Function at 0x41dfd0
Capabilities:
Delete file

Disassembly:
sub esp, 0x324
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0041cca0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.0041c7a0
add esp, 4
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e1e2
lea edx, [esp + 0x10]
push edx
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4cb468]
test eax, eax
je 0x41e119
mov al, byte [0x4cc868]
test al, al
je 0x41e119
mov ebp, 1
mov eax, dword [0x4cc974]
test eax, eax
je 0x41e069
push 0
mov ecx, 0x4cc860
call fcn.00433690
test ebp, ebp
je 0x41e09f
push 0
push 0x4cb468
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
test esi, esi
je 0x41e09f
push esi
mov ecx, 0x4cc860
call fcn.00432a80
test eax, eax
jne 0x41e09f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0045932f
add esp, 4
mov esi, 1
lea edx, [esp + 0x18]
push esi
push edx
call fcn.0041ce60
add esp, 8
push eax
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x4cc860
call fcn.00434030
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x41e1cf
cmp dword [0x4cb784], edi
jne 0x41e1bb
cmp ebx, 0xfffffc11
jne 0x41e187
push str.KEventLog.dll
lea ecx, [esp + 0x138]
push str.ERROR:__s_is_not_loaded._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x13c]
push edx
mov dword [esp + 0x140], esi
call fcn.0043e010
add esp, 0x10
jmp 0x41e1bb
mov ecx, dword [0x4cb550]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov ecx, dword [esp + 0x10]
jne 0x41e137
cmp ecx, dword [0x4cb54c]
jne 0x41e137
test edi, edi
je 0x41e147
mov dword [0x4cb550], eax
mov dword [0x4cb54c], ecx
jmp 0x41e054
mov eax, dword [0x4cc974]
test eax, eax
je 0x41e09f
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0041ce60
add esp, 8
test eax, eax
je 0x41e260
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4cc860
call fcn.004335a0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x324
ret
cmp ebx, 0xfffffff9
je 0x41e1bb
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x13c]
push str.ERROR:_InitEventLogProcess___failed_to_load_event_log_definition___.260s___code:__d_._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x140]
push edx
mov dword [esp + 0x144], esi
call fcn.0043e010
add esp, 0x14
mov eax, dword [0x4cb784]
inc eax
cmp eax, 0x14
mov dword [0x4cb784], eax
jle 0x41e260
mov dword [0x4cb784], edi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x324
ret
mov eax, dword [0x4cc974]
test eax, eax
je 0x41e207
lea eax, [esp + 0x28]
push eax
call fcn.0044c6d0
add esp, 4
test eax, eax
jne 0x41e207
push eax
mov ecx, 0x4cc860
call fcn.00433690
mov eax, dword [0x4cb468]
test eax, eax
je 0x41e260
mov al, byte [0x4cc868]
test al, al
je 0x41e260
mov eax, dword [0x4cc974]
test eax, eax
je 0x41e22e
push 0
mov ecx, 0x4cc860
call fcn.00433690
push 0
push 0x4cb468
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
test esi, esi
je 0x41e260
push esi
mov ecx, 0x4cc860
call fcn.00432a80
test eax, eax
jne 0x41e260
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0045932f
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x324
ret