Function at 0x447280
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c0db
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x240]
mov ebx, dword [ebp + 0xc]
push eax
call fcn.0040e710
add esp, 4
mov eax, dword [ebp - 0x240]
mov dword [ebp - 4], 0
test eax, eax
je 0x4472d8
mov eax, dword [eax]
jmp 0x4472da
xor eax, eax
lea ecx, [ebp - 0x23c]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x447445
test byte [ebp - 0x23c], 0x10
jne 0x447445
call fcn.0043b2f0
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
jne 0x4473e7
cmp dword [ebp - 0x21c], 0
jne 0x447359
cmp dword [ebp - 0x220], 0
jne 0x447359
push 0x30
push 0x49794c
push str.The_log_of_boot_time_activity_created_by_a_previous_instance_of_Process_Monitor_is_incomplete_and_cannot_be_read.
push esi
call edi
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x44734b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x447445
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x447445
push 0x24
push 0x49794c
push str.A_log_of_boot_time_activity_was_created_by_a_previous_instance_of_Process_Monitor._Do_you_wish_to_save_the_collected_data_now_
push esi
call edi
cmp eax, 6
jne 0x447445
push str.Bootlog.pml
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00470605
push 0x54
lea eax, [ebp - 0x294]
push 0
push eax
call fcn.00471730
add esp, 0x18
mov dword [ebp - 0x298], 0x58
lea eax, [ebp - 0x218]
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x278], 0x104
push eax
mov dword [ebp - 0x28c], 0x4a4d30
mov dword [ebp - 0x264], 0x20008
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x4473fc
jmp 0x447445
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00470605
add esp, 0xc
push 0x4a4440
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00435f40
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, 0x4bda08
push 0x4be1c0
push 0x4bdfb8
push 0
push eax
call fcn.00416710
test al, al
jne 0x4474b4
push 0x10
push 0x49794c
push str.Unable_to_create_the_requested_PML_file
push esi
call edi
xor bl, bl
mov esi, dword [ebp - 0x240]
test esi, esi
je 0x447496
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x447496
test esi, esi
je 0x447496
mov eax, dword [esi]
test eax, eax
je 0x447476
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44748d
push eax
call fcn.004705af
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.004705af
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4474c2
mov eax, dword [eax]
jmp 0x4474c4
xor eax, eax
push eax
push esi
call fcn.0043afd0
mov ecx, dword [ebp - 0x240]
add esp, 8
mov bl, al
test ecx, ecx
je 0x4474de
mov ecx, dword [ecx]
jmp 0x4474e0
xor ecx, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x4474fc
push 0x10
push 0x49794c
push str.An_error_occurred_processing_the_boot_time_data
jmp 0x447442
mov bl, 1
jmp 0x447447