Function at 0x42e5c0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xbe8
mov esi, esp
mov dword [esi + 0xbd0], ebp
mov dword [esi + 0xbd4], esp
mov dword [esi + 0xbe0], 0xffffffff
mov dword [esi + 0xbdc], 0x4369b0
mov ebx, ecx
mov edi, edx
lea ecx, [esi + 0xbd8]
mov eax, dword fs:[0]
mov dword [esi + 0xbd8], eax
mov dword fs:[0], ecx
lea ecx, [esi + 0x4c8]
push dword [ebp + 8]
call fcn.0042ce70
add esp, 4
cmp dword [esi + 0x4c8], 1
jne 0x42e639
movsd xmm0, qword [esi + 0x4cc]
movsd qword [ebx], xmm0
jmp 0x42ec8e
mov dword [esi + 0x1c], edi
lea eax, [esi + 0x4cc]
lea ecx, [esi + 0x728]
push 0x25c
push eax
push ecx
call fcn.00438b50
add esp, 0xc
mov dword [esi + 0xc], ebx
nop word [eax + eax]
lea ecx, [esi + 0x270]
lea edx, [esi + 0x728]
call fcn.004288e0
mov edi, dword [esi + 0x270]
cmp edi, 2
je 0x42ea73
mov eax, dword [esi + 0x274]
mov ebx, dword [esi + 0x278]
mov dword [esi + 4], eax
push 0x24c
lea eax, [esi + 0x27c]
push eax
lea eax, [esi + 0x984]
push eax
call fcn.00438b50
add esp, 0xc
push 0x24c
lea eax, [esi + 0x984]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.00438b50
add esp, 0xc
cmp edi, 1
je 0x42eaf9
mov edi, dword [esi + 4]
mov dword [esi + 0x274], ebx
mov dword [esi + 0x270], edi
push 0x24c
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x278]
push eax
call fcn.00438b50
add esp, 0xc
test ebx, 0x400
lea ecx, [esi + 0x20]
je 0x42e770
mov eax, dword [esi + 0x298]
mov edx, 0x20000000
and eax, edx
je 0x42e770
test bl, 0x10
je 0x42e779
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
lea edi, [esi + 0x2a0]
mov dword [esi + 4], eax
xor eax, eax
nop word cs:[eax + eax]
nop
lea edx, [esi + 0x4a8]
cmp edi, edx
je 0x42e8d2
movzx edx, word [edi]
add edi, 2
xor ebx, ebx
test dx, dx
setne bl
add eax, ebx
test dx, dx
jne 0x42e730
mov dword [esi + 0xbe0], 2
jmp 0x42e8d7
test bl, 0x10
jne 0x42e880
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
lea edi, [esi + 0x2a0]
mov dword [esi + 4], eax
xor eax, eax
nop dword [eax]
lea edx, [esi + 0x4a8]
cmp edi, edx
je 0x42e7c0
movzx edx, word [edi]
add edi, 2
xor ebx, ebx
test dx, dx
setne bl
add eax, ebx
test dx, dx
jne 0x42e790
mov dword [esi + 0xbe0], 2
jmp 0x42e7c5
mov eax, 0x104
mov dword [esi + 0xbe0], 2
lea edx, [esi + 0x2a0]
push eax
call fcn.00423870
add esp, 4
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 8]
mov dword [esi + 0xbe0], 7
lea ecx, [esi + 0x10]
push eax
mov dword [esi + 8], edi
push edi
push dword [esi + 4]
call fcn.00428e90
add esp, 0xc
cmp dword [esi + 0x24], 0
je 0x42e81a
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 8]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xbe0], 3
lea ecx, [esi + 0x20]
mov dword [esi + 4], edx
push eax
call fcn.004252a0
add esp, 4
cmp dword [esi + 0x20], 1
je 0x42e955
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
push ebx
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x42ea43
test edi, edi
je 0x42e961
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0x14], 0
mov ebx, dword [esi + 0xc]
jne 0x42e96a
jmp 0x42e97a
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x10]
lea edi, [esi + 0x2a0]
mov dword [esi + 4], eax
xor eax, eax
nop word cs:[eax + eax]
nop
lea edx, [esi + 0x4a8]
cmp edi, edx
je 0x42e999
movzx edx, word [edi]
add edi, 2
xor ebx, ebx
test dx, dx
setne bl
add eax, ebx
test dx, dx
jne 0x42e8a0
mov dword [esi + 0xbe0], 2
jmp 0x42e99e
mov eax, 0x104
mov dword [esi + 0xbe0], 2
lea edx, [esi + 0x2a0]
push eax
call fcn.00423870
add esp, 4
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 8]
mov dword [esi + 0xbe0], 6
lea ecx, [esi + 0x10]
push eax
mov dword [esi + 8], edi
push edi
push dword [esi + 4]
call fcn.00428e90
add esp, 0xc
cmp dword [esi + 0x24], 0
je 0x42e92c
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 8]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xbe0], 4
lea ecx, [esi + 0x20]
mov dword [esi + 4], edx
push eax
call fcn.004252a0
add esp, 4
cmp dword [esi + 0x20], 1
jne 0x42ea2f
mov edx, dword [esi + 0x24]
cmp dl, 3
jne 0x42eb06
cmp dword [esi + 0x14], 0
mov ebx, dword [esi + 0xc]
je 0x42e97a
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x270]
lock dec dword [eax]
jne 0x42e660
lea ecx, [esi + 0x270]
call fcn.0042ee20
jmp 0x42e660
mov eax, 0x104
mov dword [esi + 0xbe0], 2
lea edx, [esi + 0x2a0]
push eax
call fcn.00423870
add esp, 4
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 8]
mov dword [esi + 0xbe0], 8
lea ecx, [esi + 0x10]
push eax
mov dword [esi + 8], edi
push edi
push dword [esi + 4]
call fcn.00428e90
add esp, 0xc
cmp dword [esi + 0x24], 0
je 0x42e9f3
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 8]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov dword [esi + 0xbe0], 5
lea ecx, [esi + 0x20]
mov dword [esi + 4], edx
push eax
call fcn.0042e5c0
add esp, 4
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 0xc]
cmp al, 3
jne 0x42ebe4
cmp dword [esi + 0x14], 0
jne 0x42e96a
jmp 0x42e97a
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
push ebx
call sub.KERNEL32.dll_RemoveDirectoryW
test eax, eax
jne 0x42e857
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
shl eax, 0x18
shr ecx, 8
test edi, edi
mov dword [esi + 8], ecx
je 0x42ea69
mov edi, eax
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, edi
mov edi, dword [esi + 8]
xor edx, edx
jmp 0x42eb14
push dword [esi + 0x728]
call sub.KERNEL32.dll_FindClose
mov eax, dword [esi + 0x72c]
lock dec dword [eax]
mov edi, dword [esi + 0x1c]
jne 0x42ea97
lea ecx, [esi + 0x72c]
call fcn.0042ee20
cmp dword [esi + 0x4c8], 0
je 0x42ec1f
cmp byte [esi + 0x4cc], 2
jb 0x42ec1f
mov ecx, dword [esi + 0x4d0]
mov eax, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0xbe0], 1
push eax
call dword [ecx]
add esp, 4
mov edi, dword [esi + 4]
mov ebx, dword [esi + 0xc]
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x42ec0e
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x42ebfb
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x42ec03
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov dword [eax + 4], ebx
jmp 0x42eb54
mov ecx, dword [esi + 0x28]
mov eax, edx
mov edi, ecx
shrd eax, ecx, 8
shr edi, 8
mov ecx, dword [esi + 0xc]
shld edi, eax, 8
shl eax, 8
movzx edx, dl
or edx, eax
mov dword [ecx + 4], edi
mov dword [ecx], edx
cmp dword [esi + 0x14], 0
je 0x42eb3e
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x270]
lock dec dword [eax]
jne 0x42eb54
lea ecx, [esi + 0x270]
call fcn.0042ee20
push dword [esi + 0x728]
call sub.KERNEL32.dll_FindClose
mov eax, dword [esi + 0x72c]
lock dec dword [eax]
jne 0x42eb75
lea ecx, [esi + 0x72c]
call fcn.0042ee20
cmp dword [esi + 0x4c8], 0
je 0x42ec8e
cmp byte [esi + 0x4cc], 2
jb 0x42ec8e
mov ecx, dword [esi + 0x4d0]
mov eax, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0xbe0], 0
push eax
call dword [ecx]
add esp, 4
mov ebx, dword [esi + 4]
mov eax, dword [ebx + 4]
cmp dword [eax + 4], 0
je 0x42ebd9
mov edi, dword [ebx]
cmp dword [eax + 8], 9
jae 0x42ebc9
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x42ebd1
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetProcessHeap
push ebx
jmp 0x42ec86
mov ecx, dword [esi + 0x24]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
cmp dword [esi + 0x14], 0
jne 0x42eb2e
jmp 0x42eb3e
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 4]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 0x1c]
mov dword [esi + 0xbe0], 0xffffffff
lea ecx, [esi + 0x4c8]
mov edx, edi
push dword [ebp + 8]
call fcn.004252a0
add esp, 4
cmp dword [esi + 0x4c8], 1
je 0x42e628
mov edi, dword [esi + 0x4cc]
mov ebx, dword [esi + 0x4d0]
push edi
call sub.KERNEL32.dll_RemoveDirectoryW
test eax, eax
je 0x42ec6b
mov eax, dword [esi + 0xc]
mov byte [eax], 3
test ebx, ebx
jne 0x42ec80
jmp 0x42ec8e
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esi + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx], 0
test ebx, ebx
je 0x42ec8e
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0xbd8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret