Function at 0x41f4c9
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], 1
push edi
push 0x73
pop ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov edi, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x1c], edx
xor edx, edx
mov word [ecx], dx
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], dl
mov dword [ebp - 0x10], 0x3e8
call fcn.00404e78
mov eax, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0xa
pop ecx
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x10], eax
mov cl, byte [edx + 0x13]
call fcn.0041f4a4
test eax, eax
je 0x41f54d
mov al, byte [0x51e8c6]
mov byte [ebp - 2], al
mov al, byte [0x51e8c5]
jmp 0x41f55a
mov al, byte [0x51e8c8]
mov byte [ebp - 2], al
mov al, byte [0x51e8c7]
cmp dword [edx + 8], 4
mov byte [ebp - 3], al
jne 0x41f67b
push edi
call fcn.0049ad90
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x41f57c
mov bl, 0x6e
jmp 0x41f67b
cmp eax, 2
jne 0x41f588
mov bl, 0x6f
jmp 0x41f67b
mov al, byte [ebp - 2]
xor edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
cmp edi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x20]
jae 0x41f67b
inc dword [ebp - 0xc]
cmp al, cl
je 0x41f5ad
cmp al, 2
jne 0x41f5c8
cmp dword [ebp - 0xc], ecx
jne 0x41f676
cmp byte [edx + 0x1168], 2
jne 0x41f676
mov al, 3
mov byte [ebp - 2], al
cmp al, 9
je 0x41f89e
mov al, byte [edx + 0x11]
cmp al, 4
je 0x41f872
cmp dword [ebp - 0xc], ecx
jne 0x41f5fb
mov ecx, dword [ebp - 0x14]
mov edx, edi
push str..backup
push esi
call fcn.0041e68a
mov edx, dword [ebp - 8]
pop ecx
pop ecx
xor ecx, ecx
mov al, byte [edx + 0x11]
inc ecx
cmp al, 6
je 0x41f603
cmp al, cl
jne 0x41f652
push esi
mov ecx, edi
call fcn.0041f039
mov edx, dword [ebp - 8]
pop ecx
cmp byte [edx + 0x12], 6
jne 0x41f64f
mov al, byte [edx + 0x11]
mov ecx, edi
push esi
mov byte [ebp - 4], al
call fcn.0041f039
mov edx, dword [ebp - 8]
pop ecx
cmp byte [edx + 0x11], 5
jne 0x41f633
cmp byte [edx + 0x12], 7
je 0x41f63b
mov al, byte [ebp - 2]
jmp 0x41f7bf
mov ecx, edi
call fcn.0041d777
mov edx, dword [ebp - 8]
mov al, byte [ebp - 4]
mov byte [edx + 0x11], al
mov byte [edx + 0x12], 6
xor ecx, ecx
inc ecx
mov al, byte [edx + 0x11]
cmp al, 5
je 0x41f676
cmp al, 3
je 0x41f856
cmp al, 2
jne 0x41f711
cmp dword [0x51e8c0], 0
jne 0x41f7fb
push 0x78
pop eax
mov bl, al
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [ecx], dx
je 0x41f6c2
test al, al
je 0x41f6b5
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
push edx
push edx
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.0041e70e
mov ecx, dword [ebp - 0x14]
add esp, 0x14
push 0x80
push ecx
call esi
push dword [ebp - 0x14]
call edi
cmp bl, 0x68
jne 0x41f6da
mov ecx, dword [ebp - 0x24]
call fcn.0041d4fe
mov eax, dword [ebp - 0x20]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp byte [ebp - 0x28], 0
je 0x41f6f7
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp word [eax], dx
je 0x41f6f7
push 0x80
push eax
call esi
push dword [ebp - 0x18]
call edi
push 0x78
pop ecx
cmp bl, 0x70
movzx eax, bl
pop edi
cmove eax, ecx
mov ecx, dword [ebp - 0x2c]
pop esi
pop ebx
mov byte [ecx + 0x21], al
movzx eax, al
leave
ret
cmp al, cl
jne 0x41f7ee
mov al, byte [edx + 0x12]
cmp al, 6
je 0x41f846
cmp al, 0xa
jne 0x41f75e
cmp dword [0x51e8c0], 0
jne 0x41f7fb
mov dl, byte [ebp - 3]
cmp dl, cl
je 0x41f805
cmp dl, 2
je 0x41f805
mov al, byte [ebp - 2]
cmp al, dl
je 0x41f805
mov al, dl
mov byte [ebp - 2], al
jmp 0x41f590
cmp al, 0x10
jne 0x41f776
cmp dword [0x51e8c0], 0
jne 0x41f7fb
mov bl, 0x77
jmp 0x41f67b
cmp al, 9
je 0x41f782
cmp al, 8
jne 0x41f676
mov ecx, dword [ebp - 0x18]
mov edx, edi
push str..cleaned
push esi
call fcn.0041e68a
mov bl, al
pop ecx
pop ecx
test bl, bl
jne 0x41f67b
mov ecx, dword [esi + 0x1c]
push esi
call fcn.0041f039
mov edx, dword [ebp - 8]
pop ecx
cmp byte [edx + 0x12], 6
je 0x41f80c
cmp dword [0x51e8c0], 0
je 0x41f7c7
mov al, 9
mov byte [ebp - 2], al
xor ecx, ecx
inc ecx
jmp 0x41f593
mov dl, byte [ebp - 3]
xor ecx, ecx
inc ecx
cmp dl, cl
je 0x41f67b
cmp dl, 2
je 0x41f67b
mov al, byte [ebp - 2]
cmp al, dl
je 0x41f67b
jmp 0x41f754
cmp dword [0x51e8c0], 0
je 0x41f67b
mov al, 9
mov byte [ebp - 2], al
jmp 0x41f593
mov bl, 0x6a
jmp 0x41f67b
mov ecx, dword [ebp - 0x18]
mov edx, edi
push esi
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], 4
call fcn.0041efcd
mov bl, al
xor eax, eax
pop ecx
inc eax
xor ecx, ecx
movzx eax, al
cmp bl, 0x69
cmove eax, ecx
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x41f67b
mov al, cl
mov dword [ebp - 0xc], 4
mov bl, 0x68
jmp 0x41f67e
xor eax, eax
mov byte [ebp - 1], cl
push eax
mov edx, esi
mov dword [ebp - 0xc], 2
mov ecx, edi
call fcn.0041ec49
pop ecx
jmp 0x41f679
cmp byte [0x51e8c4], 9
jne 0x41f897
lea eax, [esi + 0x40]
push eax
push esi
push ecx
push 2
push dword [ebp - 0x1c]
mov edx, edi
mov ecx, edi
call fcn.0041e70e
add esp, 0x14
jmp 0x41f679
mov bl, 0x74
jmp 0x41f67b
lea eax, [esi + 0x40]
push eax
push esi
push ecx
push 0x20
jmp 0x41f883