Function at 0x41e161
Capabilities:
Delete file

Disassembly:
mov eax, 0x4679f7
call fcn.00466f40
mov eax, 0x1a5c
call fcn.00466f70
mov dx, word [0x469bb8]
push ebx
push esi
mov esi, ecx
mov ebx, 0x81
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x85a]
mov word [ebp - 0x85c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x44a]
mov word [ebp - 0x44c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0x104
lea eax, [ebp - 0x44c]
push ebx
push eax
push 0x12d
push dword [0x49a554]
call edi
lea eax, [ebp - 0x85c]
push ebx
push eax
push 0x12e
push dword [0x49a554]
call edi
lea ecx, [ebp - 0x1a68]
call fcn.00419741
and dword [ebp - 4], 0
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x1a68]
call fcn.00419752
push dword [esi + 0x584]
lea ecx, [ebp - 0x1a68]
call fcn.004197ac
push dword [esi + 4]
lea ecx, [ebp - 0x1a68]
call fcn.004197b9
cmp eax, 2
jne 0x41e23a
or dword [ebp - 4], 0xffffffff
jmp 0x41e427
mov eax, dword [esi + 0x424]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 2
mov edi, 0x100c
push 0xffffffffffffffff
push edi
push eax
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x41e39d
push eax
lea ecx, [esi + 0x420]
call fcn.00458e72
test eax, eax
mov dword [ebp - 0x14], eax
je 0x41e376
mov edi, dword [eax + 0x28d4]
test edi, edi
je 0x41e2aa
and dword [edi + 0x2424], 0
and dword [edi + 0x2420], 0
mov ecx, edi
call fcn.0044b85d
mov ecx, edi
call fcn.0044b958
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
dec dword [esi + 0x598]
mov dx, word [0x469bb8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x242]
mov word [ebp - 0x244], dx
mov word [ebp - 0x654], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x652]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x2298]
push eax
lea eax, [edi + 0x2090]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x244]
push eax
push 0x40b870
lea eax, [ebp - 0x654]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [ebp - 0x1a68]
call fcn.004197a5
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x584], eax
je 0x41e345
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call fcn.00466f25
mov eax, dword [esi + 0x9b8]
pop ecx
mov ecx, dword [ebp - 0x10]
lea eax, [eax + ecx*4]
lea ecx, [esi + 0x9b4]
push eax
call fcn.00420a80
mov edi, 0x100c
mov eax, dword [esi + 0x424]
push 0
push dword [ebp - 0x10]
push 0x1008
push eax
call ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi + 0x424]
dec ecx
push 2
push ecx
push edi
push eax
jmp 0x41e251
lea ecx, [esi + 0x420]
call fcn.00458e48
cmp dword [ebp - 0x10], eax
jl 0x41e3b0
dec dword [ebp - 0x10]
mov eax, dword [esi + 0x424]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0x102c
push eax
call ebx
lea ecx, [ebp - 0x3c]
or dword [ebp - 0x2c], 0xffffffff
push ecx
or al, 3
push dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x424]
push 0x102b
push eax
call ebx
or dword [esi + 0x580], 0xffffffff
push 1
push 0
mov ecx, esi
push dword [ebp - 0x10]
call fcn.0041cafc
mov eax, dword [esi + 0x424]
push 1
push 0xffffffffffffffff
push edi
push eax
call ebx
or edi, 0xffffffff
cmp eax, edi
jne 0x41e41d
push 1
push 0
push edi
mov ecx, esi
mov dword [esi + 0x580], edi
call fcn.0041cafc
mov ecx, esi
call fcn.0041e4cd
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x1a68]
call fcn.0046746d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret