Function at 0x4a0860
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bba00
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push str.AdobeGCData_folder:_checking_for_junction_symlink
push 0
push 4
push 0x715514
push dword [0x7f52bc]
mov dword [ebp - 0x74], esi
call fcn.00562650
mov ecx, esi
mov dword [ebp - 0x48], 0
add esp, 0x14
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a08c3
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x58]
call fcn.0049dd10
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov ecx, esi
mov dword [edx + 0x10], 0
lea edi, [ecx + 1]
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a08f8
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.0049dd10
call fcn.004c7be0
add esp, 0x18
test al, al
je 0x4a09e0
push str.AdobeGCData_folder_is_a_junction__deleting_it_and_creating_new_again
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x58]
add esp, 0x14
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x44], 0x10
lea edi, [ebp - 0x58]
mov dword [ebp - 0x2c], 7
cmovae edx, dword [ebp - 0x58]
add eax, edx
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x7c], eax
cmovae edi, dword [ebp - 0x58]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0x40], cx
push eax
lea ecx, [ebp - 0x40]
call fcn.004907a0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x7c]
push edi
call fcn.0049cae0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 0x74]
call fcn.004bfa70
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 8
jb 0x4a0d19
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0d0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d66
jmp 0x4a0d0f
push 1
sub esp, 0x18
mov ecx, esi
mov edx, esp
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a0a00
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.0049dd10
call fcn.004c5c50
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4a0d19
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x715714
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a03d0
add esp, 0xc
push 0xe
push str.AdobeGCData.db
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0049dbb0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a0ac0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0aad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d6b
push edx
push ecx
call fcn.006391f8
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.004879e0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048c060
call fcn.004c7be0
add esp, 0x18
test al, al
je 0x4a0b1c
push str.AdobeGCData.db_is_a_symlink__deleting_it
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00662f66
add esp, 0x18
push 0x715714
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a03d0
add esp, 0xc
push 0x15
push str.AdobeGCLaunchEvent.db
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0049dbb0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a0ba2
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0b8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d70
push edx
push ecx
call fcn.006391f8
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.004879e0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048c060
call fcn.004c7be0
add esp, 0x18
test al, al
je 0x4a0bfe
push str.AdobeGCLaunchEvent.db_is_a_symlink__deleting_it
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00662f66
add esp, 0x18
push 0x715714
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a03d0
add esp, 0xc
push 0x13
push str.AdobeNGLAppIDMap.db
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0049dbb0
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a0c84
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0c71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d75
push edx
push ecx
call fcn.006391f8
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.004879e0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048c060
call fcn.004c7be0
add esp, 0x18
test al, al
je 0x4a0ce0
push str.AdobeNGLAppIDMap.db_is_a_symlink__deleting_it
push 0
push 4
push 0x715514
push dword [0x7f52bc]
call fcn.00562650
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00662f66
add esp, 0x18
push esi
call fcn.004c71e0
mov edx, dword [ebp - 0x14]
add esp, 4
cmp edx, 0x10
jb 0x4a0d19
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0d0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d7a
push edx
push ecx
call fcn.006391f8
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x4a0d49
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a0d3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a0d7f
push edx
push ecx
call fcn.006391f8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret 4
call fcn.00657f14
call fcn.00657f14
call fcn.00657f14
call fcn.00657f14
call fcn.00657f14
call fcn.00657f14
int3