Function at 0x41b5fc
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x42c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
lea edx, [ebp - 0x78]
push esi
push edi
mov edi, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], edi
mov ebx, eax
call fcn.0041bb15
mov esi, eax
mov dword [ebp - 0x7c], esi
test esi, esi
je 0x41b923
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push 7
push 0x10180
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x41b96f
push 0x34
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x30]
xor eax, eax
push 0xa
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x80]
lea eax, [ebp - 0x64]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x41b95e
push 0x28
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x41b95e
push 0x28
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], 0x2000
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x41b93b
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x70], ecx
mov byte [ebp - 0x65], 1
test eax, eax
je 0x41b7bd
cmp word [eax], cx
je 0x41b7bd
push 0x3a
pop ecx
cmp word [eax + 2], cx
jne 0x41b7bd
call fcn.0041b59a
test eax, eax
je 0x41b7bd
cmp dword [ebp - 0x3c], 1
jbe 0x41b7bd
push 0x10000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x70], ecx
test ecx, ecx
je 0x41b810
mov eax, dword [ebp - 0x78]
push 0x3a
mov ax, word [eax]
mov word [ecx], ax
pop eax
mov word [ecx + 2], ax
lea eax, [ecx + 4]
push eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x84]
push eax
xor eax, eax
mov dword [ebp - 0x84], 0x7ffc
push eax
push esi
mov esi, dword [0x42c44c]
mov ecx, esi
call dword [0x42d390]
call esi
mov esi, eax
mov dword [ebp - 0x88], esi
cmp esi, 0xffffffff
je 0x41b7ba
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x41b7ac
push dword [ebp - 0x74]
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0x7ffc
push eax
push esi
mov esi, dword [0x42c450]
mov ecx, esi
call dword [0x42d390]
call esi
mov esi, dword [ebp - 0x88]
test eax, eax
je 0x41b7b3
jmp 0x41b76a
mov dword [ebp - 0x80], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x7c]
push 0xd
push 1
lea eax, [ebp - 0x65]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x7c], eax
test eax, eax
jns 0x41b829
push 0x40
push 4
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 1
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x41b829
cmp eax, 0xc0000003
jne 0x41b805
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
jmp 0x41b82f
push 0x40a5d0
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0xc
jmp 0x41b7bd
xor eax, eax
inc eax
mov dword [ebp - 0x6c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x80], 0
je 0x41b8f7
mov ecx, dword [ebp - 0x70]
xor edx, edx
call fcn.0041bb15
push dword [ebp - 0x70]
mov edi, eax
push 0x40a640
push 0x4000000
push 0x42c454
call fcn.0041aebe
push edi
push 0x40a698
push 0x4000000
push 0x42c454
call fcn.0041aebe
add esp, 0x20
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push 7
push 0x100
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x74], ecx
cmp ecx, 0xffffffff
je 0x41b8e0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push 0x28
push eax
xor eax, eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
jne 0x41b8d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x40a700
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x41b8f7
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41b8f9
xor edi, edi
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x41b90f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x6c]
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a860
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x40a780
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
jmp 0x41b90f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x40a808
jmp 0x41b94a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x41b9ad
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41b912
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push esi
push 0x40a880
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
jmp 0x41b912
push ebx
push esi
push 0x40a8e0
jmp 0x41b996