Function at 0x41bb00
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x620024]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
push 0
push dword [0x62b89c]
mov di, dx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bb4e
mov eax, 0xfffffff4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
movzx eax, di
push eax
push esi
call fcn.0044c4c4
test eax, eax
jne 0x41bb76
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebp + 8], 0
mov edi, dword [ebp + 0xc]
je 0x41bb94
mov edx, edi
mov ecx, esi
call fcn.00417ee0
cmp byte [0x62b64e], 0
je 0x41bd31
test edi, edi
je 0x41bd31
mov ecx, esi
call fcn.00417d00
test al, al
jne 0x41bbcc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [esp + 0x10]
call fcn.00403880
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
test eax, eax
js 0x41bd54
cmp eax, edx
jg 0x41bd54
or edi, 0xffffffff
cmp word [ecx + eax*2], 0x5c
jne 0x41bc88
lea eax, [edx - 1]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00415fc0
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x41bc69
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x41bc5c
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x41bc5c
push edx
call fcn.00405670
add esp, 4
mov dword [esp + 0x10], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x41bc53
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [esp + 0xc], eax
jmp 0x41bc69
push dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.00402d30
mov edx, dword [esp + 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41bc84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
call fcn.00417b70
lea ecx, [esp + 0x1c]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bca0
sub ecx, edx
lea eax, [esp + 0x18]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402d30
mov eax, dword [esp + 0xc]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x41bd54
cmp ecx, edx
jg 0x41bd54
cmp word [eax + ecx*2], 0x5c
je 0x41bcf3
push 1
push 0x5f4568
lea ecx, [esp + 0x14]
call fcn.00405b30
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb esi, esi
mov eax, dword [esp + 0xc]
neg esi
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x41bd19
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi - 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00586281
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x22c]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.00586281
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403300
int3