Function at 0x41e8d0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x570578
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xf564]
cmp dword [edi + 0x5c], 0xffffffff
je 0x41ece6
mov eax, dword [esp + 0x438]
xor ebp, ebp
cmp eax, ebp
je 0x41e951
mov eax, dword [edi + 0x30]
push ebp
cdq
add eax, 0xb6109100
push 0x989680
adc edx, 2
push edx
push eax
call fcn.00541d90
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [edi + 8], ebp
jne 0x41e93c
test dword [edi + 0x30], 0xffffff00
je 0x41e951
mov edx, dword [edi + 0x5c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esi + 0xf564]
mov ecx, dword [eax + 0x48]
mov edi, dword [eax + 0x78]
mov edx, dword [eax + 0x4c]
add edi, ecx
mov dword [eax + 0x78], edi
mov ecx, dword [eax + 0x7c]
adc ecx, edx
mov dword [eax + 0x7c], ecx
mov eax, dword [esi + 0xf564]
mov ecx, dword [eax + 0x48]
mov edi, dword [eax + 0x70]
mov edx, dword [eax + 0x4c]
add edi, ecx
mov dword [eax + 0x70], edi
mov edi, dword [eax + 0x74]
adc edi, edx
mov dword [eax + 0x74], edi
mov eax, dword [esi + 0xf564]
mov ecx, dword [eax + 0x88]
inc ecx
mov dword [eax + 0x88], ecx
mov eax, dword [esi + 0xf564]
mov edi, dword [eax + 0x8c]
inc edi
mov dword [eax + 0x8c], edi
mov eax, dword [esi + 0xf564]
mov dword [eax + 0x50], ebp
mov dword [eax + 0x54], ebp
mov ecx, dword [esi + 0xf564]
mov dword [ecx + 0x48], ebp
mov dword [ecx + 0x4c], ebp
mov edx, dword [esi + 0xf564]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0xf564]
mov dword [ecx + 0x5c], 0xffffffff
mov eax, dword [esi + 0xf564]
mov ecx, dword [eax + 8]
lea edx, [eax + 0x198]
cmp ecx, ebp
jne 0x41e9fd
lea edx, [eax + 0x94]
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
je 0x41ea08
mov eax, ecx
jmp 0x41ea0b
mov eax, dword [eax + 0x20]
push eax
push edx
lea edx, [esp + 0x30]
push edx
call fcn.00438a60
add esp, 0xc
cmp eax, 0x104
jl 0x41ea3a
push ebp
lea eax, [esp + 0x2c]
push 0x5d8664
push eax
mov ecx, esi
call fcn.0055b864
xor eax, eax
jmp 0x41eceb
mov eax, dword [esi + 0xf564]
add eax, 0x10
mov ecx, dword [eax + 0xc]
cmp ecx, ebp
je 0x41ea4e
mov eax, ecx
jmp 0x41ea51
mov eax, dword [eax + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.004389e0
add esp, 8
test eax, eax
jne 0x41ea7c
push ebp
lea edx, [esp + 0x2c]
push 0x5d8654
push edx
mov ecx, esi
call fcn.0055b864
xor eax, eax
jmp 0x41eceb
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
call fcn.0055969a
push str..fiq
lea ecx, [esp + 0x14]
mov dword [esp + 0x434], ebp
call fcn.00559a08
mov eax, dword [esi + 0xf564]
mov ecx, dword [eax + 0x90]
cmp ecx, 8
je 0x41eac3
cmp ecx, 7
je 0x41eac3
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
or ecx, edx
jne 0x41ecd2
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00541d62
add esp, 8
test eax, eax
je 0x41ecd2
mov ecx, dword [0x5e8e38]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x28]
lea eax, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x438], 1
call fcn.004c3520
add esp, 8
mov eax, dword [esi + 0xf564]
mov byte [esp + 0x430], 2
add eax, 0x10
mov ecx, dword [eax + 0xc]
cmp ecx, ebp
je 0x41eb28
mov eax, ecx
jmp 0x41eb2b
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 0x24]
call fcn.0055969a
lea ecx, [esp + 0x24]
push str._feiq_
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x43c], 3
call fcn.005598c1
lea ecx, [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x43c], 4
call fcn.0055985b
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x434], 5
call fcn.00559765
lea ecx, [esp + 0xc]
mov byte [esp + 0x430], 4
call fcn.0055962c
lea ecx, [esp + 0x18]
mov byte [esp + 0x430], 3
call fcn.0055962c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00541d62
add esp, 8
test eax, eax
je 0x41ec28
mov edx, dword [0x5e8e38]
mov dword [esp + 0xc], edx
mov eax, dword [esi + 0xf564]
mov byte [esp + 0x430], 6
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
jne 0x41ebd5
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
cmp edx, ebp
je 0x41ebe0
mov eax, edx
jmp 0x41ebe3
mov eax, dword [eax + 0x20]
push ecx
push eax
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push eax
push 0x5d85e8
push ecx
call fcn.00554dd4
add esp, 0x14
lea edx, [esp + 0xc]
push 0xff
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.005593a1
mov ecx, esi
call fcn.00424080
mov byte [esp + 0x430], 3
lea ecx, [esp + 0xc]
jmp 0x41ec9a
mov eax, dword [0x5e8e38]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xf564]
mov byte [esp + 0x430], 7
mov ecx, dword [eax + 0x1c]
cmp ecx, ebp
jne 0x41ec49
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
cmp edx, ebp
je 0x41ec54
mov eax, edx
jmp 0x41ec57
mov eax, dword [eax + 0x20]
push ecx
lea ecx, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0x5d8588
push edx
call fcn.00554dd4
add esp, 0x14
lea eax, [esp + 0xc]
push 0xff
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.005593a1
mov ecx, esi
call fcn.00424080
mov byte [esp + 0x430], 3
lea ecx, [esp + 0xc]
call fcn.0055962c
lea ecx, [esp + 0x20]
mov byte [esp + 0x430], 2
call fcn.0055962c
lea ecx, [esp + 0x24]
mov byte [esp + 0x430], 1
call fcn.0055962c
lea ecx, [esp + 0x14]
mov byte [esp + 0x430], 0
call fcn.0055962c
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], 0xffffffff
call fcn.0055962c
mov eax, 1
mov ecx, dword [esp + 0x428]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x428
ret 4