Function at 0x40585d
Capabilities:
Check if file exists
Delete directory

Disassembly:
push 0x88
mov eax, 0x595b24
call fcn.004103bb
mov dword [ebp - 0x8c], ecx
call fcn.00403fef
mov ecx, eax
call fcn.00413013
push eax
lea ecx, [ebp - 0x88]
call fcn.00401680
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x78], 0
je 0x405cf4
call fcn.004111a6
test al, al
je 0x4058bf
pop esi
pop eax
push edx
push edx
push esi
pop esp
pop eax
pop edi
pop esi
pop esp
push esi
pop eax
push esp
push eax
push ebp
push ebx
pop ebp
push edx
push esp
pop edx
push edx
pop edx
push edx
push eax
pop eax
pop ecx
push esp
call fcn.0041170a
test al, al
je 0x4058e8
push edx
pop ebp
pop ebx
pop ecx
pop ebx
push ebx
pop ebx
push edi
pop esi
push edx
push ebx
pop ebp
push ecx
push ecx
pop esp
pop edi
pop edx
push eax
pop ebp
pop esi
pop edi
push edx
pop ebp
push ebp
pop eax
push ebx
push edx
push eax
pop eax
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401658
mov esi, str.WindowsRestMater.exe
mov byte [ebp - 4], bl
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00402595
call fcn.004110d7
test al, al
je 0x405936
pop esp
pop ebx
push edx
pop ebx
pop ecx
push edx
push eax
push ebx
pop eax
pop edi
pop edi
push esi
push esp
push edx
push ecx
pop ecx
push ebx
pop edi
pop ebx
push esp
pop ebp
pop esi
pop eax
pop esp
push eax
pop eax
push edx
pop eax
push ebp
call fcn.004116c5
test al, al
je 0x405958
pop eax
pop ecx
push eax
pop ebp
push edx
push ebp
pop eax
pop esp
pop ebp
push edi
pop ebx
pop ebx
pop edi
push ecx
push ebp
push esp
push eax
push esp
pop eax
pop edi
pop ebx
pop edi
push esi
push edx
pop esi
call fcn.00411275
test al, al
je 0x40597d
pop eax
pop ecx
pop ebp
pop ecx
pop ecx
push ebx
pop eax
pop edx
pop edx
push esi
pop eax
pop esi
pop ebx
pop esp
pop eax
push ebx
pop ebp
push esi
pop ebp
push edi
push edx
pop edi
pop ecx
push ebp
push esp
push esi
pop edi
push ebp
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 1
pop ebx
push 0xffffffffffffffff
xor edi, edi
lea ecx, [ebp - 0x40]
test eax, eax
lea eax, [ebp - 0x88]
push 0
push eax
cmovne edi, ebx
call fcn.00401bbf
mov esi, str.WinUterf.exe
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00402595
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
cmovne edi, ebx
mov dword [ebp - 0x94], edi
call fcn.00411680
test al, al
je 0x405a04
pop esp
push eax
push esp
push ebx
pop edx
pop ebp
pop ebp
pop edx
pop ebp
pop esi
push edx
pop ebp
pop edx
push ebx
pop ebx
push ebx
push ecx
pop ecx
pop eax
pop edx
pop esp
pop ebp
pop eax
push ebx
push esp
xor ebx, ebx
inc ebx
test edi, edi
je 0x405a56
call fcn.00403fef
mov ecx, eax
call fcn.004130d1
push eax
lea ecx, [ebp - 0x28]
call fcn.00401680
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x405a48
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401680
mov ecx, dword [ebp - 0x8c]
call fcn.00406a4f
push 0
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401b31
call fcn.004113ce
test al, al
je 0x405a7b
pop eax
pop ebp
pop edi
push ebx
push esi
pop edx
pop esp
push edx
pop esi
pop edx
push esp
pop edx
push ebx
pop edi
push esp
push ebp
push edx
pop esp
push edx
push edi
push esp
pop esp
pop ecx
pop ecx
pop ebx
push edi
push ebp
push edi
cmp dword [ebp + 8], 0
je 0x405bcd
call fcn.00403fef
mov ecx, eax
call fcn.00412ffb
push eax
lea ecx, [ebp - 0x28]
call fcn.00401680
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
je 0x405adb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405adb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401680
mov ecx, dword [ebp - 0x8c]
call fcn.00406a4f
call fcn.004110d7
test al, al
je 0x405b01
pop esp
pop ebx
push edx
pop ebx
pop ecx
push edx
push eax
push ebx
pop eax
pop edi
pop edi
push esi
push esp
push edx
push ecx
pop ecx
push ebx
pop edi
pop ebx
push esp
pop ebp
pop esi
pop eax
pop esp
push eax
pop eax
push edx
pop eax
push ebp
call fcn.004116c5
test al, al
je 0x405b23
pop eax
pop ecx
push eax
pop ebp
push edx
push ebp
pop eax
pop esp
pop ebp
push edi
pop ebx
pop ebx
pop edi
push ecx
push ebp
push esp
push eax
push esp
pop eax
pop edi
pop ebx
pop edi
push esi
push edx
pop esi
call fcn.00411275
test al, al
je 0x405b48
pop eax
pop ecx
pop ebp
pop ecx
pop ecx
push ebx
pop eax
pop edx
pop edx
push esi
pop eax
pop esi
pop ebx
pop esp
pop eax
push ebx
pop ebp
push esi
pop ebp
push edi
push edx
pop edi
pop ecx
push ebp
push esp
push esi
pop edi
push ebp
call fcn.00403fef
mov ecx, eax
call fcn.00413007
push eax
lea ecx, [ebp - 0x70]
call fcn.00401680
cmp dword [ebp - 0x60], 0
mov byte [ebp - 4], 4
je 0x405b9e
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405b9e
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401680
mov ecx, dword [ebp - 0x8c]
call fcn.00406a4f
call fcn.0040684b
test eax, eax
je 0x405bb1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x12c]
push 0
push 1
lea ecx, [ebp - 0x70]
call fcn.00401b31
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00401b31
call fcn.004111eb
test al, al
je 0x405bf0
pop edi
pop edi
push esp
pop esp
pop edx
pop esi
pop ebx
pop ebx
push edi
push eax
pop esi
pop edx
pop ebx
pop ecx
push ebx
pop edi
pop ebx
pop esi
pop esi
push ebx
pop edx
pop ecx
push ecx
push esi
pop ebp
push eax
call fcn.004118a8
test al, al
je 0x405c0a
pop ebx
pop ebp
push esi
push eax
pop edi
push ecx
pop esi
pop edx
pop edx
push ebx
pop esi
push ebp
pop ebp
pop ebx
pop esi
pop ebx
pop edi
call fcn.00403fef
mov ecx, eax
call fcn.004130d1
push eax
lea ecx, [ebp - 0x58]
call fcn.00401680
cmp dword [ebp - 0x48], 0
mov byte [ebp - 4], 5
je 0x405c6e
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405c6e
mov esi, 0x59a724
push esi
call fcn.00433f51
pop ecx
push eax
push 0
push esi
lea ecx, [ebp - 0x58]
call fcn.00406e2f
cmp eax, 0xffffffff
je 0x405c6e
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.0041156c
test al, al
je 0x405c96
pop ecx
push esp
pop esi
push esi
pop esp
pop esp
pop ecx
pop esp
push ebp
push ecx
push ecx
push edx
pop eax
push ebx
pop esp
push ebx
pop eax
pop ebp
pop esp
pop esi
pop esp
pop ecx
pop ebp
push ebp
pop esp
push ebx
push eax
push edx
pop ebp
pop edi
pop edx
call fcn.004115f6
test al, al
je 0x405cb1
push ecx
pop esp
pop edi
pop esp
pop esi
pop ebx
push esp
pop ebp
pop esi
pop eax
push ecx
pop ebx
push esi
push ecx
push ebp
push eax
pop ebx
push eax
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
cmovae eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x94], 0
je 0x405cde
mov eax, dword [ebp - 0x8c]
mov byte [eax + 0x10], bl
push 0
push ebx
lea ecx, [ebp - 0x58]
call fcn.00401b31
push 0
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401b31
push 0
push ebx
lea ecx, [ebp - 0x88]
call fcn.00401b31
call fcn.00410376
ret 4