Function at 0x44371d
Capabilities:
Delete directory
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x475280]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x44], 0xffffffff
mov eax, edx
mov dword [ebp - 0x68], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], esi
push edi
test eax, eax
je 0x443754
mov eax, dword [eax]
jmp 0x443757
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
lea edi, [ebp - 0x90]
xor eax, eax
mov dword [ebp - 0x5c], 1
mov word [ebp - 0x54], ax
xor ecx, ecx
stosd dword es:[edi], eax
push 0x34
push ecx
mov dword [ebp - 0x58], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x40], 0
lea edi, [ebp - 0x7c]
and dword [ebp - 0x50], 0
xor eax, eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x4c]
test byte [edi + 0x10], 0x10
je 0x443832
push 0
mov edx, esi
mov ecx, ebx
call fcn.0043ef0d
test eax, eax
jne 0x443832
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44382e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x44382e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x4437f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
jmp 0x4437f5
mov eax, 0x80004005
mov dword [ebp - 0x40], eax
mov edi, 0x408b64
test eax, eax
jns 0x443811
push eax
push 0x567
mov ecx, edi
call fcn.0043f87d
mov eax, dword [ebp - 0x40]
push 0x568
push edi
push eax
push 0x408b8c
push esi
push ebx
push 1
call fcn.00434d80
mov eax, dword [ebp - 0x40]
jmp 0x443c28
and dword [ebp - 0x5c], 0
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x78], esi
push eax
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x7c]
push 0
and eax, 0x210
mov ecx, ebx
push 4
or eax, 0x48000000
push eax
call fcn.004328a6
test eax, eax
jne 0x4438b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x44387b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443880
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x443896
push esi
push 0x579
mov ecx, edi
call fcn.0043f87d
push 0x57a
push edi
push esi
push 0x406e90
mov edi, dword [ebp - 0x3c]
push edi
push ebx
push 1
call fcn.00434d80
jmp 0x443b9f
mov edi, dword [ebp - 0x48]
cmp edi, 0xffffffff
jne 0x443981
lea eax, [ebp - 0x58]
xor edx, edx
push eax
mov ecx, ebx
call fcn.004369e5
mov edi, eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], edi
test eax, eax
jne 0x44391a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x4438f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x4438fd
mov esi, 0x80004005
test esi, esi
jns 0x443b9c
push esi
push 0x58a
mov ecx, 0x408b64
call fcn.0043f87d
jmp 0x443b9c
mov edx, dword [ebp - 0x4c]
push ecx
push eax
push edi
lea edx, [edx + 0x14]
mov ecx, ebx
call fcn.004405e6
test eax, eax
jne 0x44397a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x44394e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443953
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x443969
push esi
push 0x594
mov ecx, edi
call fcn.0043f87d
push 0x595
push edi
push esi
push 0x408bbc
jmp 0x4438a2
mov dword [ebp - 0x60], 1
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x4439dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x4439b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x4439b5
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x4439cb
push esi
push 0x5a2
mov ecx, edi
call fcn.0043f87d
push 0x5a3
push edi
push esi
push 0x408bec
jmp 0x4438a2
mov eax, dword [ebp - 0x14]
add eax, 8
mov word [ebp - 0x54], ax
movzx eax, ax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x40], ecx
test ecx, ecx
jne 0x443a4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443a22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443a27
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x443a3d
push esi
push 0x5ad
mov ecx, edi
call fcn.0043f87d
push 0x5ae
push edi
push esi
push 0x406a88
jmp 0x4438a2
mov edx, dword [ebp - 0x4c]
push 0
mov eax, dword [edx + 0x58]
mov dword [ecx], eax
mov ax, word [ebp - 0x14]
mov word [ecx + 4], ax
mov ax, word [edx + 0x5c]
lea edx, [ebp - 0x90]
mov word [ecx + 6], ax
movzx eax, word [ecx + 4]
push edx
lea edx, [ecx + 8]
mov ecx, edi
push eax
call fcn.0042a5c1
test eax, eax
jne 0x443ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443aa7
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x443abd
push esi
push 0x5bf
mov ecx, edi
call fcn.0043f87d
push 0x5c0
push edi
push esi
push 0x408c08
jmp 0x4438a2
lea eax, [ebp - 0x54]
xor edx, edx
push eax
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x40]
push esi
push eax
call fcn.0042e9c1
mov esi, eax
test esi, esi
jns 0x443afb
push esi
push 0x5c6
jmp 0x44390b
mov ecx, dword [ebp - 0x50]
test ecx, ecx
jne 0x443b0c
mov ecx, dword [ebp - 0x40]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x50], ecx
push 0
lea eax, [ebp - 0x64]
push eax
movzx eax, word [ebp - 0x54]
push 0
push 0
push eax
push ecx
push 0x900a4
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x443b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x443b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x443b53
mov esi, 0x80004005
mov edi, 0x408b64
test esi, esi
jns 0x443b69
push esi
push 0x5d8
mov ecx, edi
call fcn.0043f87d
push 0x5d9
push edi
push esi
push 0x408c60
jmp 0x4438a2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x68]
or eax, 0xffffffff
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x443b97
mov eax, dword [ebp - 0x44]
or dword [ebp - 0x44], 0xffffffff
mov dword [ecx], eax
xor esi, esi
and dword [ebp - 0x5c], esi
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
je 0x443bb4
cmp dword [ebp - 0x60], 0
je 0x443bb4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x443bd2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x44], 0xffffffff
je 0x443be1
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
test byte [eax + 0x10], 0x10
je 0x443bf7
cmp dword [ebp - 0x5c], 0
je 0x443bf7
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x443c0e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x50], 0
je 0x443c26
push dword [ebp - 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00471d10
leave
ret 8