Function at 0x41eff0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57f798
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xf690]
cmp dword [edi + 0x5c], 0xffffffff
je 0x41f406
mov eax, dword [esp + 0x438]
xor ebp, ebp
cmp eax, ebp
je 0x41f071
mov eax, dword [edi + 0x30]
push ebp
cdq
add eax, 0xb6109100
push 0x989680
adc edx, 2
push edx
push eax
call fcn.00550e60
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [edi + 8], ebp
jne 0x41f05c
test dword [edi + 0x30], 0xffffff00
je 0x41f071
mov edx, dword [edi + 0x5c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esi + 0xf690]
mov ecx, dword [eax + 0x48]
mov edi, dword [eax + 0x78]
mov edx, dword [eax + 0x4c]
add edi, ecx
mov dword [eax + 0x78], edi
mov ecx, dword [eax + 0x7c]
adc ecx, edx
mov dword [eax + 0x7c], ecx
mov eax, dword [esi + 0xf690]
mov ecx, dword [eax + 0x48]
mov edi, dword [eax + 0x70]
mov edx, dword [eax + 0x4c]
add edi, ecx
mov dword [eax + 0x70], edi
mov edi, dword [eax + 0x74]
adc edi, edx
mov dword [eax + 0x74], edi
mov eax, dword [esi + 0xf690]
mov ecx, dword [eax + 0x88]
inc ecx
mov dword [eax + 0x88], ecx
mov eax, dword [esi + 0xf690]
mov edi, dword [eax + 0x8c]
inc edi
mov dword [eax + 0x8c], edi
mov eax, dword [esi + 0xf690]
mov dword [eax + 0x50], ebp
mov dword [eax + 0x54], ebp
mov ecx, dword [esi + 0xf690]
mov dword [ecx + 0x48], ebp
mov dword [ecx + 0x4c], ebp
mov edx, dword [esi + 0xf690]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0xf690]
mov dword [ecx + 0x5c], 0xffffffff
mov eax, dword [esi + 0xf690]
mov ecx, dword [eax + 8]
lea edx, [eax + 0x198]
cmp ecx, ebp
jne 0x41f11d
lea edx, [eax + 0x94]
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
je 0x41f128
mov eax, ecx
jmp 0x41f12b
mov eax, dword [eax + 0x20]
push eax
push edx
lea edx, [esp + 0x30]
push edx
call fcn.0043a910
add esp, 0xc
cmp eax, 0x104
jl 0x41f15a
push ebp
lea eax, [esp + 0x2c]
push 0x5e96e0
push eax
mov ecx, esi
call fcn.0056a944
xor eax, eax
jmp 0x41f40b
mov eax, dword [esi + 0xf690]
add eax, 0x10
mov ecx, dword [eax + 0xc]
cmp ecx, ebp
je 0x41f16e
mov eax, ecx
jmp 0x41f171
mov eax, dword [eax + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0043a890
add esp, 8
test eax, eax
jne 0x41f19c
push ebp
lea edx, [esp + 0x2c]
push 0x5e96d0
push edx
mov ecx, esi
call fcn.0056a944
xor eax, eax
jmp 0x41f40b
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
call fcn.0056877a
push 0x5e96c8
lea ecx, [esp + 0x14]
mov dword [esp + 0x434], ebp
call fcn.00568ae8
mov eax, dword [esi + 0xf690]
mov ecx, dword [eax + 0x90]
cmp ecx, 8
je 0x41f1e3
cmp ecx, 7
je 0x41f1e3
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
or ecx, edx
jne 0x41f3f2
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00550e32
add esp, 8
test eax, eax
je 0x41f3f2
mov ecx, dword [0x5f9f88]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x28]
lea eax, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x438], 1
call fcn.004cd470
add esp, 8
mov eax, dword [esi + 0xf690]
mov byte [esp + 0x430], 2
add eax, 0x10
mov ecx, dword [eax + 0xc]
cmp ecx, ebp
je 0x41f248
mov eax, ecx
jmp 0x41f24b
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 0x24]
call fcn.0056877a
lea ecx, [esp + 0x24]
push 0x5e96c0
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x43c], 3
call fcn.005689a1
lea ecx, [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x43c], 4
call fcn.0056893b
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x434], 5
call fcn.00568845
lea ecx, [esp + 0xc]
mov byte [esp + 0x430], 4
call fcn.0056870c
lea ecx, [esp + 0x18]
mov byte [esp + 0x430], 3
call fcn.0056870c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00550e32
add esp, 8
test eax, eax
je 0x41f348
mov edx, dword [0x5f9f88]
mov dword [esp + 0xc], edx
mov eax, dword [esi + 0xf690]
mov byte [esp + 0x430], 6
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
jne 0x41f2f5
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
cmp edx, ebp
je 0x41f300
mov eax, edx
jmp 0x41f303
mov eax, dword [eax + 0x20]
push ecx
push eax
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push eax
push 0x5e9664
push ecx
call fcn.00563eb4
add esp, 0x14
lea edx, [esp + 0xc]
push 0xff
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00568481
mov ecx, esi
call fcn.004249c0
mov byte [esp + 0x430], 3
lea ecx, [esp + 0xc]
jmp 0x41f3ba
mov eax, dword [0x5f9f88]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xf690]
mov byte [esp + 0x430], 7
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
jne 0x41f369
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
cmp edx, ebp
je 0x41f374
mov eax, edx
jmp 0x41f377
mov eax, dword [eax + 0x20]
push ecx
lea ecx, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0x5e9604
push edx
call fcn.00563eb4
add esp, 0x14
lea eax, [esp + 0xc]
push 0xff
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00568481
mov ecx, esi
call fcn.004249c0
mov byte [esp + 0x430], 3
lea ecx, [esp + 0xc]
call fcn.0056870c
lea ecx, [esp + 0x20]
mov byte [esp + 0x430], 2
call fcn.0056870c
lea ecx, [esp + 0x24]
mov byte [esp + 0x430], 1
call fcn.0056870c
lea ecx, [esp + 0x14]
mov byte [esp + 0x430], 0
call fcn.0056870c
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], 0xffffffff
call fcn.0056870c
mov eax, 1
mov ecx, dword [esp + 0x428]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x428
ret 4