Function at 0x41a6c0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x41a6c8
push ecx
push ebx
push esi
mov ebx, 0x44eef8
mov esi, 0x44ef00
xor eax, eax
push ebp
push 0x41a9c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
push 0x41a9d0
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00408bfc
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x41a742
mov eax, dword [0x449bc8]
mov dword [eax], 0xffffffff
jmp 0x41a966
mov eax, dword [0x44cc44]
push eax
call fcn.0041a3e8
mov edx, eax
mov eax, dword [0x449bf0]
mov ecx, 0
call fcn.00405abc
push 0x41a9f0
lea eax, [ebp - 0x24]
push eax
call fcn.00419a5c
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00405974
jmp 0x41a782
mov eax, 0x3e8
call fcn.0041a1d8
mov eax, dword [ebx]
call fcn.0041a4b8
test al, al
je 0x41a778
mov eax, esi
mov ecx, 0x41aa14
mov edx, dword [ebx]
call fcn.00405ba8
push 0x41aa2c
lea eax, [ebp - 0x28]
push eax
call fcn.00419a5c
mov edx, dword [ebp - 0x28]
mov eax, 0x44ef04
call fcn.00405974
lea eax, [ebp - 0x2c]
mov edx, dword [esi]
call fcn.00405f94
mov eax, dword [ebp - 0x2c]
mov dl, 1
call fcn.00415388
test al, al
je 0x41a812
mov eax, dword [0x449bc8]
mov dword [eax], 0xffffffff
lea eax, [ebp - 0x30]
call fcn.0041a2f8
mov eax, dword [ebp - 0x30]
call fcn.00405d74
push eax
mov eax, dword [0x44ef04]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [0x44ef04]
call fcn.00405d74
push eax
mov eax, dword [esi]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
mov eax, esi
mov ecx, 0x41aa58
mov edx, dword [ebx]
call fcn.00405ba8
push 0x41aa74
lea eax, [ebp - 0x34]
push eax
call fcn.00419a5c
mov edx, dword [ebp - 0x34]
mov eax, 0x44ef04
call fcn.00405974
lea eax, [ebp - 0x38]
mov edx, dword [esi]
call fcn.00405f94
mov eax, dword [ebp - 0x38]
mov dl, 1
call fcn.00415388
test al, al
je 0x41a897
mov eax, dword [0x449bc8]
mov dword [eax], 0xffffffff
lea eax, [ebp - 0x3c]
call fcn.0041a2f8
mov eax, dword [ebp - 0x3c]
call fcn.00405d74
push eax
mov eax, dword [0x44ef04]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [0x44ef04]
call fcn.00405d74
push eax
mov eax, dword [esi]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
push dword [ebx]
push 0x41aaa4
lea edx, [ebp - 0x40]
mov eax, dword [0x449bf0]
mov eax, dword [eax]
call fcn.0041a0b4
push dword [ebp - 0x40]
mov eax, esi
mov edx, 3
call fcn.00405c2c
lea eax, [ebp - 0x44]
mov edx, dword [esi]
call fcn.00405f94
mov eax, dword [ebp - 0x44]
mov dl, 1
call fcn.00415388
test al, al
je 0x41a91c
mov eax, dword [0x449bc8]
mov dword [eax], 0xffffffff
lea eax, [ebp - 0x48]
call fcn.0041a2f8
mov eax, dword [ebp - 0x48]
call fcn.00405d74
push eax
mov eax, dword [0x449bf0]
mov eax, dword [eax]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [0x449bf0]
mov eax, dword [eax]
call fcn.00405d74
push eax
mov eax, dword [esi]
call fcn.00405d74
push eax
call sub.kernel32.dll_MoveFileA
push 0x41aab4
lea eax, [ebp - 0x4c]
push eax
call fcn.00419a5c
mov edx, dword [ebp - 0x4c]
mov eax, 0x44eefc
call fcn.00405974
mov eax, dword [0x449d48]
mov ecx, dword [0x44eefc]
mov edx, 0x2a600
call fcn.0041a618
mov eax, dword [0x44eefc]
call fcn.00419b54
mov eax, dword [0x44eefc]
call fcn.00405d74
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a9c7
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.0040564c
lea eax, [ebp - 0x44]
call fcn.004055bc
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0040564c
lea eax, [ebp - 0x38]
call fcn.004055bc
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0040564c
lea eax, [ebp - 0x2c]
call fcn.004055bc
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040564c
ret