Function at 0x41c940
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a36a4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2934
call fcn.00494370
mov eax, dword [0x4c6184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ebx, edx
lea edx, [ebp - 0x2860]
xor edi, edi
push edx
mov dword [ebp - 0x2888], eax
mov byte [ebp - 0x285a], 1
mov dword [ebp - 0x288c], edi
mov dword [ebp - 4], edi
call fcn.0041bf30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2860]
mov eax, dword [ecx - 0xc]
cmp eax, 2
jl 0x41ca07
cmp eax, edi
jge 0x41c9bf
push 0x80070057
call fcn.004170a0
cmp word [ecx], 0x22
jne 0x41c9de
lea eax, [ebp - 0x2860]
push eax
mov eax, 1
xor ecx, ecx
call fcn.00419010
mov ecx, dword [ebp - 0x2860]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
cmp eax, edi
jl 0x41c9b5
cmp eax, edx
jg 0x41c9b5
cmp word [ecx + eax*2], 0x22
jne 0x41ca07
lea ecx, [edx - 1]
lea edx, [ebp - 0x2860]
push edx
mov eax, 1
call fcn.00419010
lea eax, [ebp - 0x2860]
push eax
lea ecx, [ebp - 0x2874]
push ecx
call fcn.004188d0
add esp, 8
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x2860]
mov byte [ebp - 0x285b], 0
mov ecx, 0x4a9710
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ca5b
cmp dx, di
je 0x41ca57
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ca5b
add eax, 4
add ecx, 4
cmp dx, di
jne 0x41ca35
xor eax, eax
jmp 0x41ca60
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41cab2
lea edx, [ebp - 0x286c]
push edx
mov ecx, 0x4a970c
call fcn.0041bf30
lea eax, [ebp - 0x286c]
lea edi, [ebp - 0x2860]
mov byte [ebp - 4], 3
call fcn.00417130
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x286c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cb1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41cb1b
mov eax, dword [esi - 0xc]
cmp eax, 1
jle 0x41cb1b
cmp eax, edi
jge 0x41cac8
push 0x80070057
call fcn.004170a0
cmp word [esi], 0x2a
jne 0x41cae0
lea ecx, [ebp - 0x2860]
push ecx
mov byte [ebp - 0x2862], 1
xor ecx, ecx
jmp 0x41cb0b
lea ecx, [eax - 1]
cmp ecx, edi
jl 0x41c9b5
cmp ecx, eax
jg 0x41c9b5
cmp word [esi + ecx*2], 0x2a
jne 0x41cb1b
lea edx, [ebp - 0x2860]
mov byte [ebp - 0x2862], 0
lea ecx, [eax - 1]
push edx
mov eax, 1
mov byte [ebp - 0x285b], al
call fcn.00419010
mov esi, dword [ebp - 0x2874]
mov byte [ebp - 0x2859], 0
mov ecx, 0x4a9710
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41cb56
test dx, dx
je 0x41cb52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41cb56
add eax, 4
add ecx, 4
test dx, dx
jne 0x41cb30
xor eax, eax
jmp 0x41cb5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41cbad
lea eax, [ebp - 0x286c]
push eax
mov ecx, 0x4a970c
call fcn.0041bf30
lea eax, [ebp - 0x286c]
lea edi, [ebp - 0x2874]
mov byte [ebp - 4], 4
call fcn.00417130
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x286c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cc16
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41cc16
mov eax, dword [esi - 0xc]
cmp eax, 1
jle 0x41cc16
test eax, eax
jns 0x41cbc3
push 0x80070057
call fcn.004170a0
cmp word [esi], 0x2a
jne 0x41cbdb
lea ecx, [ebp - 0x2874]
push ecx
mov byte [ebp - 0x2861], 1
xor ecx, ecx
jmp 0x41cc06
lea ecx, [eax - 1]
test ecx, ecx
js 0x41c9b5
cmp ecx, eax
jg 0x41c9b5
cmp word [esi + ecx*2], 0x2a
jne 0x41cc16
lea edx, [ebp - 0x2874]
mov byte [ebp - 0x2861], 0
lea ecx, [eax - 1]
push edx
mov eax, 1
mov byte [ebp - 0x2859], al
call fcn.00419010
lea eax, [ebp - 0x2870]
push eax
mov ecx, ebx
call fcn.0041bf30
push 0xa4
lea ecx, [ebp - 0x2940]
push 0
push ecx
mov byte [ebp - 4], 5
call fcn.0048a470
mov eax, dword [ebp - 0x2870]
mov esi, 1
add esp, 0xc
cmp dword [eax - 4], esi
jle 0x41cc64
mov edx, dword [eax - 0xc]
push edx
lea eax, [ebp - 0x2870]
push eax
call fcn.00416ed0
mov eax, dword [ebp - 0x2870]
lea ecx, [ebp - 0x2940]
mov dword [ebp - 0x293c], eax
mov dword [ebp - 0x2938], esi
mov dword [ebp - 0x286c], 0
call fcn.00405590
mov ebx, eax
mov eax, dword [ebp - 0x2870]
mov ecx, dword [eax - 8]
push ecx
push eax
mov dword [ebp - 0x288c], ebx
call fcn.004883c5
add esp, 8
test eax, eax
js 0x41c9b5
mov ecx, dword [ebp - 0x2870]
cmp eax, dword [ecx - 8]
jg 0x41c9b5
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x2870]
xor ecx, ecx
mov word [edx + eax*2], cx
test ebx, ebx
je 0x41d0d5
cmp dword [ebp - 0x2934], ecx
jne 0x41d0d5
xor esi, esi
lea esp, [esp]
test esi, esi
jne 0x41d0be
push 0x283c
lea eax, [ebp - 0x2858]
push esi
push eax
call fcn.0048a470
add esp, 0xc
lea ecx, [ebp - 0x2858]
mov edx, ebx
call fcn.00405880
mov esi, eax
cmp esi, 0xa
je 0x41d0c3
test esi, esi
jne 0x41d0be
cmp word [ebp - 0x2458], ax
je 0x41cce0
lea ecx, [ebp - 0x2880]
push ecx
lea ecx, [ebp - 0x1858]
call fcn.0041bf30
lea edx, [ebp - 0x2880]
push edx
lea eax, [ebp - 0x2884]
push eax
mov byte [ebp - 4], 7
call fcn.004188d0
add esp, 8
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x2860]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x41ce35
cmp byte [ebp - 0x285b], 0
je 0x41ce1b
cmp byte [ebp - 0x2862], 0
jne 0x41cdfa
push ecx
mov ecx, dword [ebp - 0x2880]
push esi
push ecx
call fcn.0048877c
add esp, 0xc
test eax, eax
je 0x41ce35
push 0
push 0
xor ecx, ecx
mov edx, ebx
call fcn.00405b40
mov esi, eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2884]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cdcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2880]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cce0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41cce0
mov edx, dword [ebp - 0x2880]
mov eax, dword [edx - 0xc]
cmp eax, ecx
jl 0x41cd96
sub eax, ecx
lea edx, [edx + eax*2]
push esi
push edx
call fcn.004889ab
add esp, 8
jmp 0x41cd8e
mov ecx, dword [ebp - 0x2880]
lea eax, [ebp - 0x2860]
push eax
call fcn.0041d2b0
test eax, eax
jne 0x41cd96
mov esi, dword [ebp - 0x2874]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x41ceb1
cmp byte [ebp - 0x2859], 0
je 0x41ce97
cmp byte [ebp - 0x2861], 0
jne 0x41ce6e
push ecx
mov ecx, dword [ebp - 0x2884]
push esi
push ecx
call fcn.0048877c
add esp, 0xc
test eax, eax
je 0x41ceb1
jmp 0x41cd96
mov edx, dword [ebp - 0x2884]
mov eax, dword [edx - 0xc]
cmp eax, ecx
jl 0x41cd96
sub eax, ecx
lea edx, [edx + eax*2]
push esi
push edx
call fcn.004889ab
add esp, 8
test eax, eax
je 0x41ceb1
jmp 0x41cd96
mov ecx, dword [ebp - 0x2884]
lea eax, [ebp - 0x2874]
push eax
call fcn.0041d2b0
test eax, eax
jne 0x41cd96
lea ecx, [ebp - 0x2868]
push ecx
call fcn.0041bb70
mov ecx, dword [ebp - 0x2888]
lea edx, [ebp - 0x2890]
push edx
mov byte [ebp - 4], 9
call fcn.0041bf30
lea eax, [ebp - 0x2890]
lea edi, [ebp - 0x2868]
mov byte [ebp - 4], 0xa
call fcn.00417130
lea eax, [ebp - 0x2890]
mov byte [ebp - 4], 9
call fcn.0043ec30
mov edx, dword [ebp - 0x2868]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x41cf2a
lea ecx, [eax - 1]
test ecx, ecx
js 0x41c9b5
cmp ecx, eax
jg 0x41c9b5
cmp word [edx + ecx*2], 0x5c
je 0x41cf2a
mov edx, 0x4a9708
mov eax, edi
call fcn.00418fa0
xor esi, esi
lea eax, [ebp - 0x2868]
mov edx, esi
jne 0x41cf3c
lea edx, [ebp - 0x1858]
call fcn.00418fa0
mov eax, dword [ebp - 0x2868]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41cf64
mov ecx, dword [ebp - 0x2868]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x2888]
lea edx, [ebp - 0x2878]
push edx
call fcn.0041bf30
mov byte [ebp - 4], 0xb
test esi, esi
je 0x41d004
lea eax, [ebp - 0x287c]
push eax
mov ecx, esi
call fcn.0041bf30
lea esi, [ebp - 0x287c]
mov byte [ebp - 4], 0xc
call fcn.00419210
lea esi, [ebp - 0x2878]
mov edi, eax
call fcn.00419210
push eax
push 2
mov ecx, edi
mov edx, ebx
call fcn.00405b40
mov esi, eax
mov eax, dword [ebp - 0x287c]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.004883c5
add esp, 8
test eax, eax
js 0x41c9b5
mov ecx, dword [ebp - 0x287c]
cmp eax, dword [ecx - 8]
jg 0x41c9b5
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x287c]
xor ecx, ecx
mov word [edx + eax*2], cx
lea eax, [ebp - 0x287c]
mov byte [ebp - 4], 0xb
call fcn.0043ec30
jmp 0x41d01d
lea esi, [ebp - 0x2878]
call fcn.00419210
push eax
push 2
xor ecx, ecx
mov edx, ebx
call fcn.00405b40
mov esi, eax
mov eax, dword [ebp - 0x2878]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.004883c5
add esp, 8
test eax, eax
js 0x41c9b5
mov ecx, dword [ebp - 0x2878]
cmp eax, dword [ecx - 8]
jg 0x41c9b5
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x2878]
xor ecx, ecx
mov word [edx + eax*2], cx
test esi, esi
jne 0x41d0a3
xor eax, eax
je 0x41d08b
lea eax, [ebp - 0x2894]
push eax
lea ecx, [ebp - 0x1858]
call fcn.0041bf30
lea ecx, [ebp - 0x2894]
push ecx
mov byte [ebp - 4], 0xd
call fcn.00417cf0
lea eax, [ebp - 0x2894]
call fcn.0043ec30
mov edx, dword [ebp - 0x2868]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc dword [ebp - 0x286c]
lea eax, [ebp - 0x2878]
call fcn.0043ec30
lea eax, [ebp - 0x2868]
call fcn.0043ec30
jmp 0x41cda5
cmp esi, 0xa
jne 0x41d0cc
cmp dword [ebp - 0x286c], 0
jne 0x41d0db
mov byte [ebp - 0x285a], 0
jmp 0x41d0db
mov byte [ebp - 0x285a], cl
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2870]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d101
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2874]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d127
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2860]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41d15b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41d15b
xor edi, edi
mov dword [ebp - 4], 0xf
cmp ebx, edi
je 0x41d18d
lea esi, [ebx + 0x6cd0]
mov cl, 1
cmp dword [esi + 0xc], edi
je 0x41d1af
mov dword [esi + 0xc], edi
inc dword [esi + 0xc1c]
push ebx
call fcn.004057d0
push ebx
call fcn.00486a80
add esp, 4
mov al, byte [ebp - 0x285a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00486a8b
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x41d178
cmp byte [esi + 0x10], 0
jne 0x41d1f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test cl, cl
jne 0x41d1d5
cmp dword [0x4cfc50], edi
jne 0x41d1f1
xor eax, eax
cmp eax, 0x100
jae 0x41d1f1
cmp dword [eax*4 + 0x4cc5d8], esi
je 0x41d1ea
inc eax
jmp 0x41d1d7
mov dword [eax*4 + 0x4cc5d8], edi
mov dword [esi + 4], 0xffffffff
test cl, cl
jne 0x41d178
cmp byte [esi + 0x14], cl
je 0x41d178
call fcn.00406010
int3