Function at 0x472da0
Capabilities:
Delete file
Get disk information
Get thread local storage value

Disassembly:
mov eax, 0x2910
call fcn.004ad6f0
mov eax, dword [0x5298e0]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x472e00
call fcn.00472780
test eax, eax
jne 0x472ddf
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x2910
ret 4
mov ecx, dword [0x5298e0]
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x472e00
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x2910
ret 4
cmp dword [esi + 0x9c], ebx
je 0x472e3b
mov edx, dword [esp + 0x2924]
mov dword [esi + 0xb840], ebx
push esi
mov eax, dword [edx + 0x2c]
push eax
push 0x526974
push 1
call fcn.004792b0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov edi, dword [esp + 0x2924]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esi + 0x8d0], ebx
mov dword [esi + 0x8e0], ebx
mov dword [esi + 0x9c], 1
mov dword [esi + 0xd270], ebx
mov dword [esi + 0xb840], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0x8c0], ebx
mov dword [esi + 0x8c4], ebx
mov dword [esi + 0x8d4], ebx
mov dword [esi + 0x8c8], ebx
mov dword [esi + 0x8e4], ebx
mov dword [esi + 0x8d8], ebx
mov dword [esi + 0x8e8], ebx
mov dword [esi + 0x8ec], ebx
mov dword [esi + 0x8f4], ebx
mov dword [esi + 0x910], ebx
mov dword [esi + 0x914], ebx
mov dword [esi + 0x918], ebx
mov dword [esi + 0x91c], ebx
mov dword [esi + 0x920], ebx
mov dword [esi + 0x924], ebx
mov dword [esi + 0x928], ebx
mov dword [esi + 0x934], 0xffffffff
mov dword [esi + 0x3e2c], ebx
mov dword [esi + 0x3e30], ebx
mov dword [esi + 0x8b0], ebx
mov dword [esi + 0x8b4], ebx
mov ecx, dword [edi + 0x88]
lea edx, [esi + 0x3614]
push 0x526974
push edx
mov dword [esi + 0x3e3c], ecx
call ebp
lea eax, [esi + 0x2e14]
push 0x526974
push eax
call ebp
mov eax, dword [edi]
add eax, 0xffffff6c
cmp eax, 0x48
ja case.0x472f34.151
xor ecx, ecx
mov cl, byte [eax + 0x473a80]
jmp dword [ecx*4 + 0x473a6c]
mov dword [esi + 0x3e40], 0x64
jmp 0x472f69
mov dword [esi + 0x3e40], 0xc8
jmp 0x472f69
mov dword [esi + 0x3e40], 0x12c
jmp 0x472f69
mov dword [esi + 0x3e40], 0x1f4
lea edx, [esp + 0x28]
push edi
push edx
mov dword [esp + 0x30], 0xdc
call fcn.00472940
add esp, 8
test eax, eax
je 0x472fb5
push edi
call fcn.00474be0
mov eax, dword [edi + 0x2c]
push esi
push eax
push 0x526974
push 0x10
call fcn.004792b0
add esp, 0x14
mov dword [esi + 0x9c], ebx
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
lea ecx, [esp + 0x28]
push ecx
call fcn.00474be0
mov edx, dword [esp + 0xc0]
add esp, 4
mov dword [esi + 0x3e2c], edx
mov eax, dword [esp + 0xc0]
mov dword [esi + 0x3e30], eax
mov eax, dword [esp + 0x2c]
cmp eax, 6
mov eax, dword [esp + 0x30]
je 0x47301a
cmp eax, ebx
jne 0x47301a
mov ecx, dword [esp + 0x54]
push esi
push ecx
push 0x526974
push 0x10
call fcn.004792b0
add esp, 0x10
mov dword [esi + 0x9c], ebx
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
lea ebp, [esi + 0x1614]
push eax
push ebp
call fcn.00478bc0
mov dx, word [esp + 0xcc]
add esp, 8
mov word [esi + 0x5734], dx
mov eax, dword [esp + 0xc6]
shr eax, 1
and eax, 1
mov dword [esi + 0xa4], eax
mov ecx, dword [esp + 0xc6]
shr ecx, 4
and ecx, 1
mov dword [esi + 0x588c], ecx
mov edx, dword [esp + 0xc6]
shr edx, 5
and edx, 1
mov dword [esi + 0x5890], edx
mov eax, dword [esp + 0xc6]
shr eax, 6
and eax, 1
mov dword [esi + 0x910], eax
mov ecx, dword [esp + 0xc6]
shr ecx, 7
and ecx, 1
mov dword [esi + 0x914], ecx
mov edx, dword [esp + 0xc6]
shr edx, 9
and edx, 1
mov dword [esi + 0x918], edx
mov eax, dword [esp + 0xc6]
shr eax, 0xa
and eax, 1
mov dword [esi + 0x91c], eax
mov ecx, dword [esp + 0xc6]
shr ecx, 8
and ecx, 1
mov dword [esi + 0x920], ecx
mov edx, dword [esp + 0xc6]
shr edx, 0xe
and edx, 1
mov dword [esi + 0x924], edx
mov eax, dword [esp + 0xc6]
shr eax, 0xb
and eax, 1
test byte [esi + 0x5735], 0x80
mov dword [esi + 0x928], eax
je 0x473110
test byte [esi + 0x5735], 0x10
je 0x473110
mov dword [esi + 0x944], ebx
jmp 0x473123
mov ecx, dword [esp + 0xc6]
shr ecx, 0xd
and ecx, 1
mov dword [esi + 0x944], ecx
mov edx, dword [esp + 0xc6]
and edx, 0xffff
shr edx, 0xf
mov dword [esi + 0x94c], edx
mov eax, dword [esp + 0xec]
and eax, 1
xor edx, edx
mov dword [esi + 0x950], eax
mov ecx, dword [esp + 0xec]
shr ecx, 1
and ecx, 1
mov dword [esi + 0x954], ecx
mov edi, dword [esp + 0xe4]
cmp edi, ebx
mov dword [esi + 0x930], ebx
setne dl
mov dword [esi + 0x92c], edx
mov eax, dword [esp + 0xc6]
shr eax, 0xc
lea edi, [esi + 0x2614]
and eax, 1
push edi
mov dword [esi + 0x8f4], eax
mov dword [esp + 0x14], edi
call fcn.00473ad0
mov al, byte [esp + 0xca]
add esp, 4
test al, 1
je 0x4731b2
mov dword [esi + 0x1608], 1
jmp 0x4731b8
mov dword [esi + 0x1608], ebx
mov eax, dword [esp + 0xc4]
test ah, 0x80
je 0x4732a6
push ebp
call fcn.004839c0
mov ebp, eax
push esi
push ebp
call fcn.00482a40
add esp, 0xc
test eax, eax
jne 0x4731ee
push esi
push 0x526974
push ebx
push ebx
push ebx
push 5
jmp 0x47326e
cmp dword [esp + 0x2c], 4
jne 0x47321e
cmp dword [esp + 0x60], ebx
jne 0x47321e
cmp dword [esp + 0x64], ebx
jne 0x47321e
cmp dword [esp + 0x70], ebx
jne 0x47321e
mov ax, word [esi + 0x5734]
test ah, 0x40
je 0x473251
test eax, 0x703
je 0x4732a6
mov edx, dword [esp + 0x54]
push esi
push edx
push 0x526974
push 0x14
call fcn.004792b0
push edi
mov dword [esi + 0x9c], ebx
call fcn.00473b40
add esp, 0x14
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov eax, dword [esp + 0x34]
push eax
push ebp
call fcn.00483a70
add esp, 8
test eax, eax
je 0x4732a6
push esi
push 0x526974
push ebx
push ebx
push ebx
push 6
call fcn.004842a0
mov ecx, dword [esp + 0x6c]
push esi
push ecx
push 0x526974
push 0x14
call fcn.004792b0
push edi
mov dword [esi + 0x9c], ebx
call fcn.00473b40
add esp, 0x2c
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
push esi
call fcn.0047cd00
mov dword [esi + 0x3e14], ebx
mov dword [esi + 0x3e20], ebx
mov dword [esi + 0x3e34], 1
mov eax, dword [esp + 0xd4]
mov dword [esi + 0x938], eax
mov ecx, dword [esp + 0xf8]
mov dword [esi + 0x93c], ecx
mov edx, dword [esp + 0xd8]
mov dword [esi + 0x940], edx
mov eax, dword [esp + 0xdc]
add esp, 4
cmp eax, ebx
je 0x473312
push 0x12c
push eax
lea eax, [esi + 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + 0xc03], bl
jmp 0x473324
lea ecx, [esi + 0xad8]
push str.Compress_Progress
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x40]
mov dword [esi + 0x3e18], edx
mov eax, dword [esp + 0x44]
mov dword [esi + 0x3e1c], eax
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x3e24], ecx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x3e28], edx
mov dword [esi + 0x8ac], ebx
mov eax, dword [esp + 0x2c]
cmp eax, ebx
jle 0x473a38
cmp eax, 7
jg 0x473a38
mov ax, word [esi + 0x5734]
test ah, 0x80
je 0x473689
cmp dword [esp + 0x58], ebx
je 0x473383
cmp dword [esp + 0x5c], ebx
jne 0x47338c
test ah, 0x40
je 0x473689
test byte [esi + 0x5735], 0x40
mov dword [esi + 0xa8], 0xffffffff
je 0x473541
lea eax, [esp + 0x920]
lea ecx, [esp + 0x1920]
push eax
lea edx, [esp + 0x2124]
push ecx
lea eax, [esp + 0x1128]
push edx
push eax
lea eax, [esi + 0x1614]
push eax
call fcn.004835b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x14
lea ecx, [esp + 0x1120]
lea edx, [esp + 0x120]
push ecx
push edx
call edi
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x11f]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x473419
lea ecx, [esp + 0x120]
push 0x51cdf4
push ecx
call ebp
push ebx
lea edx, [esp + 0x108]
push ebx
lea eax, [esp + 0x20]
push edx
push eax
push ebx
push ebx
lea ecx, [esp + 0x138]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x473451
cmp dword [esp + 0x18], 0xff
jb 0x473451
mov dword [esi + 0x8ac], 1
mov eax, dword [esi + 0x8ac]
push str..z01
cmp eax, ebx
je 0x47346c
lea edx, [esp + 0x924]
push edx
call ebp
jmp 0x473476
lea eax, [esp + 0x924]
push eax
call edi
lea ecx, [esp + 0x920]
lea edx, [esp + 0x1920]
push ecx
lea eax, [esp + 0x2124]
push edx
lea ecx, [esp + 0x1128]
lea edi, [esi + 0xac]
push eax
push ecx
push edi
call fcn.00483760
push edi
call fcn.0047e4e0
mov ebp, eax
add esp, 0x18
cmp ebp, ebx
jne 0x47350e
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x473689
mov edx, dword [esp + 0x54]
push esi
push edx
push 0x526974
push 0xa
call fcn.004792b0
mov eax, dword [esp + 0x20]
push eax
call fcn.00473b40
add esp, 0x14
mov dword [esi + 0x9c], ebx
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov ecx, dword [esp + 0x54]
push esi
push ecx
push 0x526974
push ebp
call fcn.004792b0
mov edx, dword [esp + 0x20]
push edx
call fcn.00473b40
add esp, 0x14
mov dword [esi + 0x9c], ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov eax, dword [esp + 0x5c]
lea ebp, [esi + 0x1e14]
push eax
push ebp
call fcn.00478bc0
push ebp
call fcn.004839c0
mov edi, dword [esi + 0x914]
push esi
push eax
mov dword [esi + 0x914], ebx
call fcn.00482a40
add esp, 0x14
cmp eax, ebx
mov dword [esi + 0x914], edi
jne 0x473649
push esi
push ebp
call fcn.00482af0
add esp, 8
cmp edx, ebx
jl 0x473649
jg 0x47359b
cmp eax, 0x200000
jb 0x473649
lea edi, [esi + 0xac]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi + 0xab], 0x5c
je 0x4735c6
push 0x51cdf4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1c]
push str.__XXXXXX
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ebp, 0x25
mov ecx, eax
div ebp
mov eax, 0xbacf914d
mov dl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x1c], dl
mul ecx
mov eax, ecx
mov ecx, ebp
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 5
div ecx
lea eax, [esp + 0x1c]
push eax
push edi
mov dl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x25], dl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.004e0673
add esp, 4
test eax, eax
je 0x473649
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xa8], eax
cmp dword [esi + 0xa8], 0xffffffff
jne 0x473689
mov ecx, dword [esp + 0x54]
push esi
push ecx
push 0x526974
push 0xa
call fcn.004792b0
mov edx, dword [esp + 0x20]
mov dword [esi + 0x9c], ebx
push edx
call fcn.00473b40
add esp, 0x14
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov eax, dword [esp + 0xf0]
mov ecx, 0x20
mov dword [esi + 0x8d0], eax
mov dword [esi + 0x8d4], ebx
mov eax, dword [esi + 0x8d0]
mov edx, ebx
call fcn.004b4b40
mov dword [esi + 0x8d0], eax
mov dword [esi + 0x8d4], edx
mov ecx, dword [esp + 0xe0]
mov edx, dword [esi + 0x8d0]
or edx, ecx
mov dword [esi + 0x8d0], edx
mov ecx, dword [esi + 0x8d4]
or ecx, ebx
mov dword [esi + 0x8d4], ecx
mov eax, dword [esp + 0xdc]
cmp eax, ebx
je 0x473712
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x473712
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x473712
mov dword [esi + 0x8c0], 1
mov edx, dword [esp + 0xdc]
mov dword [esi + 0x8d8], edx
mov eax, dword [esp + 0xc8]
cmp eax, ebx
je 0x47373d
mov eax, dword [eax + 4]
mov dword [esi + 0x908], eax
mov ecx, dword [esp + 0xc8]
mov edx, dword [ecx + 8]
mov dword [esi + 0x90c], edx
mov eax, dword [esp + 0xc8]
cmp dword [esi + 0x8f4], ebx
je 0x47374e
cmp eax, ebx
je 0x47378b
cmp dword [eax + 4], ebx
je 0x47378b
mov eax, dword [esp + 0x2c]
mov edi, 1
cmp eax, 6
jne 0x4737ad
mov eax, dword [esi + 0x8c0]
mov dword [esi + 0x8ec], edi
cmp eax, ebx
jne 0x47378b
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x47378b
mov eax, dword [esp + 0xc8]
cmp eax, ebx
je 0x47378b
cmp dword [eax + 4], ebx
jne 0x4737ad
mov eax, dword [esp + 0x54]
push esi
push eax
push 0x526974
push 0x10
call fcn.004792b0
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x9c], ebx
push ecx
jmp 0x473a51
cmp dword [esp + 0x2c], 7
jne 0x4737ef
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x47382f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x47382f
mov eax, dword [esp + 0xc8]
cmp eax, ebx
je 0x47382f
cmp dword [eax + 4], ebx
je 0x47382f
mov dword [esi + 0x8d0], ebx
mov dword [esi + 0x8c0], edi
mov dword [esi + 0x8c4], edi
mov dword [esi + 0x8d4], ebx
test byte [esp + 0xc6], 4
je 0x473818
mov dword [esi + 0xad0], ebx
mov dword [esi + 0xacc], edi
mov ecx, dword [esp + 0xc6]
and ecx, 8
push ecx
call fcn.00475f40
add esp, 4
mov eax, dword [esi + 0x8ec]
push esi
cmp eax, ebx
je 0x473851
lea edx, [esp + 0x2c]
push edx
call fcn.0047ce00
jmp 0x47385b
mov edx, dword [esp + 0x54]
push esi
push edx
push 0x526974
push 0x10
call fcn.004792b0
mov eax, dword [esp + 0x20]
mov dword [esi + 0x9c], ebx
push eax
jmp 0x473a51
lea eax, [esp + 0x2c]
push eax
call fcn.0047a6b0
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xac8]
add esp, 8
cmp eax, ebx
mov dword [esi + 0xacc], ebx
je 0x47387d
call fcn.00476070
mov dword [esi + 0xad0], ebx
mov eax, dword [esi + 0xa8]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 0xffffffff
je 0x4738b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [esi + 0x5735], 0x40
jne 0x4738a7
lea ecx, [esi + 0xac]
push ecx
call ebp
mov dword [esi + 0xa8], 0xffffffff
cmp dword [esp + 0x14], ebx
je 0x4738e1
test byte [esi + 0x5735], 0x40
je 0x4738e1
push edi
lea edi, [esi + 0x1614]
push edi
call fcn.004828b0
add esp, 8
lea edx, [esi + 0xac]
push edx
call ebp
push edi
call ebp
mov edi, 1
mov eax, dword [esi + 0xb82c]
mov dword [esi + 0x4ecc], ebx
cmp eax, edi
jne 0x47399e
cmp dword [esp + 0x14], ebx
jne 0x47399e
push ebx
push 0x80
push 3
push ebx
push 1
lea ebp, [esi + 0x1614]
push SysReAllocString
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x47399e
lea eax, [esp + 0x108]
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x114]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x473997
lea eax, [esi + 0x56d0]
lea ecx, [esp + 0x108]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x473997
push edi
call fcn.0047e720
add esp, 4
mov dword [esi + 0x56d8], eax
mov dword [esi + 0x56dc], edx
lea edx, [esi + 0x4ed0]
push 0x800
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + 0x56cf], bl
mov dword [esi + 0x4ecc], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x4ecc], ebx
jne 0x4739af
push esi
call fcn.00478f60
add esp, 4
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x14]
push esi
push eax
push 0x526974
push ecx
call fcn.004792b0
mov edx, dword [esp + 0x20]
mov dword [esi + 0x9c], ebx
push edx
call fcn.00473b40
mov eax, dword [esi + 0x5724]
add esp, 0x14
cmp eax, ebx
je 0x473a27
mov eax, dword [esi + 0x5728]
cmp eax, ebx
jle 0x473a12
xor edi, edi
cmp eax, ebx
jle 0x473a12
mov eax, dword [esi + 0x5724]
mov eax, dword [eax + edi*8]
cmp eax, ebx
je 0x473a07
push eax
call fcn.004ad74d
add esp, 4
mov eax, dword [esi + 0x5728]
inc edi
cmp edi, eax
jl 0x4739f1
mov ecx, dword [esi + 0x5724]
push ecx
call fcn.004ad74d
add esp, 4
mov dword [esi + 0x5724], ebx
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4
mov edx, dword [esp + 0x54]
push esi
push edx
push 0x526974
push 0x10
call fcn.004792b0
mov dword [esi + 0x9c], ebx
push edi
call fcn.00473b40
add esp, 0x14
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2910
ret 4