Function at 0x421230
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489663
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x22c], eax
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x30]
mov dword [ebp - 0x230], esi
mov byte [ebp - 0x219], 0
test eax, 0xfffffffc
jne 0x4212a1
mov eax, 2
jmp 0x421ac2
mov edi, dword [ebp + 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp edi, 1
jne 0x4212df
lea edi, [ebx + 0x84]
push edi
call eax
mov esi, dword [edi + 0x1c]
sub esi, dword [edi + 0x18]
push edi
sar esi, 5
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp + 0x10]
xor eax, eax
test esi, esi
mov esi, dword [ebp - 0x230]
cmove edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp + 0x10], edi
push ebx
mov dword [ebp - 0x280], ebx
call eax
mov dword [ebp - 4], 0
test esi, esi
jne 0x421757
push 0x5a0
call fcn.004705b4
add esp, 4
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x421323
mov ecx, eax
call fcn.004158b0
mov edi, eax
mov dword [ebp - 0x220], eax
jmp 0x42132b
xor edi, edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x27c], edi
test edi, edi
je 0x421342
lea eax, [edi + 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebx + 0x34]
mov byte [ebp - 4], 2
mov esi, dword [eax - 4]
lea ecx, [esi + 0x4fc]
call fcn.00442320
lea ecx, [esi + 0x52c]
push ecx
lea ecx, [esi + 0x4c8]
push ecx
lea ecx, [edi + 0x52c]
push ecx
lea ecx, [edi + 0x4c8]
push ecx
mov ecx, eax
call fcn.004407f0
push eax
lea ecx, [edi + 0x4fc]
call fcn.0043f730
mov eax, dword [ebp + 0x10]
xor ecx, ecx
cmp byte [ebp + 0x18], cl
cmovne eax, ecx
sub eax, ecx
je 0x4215ac
dec eax
je 0x4214c8
dec eax
jne 0x421715
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push eax
push 0x1032
push dword [ebx + 0x18]
call esi
lea ecx, [ebp - 0x219]
push ecx
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
push 0
push 0
push 0x1032
push dword [ebx + 0x18]
mov byte [ebp - 4], 7
mov dword [ebp - 0x228], 0
call esi
push ebx
push eax
push dword [ebp - 0x234]
mov ecx, edi
call fcn.00468500
test eax, eax
je 0x421426
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
mov esi, 5
call fcn.0040c710
jmp 0x421728
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx + 0x18]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4216fa
nop
push esi
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040cea0
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x248]
push eax
push edi
call fcn.00421cc0
add esp, 0x10
test al, al
je 0x4214aa
cmp byte [ebp - 0x219], 0
jne 0x4214aa
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 7
call fcn.0040f3b0
push 2
push esi
push 0x100c
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421440
jmp 0x4216fa
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x22c], 4
mov byte [ebp - 4], 7
call fcn.0040f3b0
jmp 0x4216fa
lea eax, [ebp - 0x219]
mov ecx, ebx
push eax
call fcn.004166b0
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
push ebx
mov ecx, ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x228], 0
call fcn.004166b0
push eax
push dword [ebp - 0x234]
mov ecx, edi
call fcn.00468500
test eax, eax
jne 0x421406
mov ecx, ebx
xor esi, esi
call fcn.004166b0
test eax, eax
je 0x4216fa
lea ebx, [ebx]
push esi
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040cea0
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x248]
push eax
push edi
call fcn.00421cc0
add esp, 0x10
test al, al
je 0x42158e
cmp byte [ebp - 0x219], 0
jne 0x42158e
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 5
call fcn.0040f3b0
mov ecx, ebx
inc esi
call fcn.004166b0
cmp esi, eax
jb 0x421530
jmp 0x4216fa
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x22c], 4
mov byte [ebp - 4], 5
call fcn.0040f3b0
jmp 0x4216fa
lea eax, [ebp - 0x219]
mov ecx, ebx
push eax
call fcn.004193d0
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
push ebx
mov ecx, ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x228], 0
call fcn.004193d0
push eax
push dword [ebp - 0x234]
mov ecx, edi
call fcn.00468500
test eax, eax
jne 0x421406
mov eax, dword [ebx + 0x34]
xor ecx, ecx
sub eax, dword [ebx + 0x30]
sar eax, 2
mov dword [ebp - 0x230], ecx
test eax, eax
je 0x4216fa
mov eax, dword [ebx + 0x30]
xor esi, esi
mov edi, dword [eax + ecx*4]
mov ecx, edi
call fcn.004166f0
test eax, eax
je 0x4216bb
lea ecx, [ecx]
push esi
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.00468980
cmp dword [ebp + 0x10], 0
mov byte [ebp - 4], 4
je 0x42166c
mov eax, dword [ebp - 0x240]
cmp word [eax + 8], 4
je 0x42166c
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebx + 0x84]
call fcn.00413dc0
test al, al
je 0x42169c
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x220]
call fcn.00421cc0
add esp, 0x10
test al, al
je 0x4216db
cmp byte [ebp - 0x219], 0
jne 0x4216db
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 3
call fcn.0040f3b0
mov ecx, edi
inc esi
call fcn.004166f0
cmp esi, eax
jb 0x421630
mov eax, dword [ebx + 0x34]
mov ecx, dword [ebp - 0x230]
sub eax, dword [ebx + 0x30]
inc ecx
sar eax, 2
mov dword [ebp - 0x230], ecx
cmp ecx, eax
jb 0x421616
jmp 0x4216f4
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x22c], 4
mov byte [ebp - 4], 3
call fcn.0040f3b0
mov edi, dword [ebp - 0x220]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
call fcn.0040c710
mov esi, dword [ebp - 0x22c]
test esi, esi
jne 0x421728
jmp 0x421717
xor esi, esi
mov ecx, edi
call fcn.00467cd0
test al, al
mov ecx, 4
cmove esi, ecx
mov byte [ebp - 4], 0
test edi, edi
je 0x421a9a
lea eax, [edi + 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, 2
jge 0x421a9a
push eax
mov ecx, edi
call fcn.004685f0
jmp 0x421a9a
push str.wt__ccsUTF_8
push dword [ebp - 0x234]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
call fcn.004733a4
mov eax, dword [ebp - 0x220]
add esp, 0xc
test eax, eax
jne 0x42178d
lea esi, [eax + 3]
jmp 0x421ab9
cmp esi, 1
jne 0x421812
xor esi, esi
cmp dword [0x4be690], esi
jle 0x4217fc
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi*4 + 0x4be694]
push dword [0x4be600]
call dword [sym.imp.USER32.dll_LoadStringW]
test esi, esi
jle 0x4217d3
push dword [ebp - 0x220]
push 0x2c
call fcn.00473baf
add esp, 8
lea eax, [ebp - 0x218]
push eax
push str.__s_
push dword [ebp - 0x220]
call fcn.00473c26
inc esi
add esp, 0xc
cmp esi, dword [0x4be690]
jl 0x4217a0
mov eax, dword [ebp - 0x220]
push 0x498d48
push eax
call fcn.00473c26
mov esi, dword [ebp - 0x230]
add esp, 8
jmp 0x421878
push str.__xml_version_1.0__encoding_UTF_8____n
push eax
call fcn.00473c26
push 1
push str.procmon
push dword [ebp - 0x220]
call fcn.00423290
push 1
push str.processlist
push dword [ebp - 0x220]
call fcn.00423290
add esp, 0x20
mov ecx, ebx
push dword [ebp - 0x220]
call fcn.00422860
push 0
push str.processlist
push dword [ebp - 0x220]
call fcn.00423290
push 1
push str.eventlist
push dword [ebp - 0x220]
call fcn.00423290
add esp, 0x18
mov ecx, 0x421d50
mov dword [ebp - 0x250], 0
cmp esi, 1
mov dword [ebp - 0x24c], 0
mov eax, 0x421e40
cmove eax, ecx
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x22c], eax
call fcn.004232f0
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 9
sub edi, 0
je 0x421b9e
dec edi
je 0x421ae9
dec edi
jne 0x4219bb
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x1032
push dword [ebx + 0x18]
call esi
lea ecx, [ebp - 0x219]
push ecx
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx + 0x18]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x224], edi
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4219ac
mov edi, dword [ebp - 0x22c]
push esi
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040cea0
push dword [ebp + 0x20]
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0xf
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x220]
call edi
add esp, 0x14
test al, al
je 0x421ae0
cmp byte [ebp - 0x219], 0
jne 0x421ae0
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x274], eax
inc eax
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0xe
call fcn.0040f3b0
push 2
push esi
push 0x100c
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421927
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 9
call fcn.0040c710
cmp dword [ebp - 0x230], 2
jne 0x421a52
mov edi, dword [ebp - 0x220]
push edi
push 0x3c
call fcn.00473a29
push edi
push 0x2f
call fcn.00473a29
add esp, 0x10
mov esi, str.eventlist
mov eax, 0x65
jmp 0x4219f0
push edi
push eax
call fcn.00473a29
movzx eax, word [esi + 2]
lea esi, [esi + 2]
add esp, 8
test ax, ax
jne 0x4219f0
push edi
push 0x3e
call fcn.00473a29
mov edi, dword [ebp - 0x220]
push edi
push 0x3c
call fcn.00473a29
push edi
push 0x2f
call fcn.00473a29
add esp, 0x18
mov esi, str.procmon
mov eax, 0x70
push edi
push eax
call fcn.00473a29
movzx eax, word [esi + 2]
lea esi, [esi + 2]
add esp, 8
test ax, ax
jne 0x421a31
push edi
push 0x3e
call fcn.00473a29
add esp, 8
xor esi, esi
push dword [ebp - 0x220]
call fcn.0047351f
add esp, 4
mov byte [ebp - 4], 0
cmp eax, 0xffffffff
mov ecx, 4
mov eax, dword [ebp - 0x250]
cmove esi, ecx
lea ecx, [ebp - 0x250]
push eax
push dword [eax]
lea eax, [ebp - 0x27c]
push eax
call fcn.00423810
push dword [ebp - 0x250]
call fcn.004705af
add esp, 4
test esi, esi
je 0x421aaa
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x219], 0
mov eax, 1
cmovne esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret 0x1c
mov byte [ebp - 4], 0xe
jmp 0x421c94
lea eax, [ebp - 0x219]
mov ecx, ebx
push eax
call fcn.004166b0
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
mov ecx, ebx
mov byte [ebp - 4], 0xc
xor esi, esi
call fcn.004166b0
test eax, eax
je 0x4219ac
mov edi, dword [ebp - 0x22c]
lea esp, [esp]
push esi
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0040cea0
push dword [ebp + 0x20]
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0xd
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x220]
call edi
add esp, 0x14
test al, al
je 0x421b95
cmp byte [ebp - 0x219], 0
jne 0x421b95
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x274], esi
mov byte [ebp - 4], 0xc
call fcn.0040f3b0
mov ecx, ebx
inc esi
call fcn.004166b0
cmp esi, eax
jb 0x421b30
jmp 0x4219ac
mov byte [ebp - 4], 0xc
jmp 0x421c94
lea eax, [ebp - 0x219]
mov ecx, ebx
push eax
call fcn.004193d0
push eax
push str.Process_Monitor___Exporting_event_data
push dword [ebp - 0x224]
lea ecx, [ebp - 0x278]
call fcn.0040c5c0
mov eax, dword [ebx + 0x34]
xor ecx, ecx
sub eax, dword [ebx + 0x30]
xor edi, edi
sar eax, 2
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x228], ecx
test eax, eax
je 0x4219ac
mov eax, dword [ebx + 0x30]
xor esi, esi
mov eax, dword [eax + ecx*4]
mov ecx, eax
mov dword [ebp - 0x224], eax
call fcn.004166f0
test eax, eax
je 0x421c6d
jmp 0x421c00
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00468980
push dword [ebp + 0x20]
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0xb
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x220]
call dword [ebp - 0x22c]
add esp, 0x14
test al, al
je 0x421c90
cmp byte [ebp - 0x219], 0
jne 0x421c90
mov dword [ebp - 0x274], edi
lea ecx, [ebp - 0x248]
inc edi
mov byte [ebp - 4], 0xa
call fcn.0040f3b0
mov ecx, dword [ebp - 0x224]
inc esi
call fcn.004166f0
cmp esi, eax
jb 0x421c00
mov eax, dword [ebx + 0x34]
mov ecx, dword [ebp - 0x228]
sub eax, dword [ebx + 0x30]
inc ecx
sar eax, 2
mov dword [ebp - 0x228], ecx
cmp ecx, eax
jb 0x421be2
jmp 0x4219ac
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x248]
mov esi, 4
call fcn.0040f3b0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 9
call fcn.0040c710
jmp 0x421a54