68
jmp 0x4216ee
push ebx
push edi
push 0x404cc8
push 0x3000000
push 0x475b0c
call fcn.00420a7f
add esp, 0x14
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00471d10
mov esp, ebp
pop ebp
ret