Function at 0x420950
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58672e
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov ebx, ecx
push str.DeleteDriverFileStd
push 0
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x438], ebx
call fcn.0044ca70
add esp, 0xc
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x434], 1
call fcn.0055ca80
add esp, 0xc
test ebx, ebx
jne 0x4209f8
push ebx
push str.return___08x
lea ecx, [ebp - 0x454]
push 2
push ecx
call fcn.0044cd10
add esp, 0x10
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
xor eax, eax
jmp 0x4211d0
push 0x208
lea edx, [ebp - 0x420]
push 0
push edx
call fcn.0055ca80
mov ecx, dword [ebx + 8]
add esp, 0xc
lea edi, [ebp - 0x420]
call fcn.00421220
lea ecx, [ebp - 0x44c]
call fcn.0046c431
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 1
call fcn.0046c510
mov esi, dword [ebx + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
test eax, eax
je 0x420a71
lea ebx, [ebx]
mov eax, dword [ebp - 0x444]
push esi
push eax
lea ecx, [ebp - 0x44c]
call fcn.0046c98a
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
test eax, eax
jne 0x420a50
call fcn.00461e32
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x420a8b
push 0x80004005
call fcn.004025a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 2
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x420aac
xor eax, eax
jmp 0x420ac0
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420ab1
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004039c0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.005589fd
add esp, 8
test eax, eax
jne 0x420ae7
or ecx, 0xffffffff
jmp 0x420aed
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0040a1c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0046c900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420b43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x420b4e
xor eax, eax
jmp 0x420b62
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420b53
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004039c0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.005589fd
add esp, 8
test eax, eax
jne 0x420b89
or ecx, 0xffffffff
jmp 0x420b8f
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0040a1c0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0046c900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420be5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x18]
test edx, edx
jne 0x420bf0
xor eax, eax
jmp 0x420c04
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420bf5
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004039c0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.005589fd
add esp, 8
test eax, eax
jne 0x420c2b
or ecx, 0xffffffff
jmp 0x420c31
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0040a1c0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0046c900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x420c92
xor eax, eax
jmp 0x420ca6
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420c97
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004039c0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.005589fd
add esp, 8
test eax, eax
jne 0x420ccd
or ecx, 0xffffffff
jmp 0x420cd3
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0040a1c0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.0046c900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x428], 0
test ecx, ecx
jle 0x421170
mov eax, dword [ebp - 0x428]
test eax, eax
js 0x4211f1
cmp eax, ecx
jge 0x4211f1
mov ecx, dword [ebp - 0x448]
mov esi, dword [ecx + eax*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x420d86
cmp eax, dword [esi - 0x10]
jne 0x420d86
lea ebx, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x420dbe
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x4211ec
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.0055701e
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0x430], ebx
push 0x5c
push ebx
mov byte [ebp - 4], 7
call fcn.005589fd
add esp, 8
test eax, eax
jne 0x420ddf
or edi, 0xffffffff
jmp 0x420de5
sub eax, ebx
sar eax, 1
mov edi, eax
lea ecx, [ebp - 0x420]
push ecx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
mov eax, dword [ebx - 0xc]
jne 0x420e4d
sub eax, edi
push eax
lea edx, [ebp - 0x468]
push edx
lea ecx, [ebp - 0x430]
call fcn.0040a1c0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push 0x5b7940
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x420e97
sub eax, edi
push eax
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x430]
call fcn.0040a1c0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420ea3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x438]
push ecx
push ebx
call fcn.00421370
add esp, 8
test eax, eax
jne 0x42112f
push 0x20
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x434], eax
test eax, eax
jne case.0x420ef6.4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x1e
ja case.0x420ef6.4
movzx ecx, byte [eax + 0x421200]
jmp dword [ecx*4 + 0x4211f8]
mov dword [ebp - 0x434], 1
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
je 0x420f83
mov eax, dword [ebp - 0x438]
mov eax, dword [eax]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x430]
call fcn.0040a1c0
mov edx, dword [eax]
push edx
push esi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push 0x5bad90
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x420fe5
mov ecx, dword [ebp - 0x438]
mov eax, dword [ecx]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x430]
call fcn.0040a1c0
mov eax, dword [eax]
push eax
push esi
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push str._s_d_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420ff1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x20
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00403340
push 3
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 8
call fcn.0040a1c0
mov byte [ebp - 4], 9
mov ecx, dword [eax]
mov esi, dword [ebp - 0x42c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x4210a8
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x421098
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x421098
push eax
call fcn.00404900
mov dword [ebp - 0x46c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x421087
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x46c]
add ecx, 0x10
mov dword [ebp - 0x42c], ecx
jmp 0x4210a8
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.004039c0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4210ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x42c]
push 0x5ba180
push ecx
call fcn.00556d01
add esp, 8
test eax, eax
je 0x4210fe
mov edx, dword [ebp - 0x42c]
push 0x5ba188
push edx
call fcn.00556d01
add esp, 8
test eax, eax
jne 0x421109
lea ecx, [ebp - 0x218]
call fcn.0041c3c0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42112f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42114f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x428], eax
cmp eax, ecx
jl 0x420d41
mov esi, dword [ebp - 0x424]
mov edi, dword [ebp - 0x434]
push edi
push str.return___08x
lea ecx, [ebp - 0x454]
push 2
push ecx
call fcn.0044cd10
lea eax, [esi - 0x10]
add esp, 0x10
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4211ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0
call fcn.0046c766
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret
call fcn.00403b90
call fcn.004624e2
mov edi, edi
std
push cs
inc edx
add byte [edi], al
cmovb eax, dword [eax]
add byte [eax], al
add dword [eax], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add ah, cl