Function at 0x427743
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac6f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x330
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x324], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRChrIA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x4277d5
xor eax, eax
jmp 0x427a5c
lea edx, [ebp - 0x118]
push edx
push 0x104
lea eax, [ebp - 0x324]
push eax
call fcn.00415480
push str.BFSDRV.sys
mov ecx, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.00415480
push str._bfsdll.dll
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
sub edx, eax
mov ecx, 0x104
sub ecx, edx
push ecx
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
sub edx, eax
lea ecx, [ebp + edx - 0x324]
push ecx
call fcn.00415480
mov byte [ebp - 0x220], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x118]
push edx
push 0x4c90ac
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.00403f10
add esp, 0x10
mov dword [ebp - 0x14], 0
push str..BypassFs
call fcn.0042d849
add esp, 4
test eax, eax
jne 0x42796a
mov dword [ebp - 4], 0
call fcn.0043ed70
mov dword [ebp - 0x334], eax
push 3
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp - 0x334]
call fcn.0043fa03
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jne 0x4278e0
mov dword [ebp - 4], 0xffffffff
jmp 0x427a1e
jmp 0x4278fd
mov dword [ebp - 4], 0xffffffff
push 3
push 1
push 3
push 0x4c90c4
lea edx, [ebp - 0x220]
push edx
call fcn.0042d389
add esp, 0x14
test eax, eax
jne 0x427927
jmp 0x427a1e
call fcn.0042d020
test eax, eax
je 0x427946
push 0x4c90cc
call fcn.0042d048
add esp, 4
test eax, eax
jne 0x427946
jmp 0x427a1e
call fcn.0042d50d
test eax, eax
jne 0x427954
jmp 0x427a1e
push 0x4c90d4
call fcn.0042d592
add esp, 4
test eax, eax
jne 0x42796a
jmp 0x427a1e
mov dword [ebp - 4], 2
call fcn.0043ed70
mov dword [ebp - 0x33c], eax
push 4
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x33c]
call fcn.0043fa03
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jne 0x4279a8
mov dword [ebp - 4], 0xffffffff
jmp 0x427a1e
jmp 0x4279c5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4279ea
jmp 0x427a1e
push 0
mov edx, dword [ebp - 0x328]
push edx
call fcn.004274b5
add esp, 8
test eax, eax
jne 0x427a01
jmp 0x427a1e
call dword [0x54b4f8]
test eax, eax
jne 0x427a0d
jmp 0x427a1e
mov dword [ebp - 0x14], 1
xor eax, eax
test eax, eax
jne 0x42788a
push 0x80
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4c90dc
call fcn.0042d2a4
add esp, 4
push str.BFSDRV
call fcn.0042d4b1
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret