Function at 0x41cce0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0xbfa0]
mov eax, 0xc014
call fcn.0041d7b0
mov eax, dword [0x450970]
xor eax, ebp
mov dword [ebp + 0xbf9c], eax
mov eax, dword [ebp + 0xbfa8]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
call fcn.0041cbf8
and dword [ebp - 0x6c], 0
mov esi, 0x439440
lea eax, [ebp + 0x3f9c]
push esi
push eax
mov byte [ebp - 0x67], 0
mov byte [ebp - 0x68], 0
call fcn.0041dfba
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0041dfba
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x10
mov byte [ebp - 0x65], 0
mov esi, 0x2000
mov eax, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
cmp eax, 0x3c
jge 0x41d011
push 0x448fc4
push dword [ebp - 0x74]
mov byte [ebp - 0x66], 0
xor edi, edi
call fcn.0041f347
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
test eax, eax
je 0x41d011
push eax
jmp 0x41cfd0
lea eax, [ebp + eax*2 + 0x7f9a]
movzx ecx, word [eax]
cmp cx, 0xd
je 0x41cd95
cmp cx, 0xa
jne 0x41cdab
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041da4b
pop ecx
test eax, eax
jg 0x41cd7f
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041da4b
pop ecx
test eax, eax
jne 0x41cdc2
inc edi
jmp 0x41cfcd
lea eax, [ebp + 0x7f9c]
test edi, edi
jne 0x41cdd9
push eax
call fcn.0041cbb4
pop ecx
inc edi
jmp 0x41cfcd
cmp edi, 1
jne 0x41cedd
push str.force_reboot
push eax
call fcn.0041da65
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp - 0x68], al
jne 0x41ce15
lea eax, [ebp + 0x7f9c]
push str.reboot_deletion
push eax
call fcn.0041da65
pop ecx
pop ecx
mov byte [ebp - 0x65], 0
test eax, eax
jne 0x41ce19
mov byte [ebp - 0x65], 1
push dword [ebp - 0x70]
lea eax, [ebp + 0x7f9c]
push esi
push eax
call fcn.00422f3d
add esp, 0xc
test eax, eax
je 0x41ce84
mov edi, str.EOSMARKER
push edi
call fcn.0041da4b
push eax
lea eax, [ebp + 0x7f9c]
push edi
push eax
call fcn.0041da14
add esp, 0x10
test eax, eax
je 0x41cebe
cmp dword [ebp - 0x6c], 1
jne 0x41ce6b
lea eax, [ebp + 0x7f9c]
push eax
lea eax, [ebp + 0x3f9c]
push eax
call fcn.0041df8c
pop ecx
pop ecx
push dword [ebp - 0x70]
lea eax, [ebp + 0x7f9c]
push esi
push eax
call fcn.00422f3d
add esp, 0xc
test eax, eax
jne 0x41ce30
jmp 0x41cebe
mov edi, str.EOSMARKER
jmp 0x41cebe
push edi
call fcn.0041da4b
push eax
lea eax, [ebp + 0x7f9c]
push edi
push eax
call fcn.0041da14
add esp, 0x10
test eax, eax
je 0x41ced5
cmp dword [ebp - 0x6c], 1
jne 0x41cebe
lea eax, [ebp + 0x7f9c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0041df8c
pop ecx
pop ecx
push dword [ebp - 0x70]
lea eax, [ebp + 0x7f9c]
push esi
push eax
call fcn.00422f3d
add esp, 0xc
test eax, eax
jne 0x41ce8b
push 2
pop edi
jmp 0x41cfcd
push eax
cmp edi, 2
jne 0x41cf67
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41cfcd
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041cabb
pop ecx
test al, al
je 0x41cfcd
lea eax, [ebp + 0x7f9c]
push 0x448f6c
push eax
call fcn.0041e3ec
pop ecx
pop ecx
test eax, eax
je 0x41cf3c
lea eax, [ebp + 0x7f9c]
push str..tmp_dir
push eax
call fcn.0041e3ec
pop ecx
pop ecx
test eax, eax
jne 0x41cfc0
cmp dword [ebp - 0x6c], 0x3c
mov byte [ebp - 0x66], 1
jne 0x41cfcd
cmp byte [ebp - 0x65], 0
je 0x41cfcd
push 4
push 0
lea eax, [ebp + 0x7f9c]
push eax
call ebx
test eax, eax
je 0x41cfcd
mov byte [ebp - 0x67], 1
jmp 0x41cfcd
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x41cfcd
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041cabb
pop ecx
test al, al
je 0x41cfcd
lea eax, [ebp + 0x7f9c]
push 0x448f6c
push eax
call fcn.0041e3ec
pop ecx
pop ecx
test eax, eax
je 0x41cfb0
lea eax, [ebp + 0x7f9c]
push str..tmp_dir
push eax
call fcn.0041e3ec
pop ecx
pop ecx
test eax, eax
jne 0x41cfc0
cmp dword [ebp - 0x6c], 0x3c
mov byte [ebp - 0x66], 1
jne 0x41cfcd
cmp byte [ebp - 0x65], 0
je 0x41cfcd
push 4
push 0
lea eax, [ebp + 0x7f9c]
push eax
call ebx
push dword [ebp - 0x70]
lea eax, [ebp + 0x7f9c]
push esi
push eax
call fcn.00422f3d
add esp, 0xc
test eax, eax
jne 0x41cd9a
push dword [ebp - 0x70]
call fcn.0041f6b2
cmp byte [ebp - 0x66], 0
pop ecx
je 0x41d011
cmp dword [ebp - 0x6c], 0x3c
jge 0x41cd4a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41cd4a
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 0xbfac], 0
je 0x41d046
push esi
lea eax, [ebp + 0x7f9c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 0x65], 0
je 0x41d046
push 4
push 0
lea eax, [ebp + 0x7f9c]
push eax
call ebx
cmp byte [ebp - 0x68], 0
je 0x41d084
call fcn.0041cc6e
test al, al
jne 0x41d10e
lea eax, [ebp - 0x64]
push eax
call fcn.0041da4b
pop ecx
cmp eax, 5
jbe 0x41d10e
push 0x30
push 0x43bd54
lea eax, [ebp - 0x64]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41d10e
cmp byte [ebp - 0x67], 0
je 0x41d10e
lea eax, [ebp + 0x3f9c]
push eax
call fcn.0041da4b
pop ecx
cmp eax, 5
jbe 0x41d0e3
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x24
mov edi, 0x43bd54
push edi
lea eax, [ebp + 0x3f9c]
push eax
push 0
call esi
cmp eax, 6
jne 0x41d0e3
call fcn.0041cc6e
test al, al
jne 0x41d10e
lea eax, [ebp - 0x64]
push eax
call fcn.0041da4b
pop ecx
cmp eax, 5
jbe 0x41d10e
push 0x30
push edi
lea eax, [ebp - 0x64]
push eax
push 0
call esi
jmp 0x41d10e
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041cb5c
pop ecx
push 4
push 0
lea eax, [ebp + 0x7f9c]
push eax
call ebx
test eax, eax
je 0x41d10e
lea eax, [ebp + 0x7f9c]
push eax
call fcn.0041ca1c
pop ecx
mov ecx, dword [ebp + 0xbf9c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041d798
add ebp, 0xbfa0
leave
ret