Function at 0x422f40
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c192
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x5c49f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov edi, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [0x5c9840]
cmp eax, dword [ecx + 4]
jle 0x422fba
push 0x5c9840
call fcn.0053357d
add esp, 4
cmp dword [0x5c9840], 0xffffffff
jne 0x422fba
call fcn.004366f0
push 0x560310
call fcn.00533907
add esp, 4
push 0x5c9840
call fcn.0053353e
add esp, 4
push 0x5b0d40
push 0
push 0x5b063c
push 0x5c9848
call fcn.004367d0
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.00430270
push 1
sub esp, 8
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
call fcn.0042ba10
push esi
inc eax
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0042a2b0
push 1
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0042ba10
push eax
push 0
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042a2b0
mov esi, eax
lea eax, [ebp - 0x30]
cmp eax, esi
je 0x42305d
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x423042
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.0042ce80
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
call fcn.0042c6c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x88]
cmp eax, 0x10
jb 0x42307f
inc eax
lea ecx, [ebp - 0x9c]
push eax
push dword [ebp - 0x9c]
call fcn.0042ce80
push 0xd
push str._rollback.txt
lea ecx, [ebp - 0x30]
call fcn.0042c490
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4230e1
mov eax, dword [ecx]
jmp 0x4230e3
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.0042c2b0
lea eax, [ebp - 0x54]
push eax
call fcn.00428330
mov ecx, dword [ebp - 0x50]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x54]
sub ecx, esi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4231de
sub esp, 0x18
lea eax, [eax + eax*2]
mov ecx, esp
shl eax, 4
add eax, 0xffffffd0
add eax, esi
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0042c2b0
call fcn.00425410
test al, al
jne 0x42316e
push 0x5b0d5c
push 1
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
add esp, 0x10
jmp 0x423335
push 0x5b0d80
push 0
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
push 0x5b0ec0
cmovae eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0
push eax
call fcn.0053ab19
add esp, 0x1c
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
cmovae eax, dword [ebp - 0x48]
push dword [ebp - 0xb8]
push dword [ebp - 0x38]
push 1
push eax
call fcn.0053a87a
push dword [ebp - 0xb8]
call fcn.00539ebd
add esp, 0x14
call fcn.00429020
lea eax, [ebp - 0x6c]
push eax
call fcn.00424790
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x84]
push 0
push 0x5b03e0
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0x74], 0
mov byte [ebp - 0x84], 0
call fcn.0042c1b0
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0xb8], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x423247
mov eax, dword [ecx]
jmp 0x423249
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.0042c2b0
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
lea edx, [edi + 0x50]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x42328b
mov eax, dword [ecx]
jmp 0x42328d
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.0042c2b0
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 5
push eax
call fcn.00441f10
test eax, eax
jne 0x423398
cmp dword [ebp - 0x70], 0x10
lea eax, [ebp - 0x84]
cmovae eax, dword [ebp - 0x84]
push eax
push 0x5b0d9c
push 1
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
add esp, 0x14
mov eax, dword [ebp - 0x70]
cmp eax, 0x10
jb 0x4232f9
inc eax
lea ecx, [ebp - 0x84]
push eax
push dword [ebp - 0x84]
call fcn.0042ce80
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0x74], 0
mov byte [ebp - 0x84], 0
cmp eax, 0x10
jb 0x423323
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.0042ce80
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x6c], 0
lea ecx, [ebp - 0x54]
call fcn.0042b5a0
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x423352
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.0042ce80
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
cmp eax, 0x10
jb 0x423379
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.0042ce80
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053342f
mov esp, ebp
pop ebp
ret 4
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4233c3
mov eax, dword [ecx]
jmp 0x4233c5
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.0042c2b0
lea ecx, [ebp - 0xb4]
call fcn.00435cb0
add esp, 0x18
lea eax, [edi + 8]
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
lea edx, [eax + 0x10]
jb 0x4233f5
mov eax, dword [eax]
push dword [edx]
cmp dword [ebp - 0xa0], 0x10
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0xa4]
cmovae ecx, dword [ebp - 0xb4]
push eax
call fcn.0042b980
add esp, 8
test eax, eax
je 0x423488
push 0x5b0db8
push 1
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
add esp, 0x10
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x58], 0x10
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xa0]
cmp eax, 0x10
jb 0x423468
inc eax
lea ecx, [ebp - 0xb4]
push eax
push dword [ebp - 0xb4]
call fcn.0042ce80
mov dword [ebp - 0xa0], 0xf
mov dword [ebp - 0xa4], 0
mov byte [ebp - 0xb4], 0
jmp 0x4232de
push 0x5b0dd4
push 0
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
lea ecx, [ebp - 0x9c]
call fcn.00430270
add esp, 8
mov byte [ebp - 4], 8
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x5c
lea ecx, [ebp - 0x9c]
push eax
call fcn.0042bb00
push eax
push 0
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0042a2b0
push eax
lea ecx, [ebp - 0x9c]
call fcn.0042a3c0
mov eax, dword [ebp - 0xc0]
cmp eax, 0x10
jb 0x423503
inc eax
lea ecx, [ebp - 0xd4]
push eax
push dword [ebp - 0xd4]
call fcn.0042ce80
push 1
push 0x5b0c88
lea ecx, [ebp - 0x9c]
call fcn.0042c490
push 0xffffffffffffffff
push 0
lea esi, [edi + 0x20]
mov ecx, eax
push esi
call fcn.0042c5c0
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x6c]
call fcn.00454590
test eax, eax
jne 0x423596
push 0x5b0de4
push 1
push 0x5b063c
call fcn.00436780
push eax
call fcn.004367d0
add esp, 0x10
lea ecx, [ebp - 0x9c]
call fcn.0042a380
lea ecx, [ebp - 0xb4]
call fcn.0042a380
lea ecx, [ebp - 0x84]
call fcn.0042a380
lea ecx, [ebp - 0x6c]
call fcn.0042a380
lea ecx, [ebp - 0x54]
call fcn.0042b5a0
lea ecx, [ebp - 0x48]
call fcn.0042a380
lea ecx, [ebp - 0x30]
call fcn.0042a380
jmp 0x423379
cmp dword [ebp - 0x58], 0x10
lea eax, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 0x18
lea eax, [ebp - 0x9c]
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0042c2b0
call fcn.00429480
add esp, 0x18
sub esp, 0x18
mov ecx, esp
test al, al
jne 0x4235fd
lea eax, [ebp - 0x9c]
push eax
call fcn.0042a520
call fcn.004359e0
add esp, 0x18
push 0x5b0dfc
jmp 0x42353b
push esi
call fcn.0042a520
call fcn.00425410
test al, al
jne 0x423616
push 0x5b0e3c
jmp 0x42353b
push 0x5b0e58
jmp 0x423173