Function at 0x41e4d0
Capabilities:
Delete file
Get file attributes
Get file size
Move file
Set file attributes
Timestomp file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b1cb3
push eax
mov dword fs:[0], esp
sub esp, 0x160
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
call fcn.0041b3f0
mov eax, dword [esp + 0x184]
add esp, 4
cmp eax, ebx
je 0x41efa9
cmp word [eax], bx
je 0x41efa9
mov ebp, dword [esp + 0x184]
cmp ebp, ebx
je 0x41efa9
cmp word [ebp], bx
je 0x41efa9
cmp dword [0x4f5fdc], ebx
jne 0x41e53f
push 0x1fd3
push 2
jmp 0x41efb0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
test al, 0x10
mov dword [esp + 0x80], eax
je 0x41e55f
push 0x1fdb
push 0x1d
jmp 0x41efb0
push ebp
call esi
or ecx, 0xffffffff
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x41e57d
test al, 0x10
je 0x41e57d
push 0x1fe5
push 0x1e
jmp 0x41efb0
mov edx, dword [0x4bc794]
mov eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x194]
mov dword [esp + 0x178], ebx
cmp edx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x60], ebx
je 0x41e5c5
mov edx, dword [esp + 0x198]
mov dword [esp + 0x24], eax
cmp edx, ebx
jne 0x41e5c9
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x14], ecx
jne 0x41e5d3
mov dword [esp + 0x24], ebx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xa9]
mov byte [esp + 0xa8], bl
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x1a8]
stosw word es:[edi], ax
cmp esi, ebx
stosb byte es:[edi], al
je 0x41e600
cmp dword [esi], ebx
je 0x41e600
xor eax, eax
jmp 0x41e605
mov eax, 1
push eax
lea eax, [esp + 0xac]
push eax
call fcn.0041dfb0
add esp, 8
test eax, eax
jne 0x41e642
push 0x2003
push 7
call fcn.0041b3d0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x178], 0xffffffff
call fcn.00447cd0
jmp 0x41efb8
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x124]
mov dword [esp + 0x120], ebx
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
call fcn.0044ae30
lea ecx, [esp + 0x68]
mov byte [esp + 0x178], 1
call fcn.0044ae30
lea ecx, [esp + 0x30]
mov byte [esp + 0x178], 2
call fcn.0044ae30
mov eax, dword [esp + 0x18c]
mov byte [esp + 0x178], 3
cmp eax, ebx
mov dword [esp + 0x6c], ebx
je 0x41e6cf
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.00421350
add esp, 8
cmp eax, ebx
je 0x41e6cf
lea ecx, [esp + 0x30]
call fcn.0044b330
mov dword [esp + 0x6c], eax
lea ecx, [esp + 0x34]
call fcn.0044ae30
cmp esi, ebx
mov byte [esp + 0x178], 4
mov dword [esp + 0x74], ebx
je 0x41e715
mov edx, dword [esi]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x3c]
call fcn.0044afa0
lea ecx, [esp + 0x34]
call fcn.0044b340
mov ecx, dword [esi]
mov dword [esp + 0x74], eax
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x180]
push esi
call fcn.004135c0
add esp, 4
cmp eax, ebx
jne 0x41ec3f
mov ecx, dword [esp + 0x1a0]
mov eax, 5
cmp ecx, ebx
je 0x41e742
mov eax, 7
push ebx
push 0x80
push 3
push ebx
push eax
push SysReAllocStringLen
push esi
call fcn.00429640
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
mov dword [esp + 0x40], ebp
je 0x41ee80
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
call fcn.0041b900
add esp, 0x20
test eax, eax
jne 0x41ee94
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
mov esi, ecx
cmp esi, ebx
je 0x41e859
mov ecx, 8
lea edi, [esp + 0x88]
mov dword [esp + 0x84], ebx
lea edx, [esp + 0x84]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x184]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x41e83b
cmp dword [esp + 0xa4], ebx
jne 0x41e7d9
cmp dword [esp + 0xa0], ebx
je 0x41e83b
mov ecx, dword [0x4f650c]
mov edi, dword [esp + 0x184]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x4e1afc
push edi
call fcn.00429330
add esp, 0x10
test eax, eax
je 0x41e82a
mov eax, dword [esp + 0x10]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x41e819
mov dword [esp + 0x20], 1
jmp 0x41e842
push 0x208a
push 0x28
call fcn.0041b3d0
add esp, 8
jmp 0x41e842
push 0x2091
push 0x24
call fcn.0041b3d0
add esp, 8
jmp 0x41e842
mov edi, dword [esp + 0x184]
test byte [esp + 0x14], 1
je 0x41e860
mov eax, dword [esp + 0x14]
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x41e860
mov edi, dword [esp + 0x184]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push edi
call fcn.00429640
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [esp + 0x50], eax
je 0x41eea5
cmp esi, ebx
je 0x41e895
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x41e89d
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x54]
call fcn.0044ae30
lea ecx, [esp + 0x44]
mov byte [esp + 0x178], 5
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
call fcn.0044ae30
lea ecx, [esp + 0x4c]
mov byte [esp + 0x178], 6
call fcn.0044ae30
lea ecx, [esp + 0x3c]
mov byte [esp + 0x178], 7
mov dword [esp + 0x64], ebx
mov dword [esp + 0x5c], ebx
call fcn.0044ae30
cmp esi, ebx
mov byte [esp + 0x178], 8
mov ebp, 1
je 0x41ead9
mov eax, dword [esp + 0x20]
or esi, 0xffffffff
or edi, 0xffffffff
cmp eax, ebx
je 0x41e96f
mov ecx, dword [esp + 0x10]
push ebx
push 0x80
push 4
push ebx
push 7
push SysReAllocStringLen
push ecx
call fcn.00429640
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x41e973
cmp dword [esp + 0x24], ebx
je 0x41e96b
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
jne 0x41e950
cmp dword [esp + 0x14], ebx
je 0x41e967
cmp dword [esp + 0x194], 1
jne 0x41e96b
push edi
call fcn.00413320
add esp, 4
test eax, eax
je 0x41e96b
mov dword [esp + 0x24], ebx
mov esi, edi
jmp 0x41e973
mov esi, dword [esp + 0x50]
cmp dword [esp + 0x188], ebx
jne 0x41eacd
cmp esi, 0xffffffff
je 0x41eacd
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x64]
push eax
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x64]
push ecx
lea eax, [esp + 0xfc]
push edx
lea ecx, [esp + 0x138]
push eax
lea edx, [esp + 0xc4]
push ecx
push edx
push esi
call fcn.00421a20
add esp, 0x28
test eax, eax
je 0x41eacd
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x58]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push ebx
push 1
push edx
lea ecx, [esp + 0xbc]
push eax
push ecx
push esi
mov dword [esp + 0x34], ebx
call fcn.004211f0
add esp, 0x20
test eax, eax
je 0x41ea02
xor ebp, ebp
cmp dword [esp + 0x6c], ebx
jne 0x41ea4c
test byte [esp + 0xcc], 8
je 0x41ea4c
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x30]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x3c]
push eax
push 1
push 3
push ecx
lea eax, [esp + 0xbc]
push edx
push eax
push esi
mov dword [esp + 0x34], ebx
call fcn.004211f0
add esp, 0x20
test eax, eax
je 0x41ea4c
lea ecx, [esp + 0x30]
call fcn.0044b330
cmp dword [esp + 0x74], ebx
jne 0x41ea98
mov eax, dword [esp + 0xcc]
test ah, 1
je 0x41ea98
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push 2
push 4
push eax
lea edx, [esp + 0xbc]
push ecx
push edx
push esi
mov dword [esp + 0x34], ebx
call fcn.004211f0
add esp, 0x20
test eax, eax
je 0x41ea98
lea ecx, [esp + 0x34]
call fcn.0044b330
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x64]
lea eax, [esp + 0x3c]
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x50]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
push esi
call fcn.00423bf0
lea eax, [esp + 0xc8]
push eax
call fcn.0041e040
add esp, 0x24
cmp edi, 0xffffffff
je 0x41ead9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esp + 0xf2], bx
jne 0x41eeb6
lea ecx, [esp + 0x68]
push ebp
lea edx, [esp + 0x5c]
push ecx
lea eax, [esp + 0x128]
push edx
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.0041e0d0
add esp, 0x14
test eax, eax
je 0x41eebf
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x3c]
mov edi, dword [esp + 0x50]
push edx
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
lea edx, [esp + 0x48]
push ecx
lea eax, [esp + 0x94]
mov esi, dword [esp + 0x58]
push edx
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x88]
push ecx
lea eax, [esp + 0x7c]
push edx
lea ecx, [esp + 0x110]
push eax
lea edx, [esp + 0x14c]
push ecx
lea eax, [esp + 0xd8]
push edx
push eax
push edi
push esi
mov dword [esp + 0xbc], ebx
call fcn.0041efe0
mov ecx, dword [esp + 0xbc]
add esp, 0x40
cmp ecx, ebx
je 0x41eb99
cmp dword [esp + 0x1c], ebx
jne 0x41eb99
mov dword [esp + 0x1c], 1
cmp eax, ebx
je 0x41eece
test byte [esp + 0x19c], 1
je 0x41ebf8
lea ecx, [esp + 0x74]
lea edx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test byte [esp + 0x19c], 4
je 0x41ec15
lea ecx, [esp + 0x60]
lea edx, [esp + 0x48]
push ecx
push edx
push esi
call fcn.00428e80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1a4]
mov dword [esp + 0x40], 0xffffffff
cmp eax, ebx
je 0x41ec36
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esp + 0x28], ebx
jmp 0x41eece
mov edx, dword [esp + 0x14]
xor eax, eax
cmp edx, 0xffffffff
setne al
cmp eax, ebx
je 0x41eced
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x88]
mov dword [esp + 0x84], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x84]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x41ece1
cmp dword [esp + 0xa4], ebx
jne 0x41ec90
cmp dword [esp + 0xa0], ebx
je 0x41ece1
mov ecx, dword [0x4f650c]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x4e1afc
push ebp
call fcn.00429330
add esp, 0x10
test eax, eax
je 0x41ecd2
mov eax, dword [esp + 0x10]
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x41ecc9
mov dword [esp + 0x20], 1
jmp 0x41ece1
push 0x2039
push 0x28
jmp 0x41ecd9
push 0x2040
push 0x24
call fcn.0041b3d0
add esp, 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
je 0x41ecf5
mov dword [esp + 0x1c], 1
test byte [esp + 0x19c], 4
je 0x41ed19
mov eax, dword [esp + 0x180]
lea ecx, [esp + 0x60]
lea edx, [esp + 0x48]
push ecx
push edx
push eax
call fcn.00429050
add esp, 0xc
mov ecx, dword [esp + 0x1a4]
mov edx, dword [esp + 0x180]
push ecx
push 0xffffffffffffffff
push ebx
push ebp
push edx
call fcn.00412440
add esp, 0x14
test eax, eax
je 0x41eda3
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x41ed5b
mov edx, dword [esp + 0x60]
push edx
push eax
mov eax, dword [esp + 0x18c]
push eax
call fcn.00429100
add esp, 0xc
test byte [esp + 0x19c], 2
je 0x41ed7b
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x184]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esp + 0x20], ebx
je 0x41ee0b
cmp dword [esp + 0x24], ebx
je 0x41ef84
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x198]
push 0x103
push eax
push ecx
jmp 0x41ee03
push 0x2054
push 0x24
call fcn.0041b3d0
add esp, 8
cmp dword [esp + 0x1c], ebx
je 0x41edc6
mov ecx, dword [esp + 0x184]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x20], ebx
je 0x41ee0b
mov edx, dword [esp + 0x184]
mov eax, dword [esp + 0x10]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41ee0b
mov eax, dword [esp + 0x190]
mov dword [esp + 0x28], 0xffffffff
cmp eax, ebx
je 0x41ee0b
mov ecx, dword [esp + 0x10]
push 0x103
push ecx
push eax
call fcn.00438675
add esp, 0xc
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x41ee20
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x178], 3
call fcn.0044af00
lea ecx, [esp + 0x30]
mov byte [esp + 0x178], 2
call fcn.0044af00
lea ecx, [esp + 0x68]
mov byte [esp + 0x178], 1
call fcn.0044af00
lea ecx, [esp + 0x58]
mov byte [esp + 0x178], bl
call fcn.0044af00
lea ecx, [esp + 0x10]
mov dword [esp + 0x178], 0xffffffff
call fcn.00447cd0
mov eax, dword [esp + 0x28]
jmp 0x41efbd
push 0x206c
push 3
call fcn.0041b3d0
add esp, 8
jmp 0x41ee0b
push 0x2073
push 0x2a
call fcn.0041b3d0
add esp, 8
jmp 0x41ef16
push 0x20a7
push 4
call fcn.0041b3d0
add esp, 8
jmp 0x41ef16
push 0x2116
push 1
jmp 0x41eec6
push 0x211e
push 8
call fcn.0041b3d0
add esp, 8
lea ecx, [esp + 0x3c]
mov byte [esp + 0x178], 7
call fcn.0044af00
lea ecx, [esp + 0x4c]
mov byte [esp + 0x178], 6
call fcn.0044af00
lea ecx, [esp + 0x44]
mov byte [esp + 0x178], 5
call fcn.0044af00
lea ecx, [esp + 0x54]
mov byte [esp + 0x178], 4
call fcn.0044af00
mov ebp, dword [esp + 0x40]
cmp ebp, 0xffffffff
je 0x41ef22
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
je 0x41ef32
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], ebx
jne 0x41edb2
cmp dword [0x4f6508], ebx
je 0x41ed3d
mov ecx, dword [esp + 0x184]
lea eax, [esp + 0x120]
push eax
push ecx
call fcn.00420010
add esp, 8
test eax, eax
jne 0x41ed3d
push 0x2153
push 0x1c
call fcn.0041b3d0
add esp, 8
mov dword [esp + 0x28], 0xffffffff
jmp 0x41edb2
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41ee0b
mov eax, dword [esp + 0x10]
push eax
call fcn.00429150
add esp, 4
jmp 0x41ee0b
push 0x1fcd
push 1
call fcn.0041b3d0
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x16c
ret