Function at 0x494535
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push 0x10c
mov eax, 0x4bb6cd
call fcn.004701a5
mov byte [ebp - 0xbd], dl
mov ebx, ecx
push 0x80
push ebx
mov dword [ebp - 0xbc], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x494c25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xc4], esi
cmp esi, 2
je 0x494c25
cmp esi, 3
je 0x494c25
cmp byte [ebp - 0xbd], 0
je 0x4948dd
push ebx
push str.delete_on_reboot:__s
call fcn.004a35a8
pop ecx
pop ecx
cmp esi, 5
jne 0x4946de
and dword [ebp - 4], 0
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.004a5655
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea ecx, [ebp - 0xb8]
movsd dword es:[edi], dword [esi]
call fcn.0040afc8
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.004a5cbc
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0
call fcn.0040ade7
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xb8]
movsd dword es:[edi], dword [esi]
call fcn.0040afa6
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004a5cbc
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.0040ade7
or dword [ebp - 4], 0xffffffff
jmp 0x4946de
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4948d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push str.DING::CUtils::DeleteFileW_1101__:_MoveFileEx_failed_to_delete_file:__s___lu__r_n
mov dword [ebp - 0xc4], esi
call fcn.004a35be
add esp, 0xc
cmp esi, 5
jne 0x4948bf
mov edi, str.DumpSecurityInfo_is_not_supported
push edi
call fcn.004a35a8
pop ecx
lea ecx, [ebp - 0x58]
call fcn.00426a1a
mov dword [ebp - 4], 4
push ebx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.0040385b
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xbc]
cmp dword [eax - 4], 1
jle 0x494766
push dword [eax - 0xc]
lea ecx, [ebp - 0xbc]
call fcn.00402e02
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xbc]
call fcn.00402db7
push edi
call fcn.004a35a8
pop ecx
mov ecx, dword [ebp - 0xbc]
lea ecx, [ecx - 0x10]
call fcn.00402199
jmp 0x49481f
lea ecx, [ebp - 0x58]
call fcn.00426c16
lea ecx, [ebp - 0x58]
test al, al
je 0x4948ba
call fcn.00426a56
mov eax, 0x8007000e
jmp 0x494c27
call fcn.00426a56
test esi, esi
jle 0x4948cc
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x494c27
mov eax, 0x80070bc2
jmp 0x494c27
push esi
push ebx
push str.DING::CUtils::DeleteFileW_1129__:_failed_to_delete_file:__s___lu_
call fcn.004a35be
add esp, 0xc
cmp esi, 5
jne 0x494a2c
mov dword [ebp - 4], 8
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.004a5655
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea ecx, [ebp - 0xb8]
movsd dword es:[edi], dword [esi]
call fcn.0040afc8
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.004a5cbc
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 8
call fcn.0040ade7
mov eax, 0x1f01ff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x50eb70
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xb8]
movsd dword es:[edi], dword [esi]
call fcn.0040afa6
push eax
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
inc edx
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.004a5cbc
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.0040ade7
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xd4]
jmp 0x494a2c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4948bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x494c25
cmp eax, 3
je 0x494c25
cmp esi, 5
je 0x494a61
cmp eax, 5
jne 0x4948bf
mov edi, str.DumpSecurityInfo_is_not_supported
push edi
call fcn.004a35a8
pop ecx
lea ecx, [ebp - 0xf8]
call fcn.00426a1a
mov dword [ebp - 4], 0xc
push ebx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xd
call fcn.0040385b
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xbc]
cmp dword [eax - 4], 1
jle 0x494ab3
push dword [eax - 0xc]
lea ecx, [ebp - 0xbc]
call fcn.00402e02
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xbc]
call fcn.00402db7
push edi
call fcn.004a35a8
pop ecx
mov ecx, dword [ebp - 0xbc]
lea ecx, [ecx - 0x10]
call fcn.00402199
jmp 0x494b81
lea ecx, [ebp - 0xf8]
call fcn.00426c16
lea ecx, [ebp - 0xf8]
jmp 0x49482a
xor eax, eax
call fcn.004700f7
ret