Function at 0x4248c8
Capabilities:
Delete file
Move file
Print debug messages
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
push edi
mov dword [ebp - 0x628], ecx
cmp dword [ebp + 0x10], 0
je 0x4248f5
mov eax, dword [ebp + 8]
push eax
call fcn.00464260
add esp, 4
test eax, eax
je 0x4248f5
xor eax, eax
jmp 0x424ce5
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push str.TFW_333__s
push 0x400
lea edx, [ebp - 0x400]
push edx
call fcn.0040a150
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.0047d177
add esp, 4
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x62c], edx
mov eax, dword [ebp - 0x62c]
sub eax, 1
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0x73
ja case.0x424977.6
mov edx, dword [ebp - 0x62c]
xor ecx, ecx
mov cl, byte [edx + 0x424d08]
jmp dword [ecx*4 + 0x424cec]
push str.CForceKill::KillFileClass___SCAN_FOUND_or_AVE_ENGINE_SCAN_FOUND_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x628]
call fcn.00424d7c
jmp 0x424ce5
push str.CForceKill::KillFileClass___MOVEFILE_REBOOT_or_AVE_ENGINE_MOVEFILE_REBOOT_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.00445886
mov ecx, eax
call fcn.00445ad0
mov dword [0x53e6b4], 1
mov eax, 1
jmp 0x424ce5
push str.CForceKill::KillFileClass___FORCE_KILLSYS_or_AVE_ENGINE_FORCE_KILLSYS_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00445886
mov ecx, eax
call fcn.00445ad0
mov eax, 1
jmp 0x424ce5
push str.CForceKill::KillFileClass___FORCE_KILLDENY_or_AVE_ENGINE_FORCE_KILLDENY_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00445886
mov ecx, eax
call fcn.00445ad0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x404], eax
push 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00445886
mov ecx, eax
call fcn.00445ad0
cmp dword [ebp - 0x404], 0xffffffff
je 0x424ba0
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
push 4
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x424acd
push 8
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x424acd
jmp 0x424b72
push 3
push 0
push 0
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x424b51
mov byte [ebp - 0x518], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x517]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x14e
push 0x4c7814
push 0x104
lea edx, [ebp - 0x518]
push edx
call fcn.00403d80
add esp, 0x14
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x424b72
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x40c], 1
xor edx, edx
test edx, edx
jne 0x424a8f
cmp dword [ebp - 0x40c], 0
jne 0x424b9e
cmp dword [ebp - 0x408], 0
je 0x424b91
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x424beb
mov byte [ebp - 0x61c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x61b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x165
push str._d_error_code_is__d__n
push 0x104
lea edx, [ebp - 0x61c]
push edx
call fcn.00403d80
add esp, 0x14
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042ab25
add esp, 4
mov eax, 1
jmp 0x424ce5
push str.CForceKill::KillFileClass___SCAN_DEL_REG_or_AVE_ENGINE_SCAN_DEL_REG_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x628]
call fcn.0042487b
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042ab25
add esp, 4
call fcn.0041ced0
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x624], 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x620]
call fcn.0041ecc0
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
je 0x424c84
push 0
mov eax, dword [ebp - 0x624]
push eax
mov ecx, dword [ebp - 0x620]
call fcn.0041d34e
jmp 0x424c4e
mov eax, 1
jmp 0x424ce5
push str.CForceKill::KillFileClass___FORCE_KIILHANDLE_or_AVE_ENGINE_FORCE_KIILHANDLE_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00437c66
add esp, 8
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x628]
call fcn.0042487b
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042ab25
add esp, 4
mov eax, 1
jmp 0x424ce5
push str.CForceKill::KillFileClass___default_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc