Function at 0x41e380
Capabilities:
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bbfa
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5d7ce0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x10]
push str.Wow64DisableWow64FsRedirection
xor esi, esi
push str.kernel32
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x244], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x248], eax
cmp eax, esi
je 0x41e404
lea ecx, [ebp - 0x244]
push ecx
call eax
mov dword [ebp - 4], esi
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41e421
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 1
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41e451
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 2
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41e481
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41e4b1
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x23c], eax
push 1
lea ecx, [ebp - 0x238]
push ecx
push ecx
mov byte [ebp - 4], 4
mov edi, esp
mov dword [ebp - 0x224], esp
mov dword [ebp - 0x224], edi
call fcn.0044d418
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x41e4f9
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str.strDeleteFile
mov byte [ebp - 4], 5
test ecx, 0xffff0000
jne 0x41e532
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.0044d834
cmp eax, esi
je 0x41e540
push ebx
push eax
mov ecx, edi
call fcn.004074b0
jmp 0x41e540
push 0xd
push str.strDeleteFile
mov ecx, edi
call fcn.00407870
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x234]
mov byte [ebp - 4], 4
mov ebx, dword [ebp - 0x220]
push esi
call fcn.0043b9d0
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x41e656
mov ecx, 0xa0000001
lea esi, [ebp - 0x220]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0040d290
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e5a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x240]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e5db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e601
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e627
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41ef97
push 1
lea ecx, [ebp - 0x23c]
push ecx
push ecx
mov edi, esp
mov dword [ebp - 0x224], esp
mov dword [ebp - 0x224], edi
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41e688
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str.iSystemBits
mov byte [ebp - 4], 7
test ecx, 0xffff0000
jne 0x41e6c1
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.0044d834
test eax, eax
je 0x41e6cf
push ebx
push eax
mov ecx, edi
call fcn.004074b0
jmp 0x41e6cf
push 0xb
push str.iSystemBits
mov ecx, edi
call fcn.00407870
mov edi, dword [ebp - 0x234]
mov byte [ebp - 4], 4
mov ebx, dword [ebp - 0x220]
push esi
call fcn.0043b9d0
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x41e7e2
mov ecx, 0xa0000001
lea esi, [ebp - 0x220]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.0040d290
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e735
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x240]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e767
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e78d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e7b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41ef97
mov edi, dword [ebp - 0x23c]
push edi
call fcn.0054df0d
add esp, 4
cmp dword [0x5d9fb8], 0
mov esi, eax
je 0x41e847
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e83d
lea ecx, [ebp - 0x27c]
push ecx
call eax
mov ax, word [ebp - 0x27c]
cmp ax, 9
je 0x41e833
cmp ax, 6
jne 0x41e83d
mov dword [0x5e0c44], 1
mov dword [0x5d9fb8], 0
test esi, esi
je 0x41e859
cmp esi, 1
jne 0x41e89a
cmp dword [0x5e0c44], 0
jne 0x41e8a8
mov ebx, dword [ebp - 0x238]
push ecx
mov dword [ebp - 0x224], esp
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41e94d
cmp eax, dword [ebx]
jne 0x41e94d
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41e989
cmp esi, 2
jne 0x41e8a8
cmp dword [0x5e0c44], 0
jne 0x41e859
lea eax, [edi - 0x10]
mov dword [ebp - 0x228], 1
mov byte [ebp - 4], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e8d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e8f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e91e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41ef97
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41e966
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x224]
call fcn.0044a6f0
add esp, 4
mov byte [ebp - 4], 9
push eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x220], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x41e9cd
cmp eax, dword [ebx]
jne 0x41e9cd
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41ea09
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41e9e6
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x250]
call fcn.0044a7b0
add esp, 4
push eax
lea edx, [ebp - 0x24c]
push edx
mov byte [ebp - 4], 0xa
call fcn.004135f0
add esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
mov edi, dword [ebp - 0x22c]
lea esi, [eax - 0x10]
add edi, 0xfffffff0
cmp esi, edi
je 0x41eb03
cmp dword [edi + 0xc], 0
jl 0x41eaf3
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x41eaf3
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x41ea83
cmp eax, dword [esi]
jne 0x41ea83
mov dword [ebp - 0x220], esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x41eac9
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x41eaa0
call fcn.0043d450
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x220]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
lea edx, [eax + eax + 2]
push edx
add esi, 0x10
push esi
lea eax, [eax + eax + 2]
push eax
add ecx, 0x10
push ecx
call fcn.0054de82
add esp, 0x10
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41eae2
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x10
mov dword [ebp - 0x22c], ecx
jmp 0x41eb03
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x22c]
call fcn.00407870
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41eb29
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41eb4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41eb75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov dword [ebp - 0x224], esp
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41eba1
cmp eax, dword [ebx]
jne 0x41eba1
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41ebdd
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41ebba
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x224]
call fcn.0044a990
add esp, 4
mov byte [ebp - 4], 0xc
mov edx, dword [eax]
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
mov dword [ebp - 0x220], eax
cmp esi, eax
je 0x41ecc1
cmp dword [eax + 0xc], 0
jl 0x41ecb1
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x41ecb1
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x41ec45
cmp eax, dword [esi]
jne 0x41ec45
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41ec81
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x41ec5e
call fcn.0043d450
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0054de82
add esp, 0x10
mov eax, dword [ebp - 0x220]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41eca6
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 0x10
mov dword [ebp - 0x230], edi
jmp 0x41ecc1
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [ebp - 0x230]
call fcn.00407870
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ece7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x224], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41ed13
cmp eax, dword [ebx]
jne 0x41ed13
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41ed4f
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41ed2c
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
call fcn.0044aaa0
add esp, 4
test eax, eax
je 0x41ee6d
mov edi, dword [ebp - 0x238]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x41ed87
and eax, 0xfffffffe
jne 0x41ed7f
mov eax, 0x80
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
jne 0x41ee65
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.00550f40
mov edx, dword [ebp - 0x230]
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push esi
push 0x5ae6f8
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x41ee65
push 1
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41ee25
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 0x254]
mov esi, eax
mov dword [ebp - 0x228], esi
mov dword [edx], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ee79
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
jne 0x41ee65
push 2
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push esi
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
mov dword [ebp - 0x228], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ee79
mov eax, dword [ebp - 0x258]
mov esi, dword [ebp - 0x228]
test esi, esi
jne 0x41eee5
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov edx, dword [ebp - 0x240]
mov dword [edx], ecx
mov ecx, eax
lea esi, [ebp - 0x220]
call fcn.0041ae20
mov edx, dword [ebp - 0x234]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x220]
mov esi, dword [ebp - 0x22c]
mov eax, dword [edi + 0x2c]
push ecx
push esi
push eax
push edx
call fcn.00409220
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41ef0e
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x22c]
mov dword [ecx], 2
mov eax, dword [edx + 0x30]
push esi
push eax
mov eax, dword [ebp - 0x234]
push eax
call fcn.00409220
add esp, 0xc
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef97
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x248], 0
je 0x41efcb
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41efcb
mov ecx, dword [ebp - 0x244]
push ecx
call eax
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054bd91
mov esp, ebp
pop ebp
ret