Function at 0x4210b0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4d22ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
push ebx
push ebp
mov ebp, dword [esp + 0x2a8]
mov eax, dword [ebp + 0x40]
sub eax, dword [ebp + 0x3c]
push esi
push edi
lea edi, [ebp + 0x30]
mov byte [esp + 0x17], 0
mov dword [esp + 0x1c], 0
test eax, 0xfffffffc
jne 0x4210fd
mov eax, 2
jmp 0x4218dc
cmp dword [esp + 0x2bc], 1
jne 0x42112f
lea ebx, [ebp + 0xf0]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebx + 0x28]
sub esi, dword [ebx + 0x24]
push ebx
sar esi, 5
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x42112f
mov dword [esp + 0x2bc], esi
push ebp
mov dword [esp + 0x90], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x2c0]
xor ebx, ebx
mov dword [esp + 0x2a8], ebx
cmp esi, ebx
jne 0x4215ad
push 0x5f8
call fcn.0049e995
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x2a8], 1
cmp eax, ebx
je 0x42117e
push eax
call fcn.00410dd0
mov dword [esp + 0x18], eax
jmp 0x421184
mov dword [esp + 0x18], ebx
mov eax, ebx
mov dword [esp + 0x90], eax
cmp eax, ebx
je 0x42119b
add eax, 0x5d0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, edi
mov byte [esp + 0x2a8], 2
call fcn.00415d90
mov esi, dword [eax]
lea ebx, [esi + 0x508]
call fcn.00457040
mov ecx, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.0041f3b0
xor eax, eax
cmp byte [esp + 0x2c4], al
setne al
dec eax
and eax, dword [esp + 0x2bc]
sub eax, 0
je 0x4213e6
sub eax, 1
je 0x4212f0
sub eax, 1
jne 0x421563
mov ecx, dword [ebp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push eax
push 0x1032
push ecx
call ebx
mov ecx, dword [esp + 0x2b4]
lea edx, [esp + 0x17]
push edx
push 0x4ddf08
lea esi, [esp + 0x44]
call fcn.004116a0
push 0
push 0
mov byte [esp + 0x2b0], 7
mov eax, dword [ebp + 0x18]
push 0x1032
push eax
mov dword [esp + 0x30], 0
call ebx
mov ecx, dword [esp + 0x2b8]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
mov esi, ebp
call fcn.0048be10
test al, al
jne 0x421264
mov dword [esp + 0x1c], 3
jmp 0x421552
mov eax, dword [ebp + 0x18]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x421552
mov edi, edi
push esi
lea ecx, [esp + 0x2c]
mov eax, ebp
call fcn.00411670
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
mov byte [esp + 0x2ac], 8
mov eax, dword [esp + 0x1c]
push edx
push eax
lea edi, [esp + 0x34]
call fcn.00420fd0
test al, al
je 0x421539
cmp byte [esp + 0x17], 0
jne 0x421539
mov byte [esp + 0x2a8], 7
mov ecx, edi
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
mov ecx, dword [ebp + 0x18]
push 2
push esi
push 0x100c
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x421280
jmp 0x421552
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 0x28]
push ebp
call ebx
mov ecx, dword [esp + 0x2b4]
lea edx, [esp + 0x17]
push edx
mov eax, esi
push 0x4ddf08
lea esi, [esp + 0x44]
call fcn.004116a0
mov byte [esp + 0x2a8], 5
push ebp
mov dword [esp + 0x24], 0
call edi
mov esi, dword [ebp + 0x28]
push ebp
call ebx
mov eax, dword [esp + 0x2b8]
mov ecx, dword [esp + 0x18]
push esi
push eax
push ecx
mov esi, ebp
call fcn.0048be10
test al, al
jne 0x421360
mov dword [esp + 0x1c], 3
jmp 0x421552
push ebp
xor esi, esi
call edi
mov edi, dword [ebp + 0x28]
push ebp
call ebx
test edi, edi
jbe 0x421552
mov ebx, vtable.CEventRef.0
push esi
lea ecx, [esp + 0x2c]
mov eax, ebp
call fcn.00411670
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x40]
mov byte [esp + 0x2ac], 6
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edi, [esp + 0x34]
call fcn.00420fd0
test al, al
je 0x4213dd
cmp byte [esp + 0x17], 0
jne 0x4213dd
mov byte [esp + 0x2a8], 5
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.00405d80
push ebp
inc esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, edi
jb 0x421378
jmp 0x421552
mov dword [esp + 0x28], ebx
jmp 0x421541
lea edx, [esp + 0x17]
push edx
push ecx
push ebp
call fcn.00413ef0
mov ecx, dword [esp + 0x2bc]
add esp, 4
push 0x4ddf08
lea esi, [esp + 0x44]
call fcn.004116a0
mov byte [esp + 0x2a8], 3
xor ebx, ebx
push ebp
mov dword [esp + 0x24], ebx
call fcn.00413ef0
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2bc]
push eax
push ecx
mov esi, ebp
call fcn.0048be10
test al, al
jne 0x421444
mov dword [esp + 0x1c], 3
jmp 0x421552
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0xc]
mov dword [esp + 0x24], ebx
sar edx, 2
test edx, edx
jbe 0x421552
lea esp, [esp]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
sar eax, 2
cmp dword [esp + 0x24], eax
jb 0x421474
call fcn.0049f380
mov ecx, dword [edi + 0xc]
mov edx, dword [esp + 0x24]
mov ebx, dword [ecx + edx*4]
mov eax, ebx
xor esi, esi
call fcn.00410f30
test eax, eax
jbe 0x42151a
nop
mov eax, esi
lea ecx, [esp + 0x28]
mov edi, ebx
call fcn.0048d390
cmp dword [esp + 0x2bc], 0
mov byte [esp + 0x2a8], 4
je 0x4214ce
mov eax, dword [esp + 0x30]
cmp dword [eax + 8], 4
je 0x4214ce
lea ecx, [esp + 0x28]
push ecx
lea edx, [ebp + 0xf0]
push edx
call fcn.0040d7d0
test al, al
je 0x4214f1
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
push edx
lea edi, [esp + 0x34]
call fcn.00420fd0
test al, al
je 0x421539
cmp byte [esp + 0x17], 0
jne 0x421539
mov byte [esp + 0x2a8], 3
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
mov eax, ebx
inc esi
call fcn.00410f30
cmp esi, eax
jb 0x421490
mov ecx, dword [ebp + 0x40]
sub ecx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x24]
lea edi, [ebp + 0x30]
inc eax
sar ecx, 2
mov dword [esp + 0x24], eax
cmp eax, ecx
jb 0x421460
jmp 0x421552
mov dword [esp + 0x28], vtable.CEventRef.0
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 4
call fcn.00405d80
lea eax, [esp + 0x3c]
mov byte [esp + 0x2a8], 2
call fcn.00411790
mov edi, dword [esp + 0x18]
push edi
call fcn.0048d5f0
mov esi, 4
test al, al
je 0x42157a
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x2a8], 0
test edi, edi
je 0x4218b5
lea edx, [edi + 0x5d0]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, 2
jge 0x4218b5
push eax
mov ecx, edi
call fcn.0048c790
jmp 0x4218b5
mov eax, dword [esp + 0x2b8]
push str.wt__ccsutf_8
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], ebx
call fcn.0049fbe0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
jne 0x4215e4
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 3
jmp 0x4218dc
cmp esi, 1
jne 0x42166f
xor esi, esi
cmp dword [0x4fefec], ebx
jle 0x421657
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ecx]
mov eax, dword [esi*4 + 0x4feff0]
push 0x104
lea edx, [esp + 0x98]
push edx
push eax
mov eax, dword [0x4fe8b8]
push eax
call edi
cmp esi, ebx
jle 0x421630
mov ecx, dword [esp + 0x18]
push ecx
push 0x2c
call fcn.004a0be5
add esp, 8
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x94]
push edx
push str.__s_
push eax
call fcn.004a0940
inc esi
add esp, 0xc
cmp esi, dword [0x4fefec]
jl 0x421600
mov eax, dword [esp + 0x18]
push 0x4ddf80
push eax
call fcn.004a0940
add esp, 8
mov dword [esp + 0x24], 0x41f960
jmp 0x4216cf
push str.__xml_version_1.0__encoding_UTF_8____n
push eax
call fcn.004a0940
mov edi, dword [esp + 0x20]
add esp, 8
push 1
mov eax, str.procmon
call fcn.00449f70
mov edi, dword [esp + 0x18]
push 1
mov eax, str.processlist
call fcn.00449f70
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00420640
mov edi, dword [esp + 0x18]
push ebx
mov eax, str.processlist
call fcn.00449f70
mov edi, dword [esp + 0x18]
push 1
mov eax, str.eventlist
call fcn.00449f70
mov dword [esp + 0x24], 0x41fa40
lea edx, [esp + 0x3c]
push edx
call fcn.00429790
mov eax, dword [esp + 0x2bc]
sub eax, ebx
mov byte [esp + 0x2a8], 9
je 0x4219c3
sub eax, 1
je 0x4218f7
sub eax, 1
jne 0x4217e1
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push eax
mov eax, dword [ebp + 0x18]
push 0x1032
push eax
call ebx
lea ecx, [esp + 0x17]
push ecx
mov ecx, dword [esp + 0x2b8]
push 0x4ddf08
lea esi, [esp + 0x6c]
call fcn.004116a0
push 2
push 0xffffffffffffffff
mov byte [esp + 0x2b0], 0xe
mov edx, dword [ebp + 0x18]
push 0x100c
push edx
xor edi, edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4217d0
push esi
lea ecx, [esp + 0x2c]
mov eax, ebp
call fcn.00411670
mov eax, dword [esp + 0x2cc]
mov ecx, dword [esp + 0x2c8]
push eax
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x34]
mov byte [esp + 0x2b4], 0xf
mov ecx, dword [esp + 0x24]
push eax
push ecx
call dword [esp + 0x38]
test al, al
je 0x421abb
cmp byte [esp + 0x17], 0
jne 0x421abb
mov dword [esp + 0x68], edi
mov byte [esp + 0x2a8], 0xe
lea ecx, [esp + 0x28]
inc edi
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
mov edx, dword [ebp + 0x18]
push 2
push esi
push 0x100c
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x421753
lea eax, [esp + 0x64]
mov byte [esp + 0x2a8], 9
call fcn.00411790
cmp dword [esp + 0x2c0], 2
jne 0x421871
mov esi, dword [esp + 0x18]
push esi
push 0x3c
call fcn.004a0a5e
push esi
push 0x2f
call fcn.004a0a5e
add esp, 0x10
mov edi, str.eventlist
mov eax, 0x65
push esi
push eax
call fcn.004a0a5e
movzx eax, word [edi + 2]
add edi, 2
add esp, 8
test ax, ax
jne 0x421810
push esi
push 0x3e
call fcn.004a0a5e
mov esi, dword [esp + 0x20]
push esi
push 0x3c
call fcn.004a0a5e
push esi
push 0x2f
call fcn.004a0a5e
add esp, 0x18
mov edi, str.procmon
mov eax, 0x70
nop
push esi
push eax
call fcn.004a0a5e
movzx eax, word [edi + 2]
add edi, 2
add esp, 8
test ax, ax
jne 0x421850
push esi
push 0x3e
call fcn.004a0a5e
add esp, 8
mov edx, dword [esp + 0x18]
push edx
call fcn.004a0200
add esp, 4
cmp eax, 0xffffffff
jne 0x42188b
mov dword [esp + 0x1c], 4
lea esi, [esp + 0x3c]
mov byte [esp + 0x2a8], 0x10
call fcn.00429a00
mov byte [esp + 0x2a8], 0
mov eax, dword [esp + 0x3c]
push eax
call fcn.0049e96f
mov esi, dword [esp + 0x20]
add esp, 4
test esi, esi
je 0x4218c7
mov ecx, dword [esp + 0x2b8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esp + 0x17], 0
je 0x4218d3
mov esi, 1
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x2a0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x29c
ret 0x20
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
call ebx
mov esi, dword [ebp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x2b4]
lea eax, [esp + 0x17]
push eax
mov eax, esi
push 0x4ddf08
lea esi, [esp + 0x6c]
call fcn.004116a0
push ebp
mov byte [esp + 0x2ac], 0xc
xor esi, esi
call ebx
mov edi, dword [ebp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jbe 0x4217d0
push esi
lea ecx, [esp + 0x2c]
mov eax, ebp
call fcn.00411670
mov ecx, dword [esp + 0x2cc]
mov edx, dword [esp + 0x2c8]
push ecx
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2b4], 0xd
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [esp + 0x38]
test al, al
je 0x421abb
cmp byte [esp + 0x17], 0
jne 0x421abb
mov byte [esp + 0x2a8], 0xc
lea ecx, [esp + 0x28]
mov dword [esp + 0x68], esi
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
push ebp
inc esi
call ebx
mov edi, dword [ebp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, edi
jb 0x421945
jmp 0x4217d0
lea eax, [esp + 0x17]
push eax
push ecx
push ebp
call fcn.00413ef0
mov ecx, dword [esp + 0x2bc]
add esp, 4
push 0x4ddf08
lea esi, [esp + 0x6c]
call fcn.004116a0
mov byte [esp + 0x2a8], 0xa
mov ecx, dword [ebp + 0x40]
sub ecx, dword [ebp + 0x3c]
xor ebx, ebx
sar ecx, 2
mov dword [esp + 0x20], ebx
test ecx, ecx
jbe 0x4217d0
mov edx, dword [ebp + 0x40]
sub edx, dword [ebp + 0x3c]
sar edx, 2
cmp dword [esp + 0x20], edx
jb 0x421a1a
call fcn.0049f380
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
mov edi, dword [eax + ecx*4]
mov eax, edi
xor esi, esi
call fcn.00410f30
test eax, eax
jbe 0x421a9c
mov eax, esi
lea ecx, [esp + 0x28]
call fcn.0048d390
mov edx, dword [esp + 0x2cc]
mov eax, dword [esp + 0x2c8]
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x34]
mov byte [esp + 0x2b4], 0xb
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [esp + 0x38]
test al, al
je 0x421abb
cmp byte [esp + 0x17], 0
jne 0x421abb
mov dword [esp + 0x68], ebx
mov byte [esp + 0x2a8], 0xa
lea ecx, [esp + 0x28]
inc ebx
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
mov eax, edi
inc esi
call fcn.00410f30
cmp esi, eax
jb 0x421a31
mov ecx, dword [ebp + 0x40]
sub ecx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x20]
inc eax
sar ecx, 2
mov dword [esp + 0x20], eax
cmp eax, ecx
jb 0x421a06
jmp 0x4217d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x28], vtable.CEventRef.0
call fcn.00405d80
lea eax, [esp + 0x64]
mov byte [esp + 0x2a8], 9
call fcn.00411790
jmp 0x421871