Function at 0x41316d
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
push ebx
mov ebx, dword [edi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 8]
mov dword [ebp - 0x1c], edx
xor edx, edx
mov word [ecx], dx
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x18], eax
mov al, byte [ecx + 0x13]
mov dword [ebp - 0xc], esi
mov byte [ebp - 5], 1
mov byte [ebp - 3], 0
mov byte [ebp - 1], 0x73
call fcn.0041277c
test eax, eax
je 0x4131ca
mov al, byte [0x49c179]
mov byte [ebp - 2], al
mov al, byte [0x49c178]
jmp 0x4131d7
mov al, byte [0x49c17b]
mov byte [ebp - 2], al
mov al, byte [0x49c17a]
cmp dword [ecx + 8], 4
mov byte [ebp - 4], al
je 0x4131e9
mov byte [ebp - 1], 0x73
jmp 0x4132f0
push esi
call fcn.0046ab80
pop ecx
cmp eax, 1
jne 0x4131fe
mov byte [ebp - 1], 0x6e
jmp 0x4132f0
cmp eax, 2
jne 0x41320c
mov byte [ebp - 1], 0x6f
jmp 0x4132f0
mov al, byte [ebp - 2]
and dword [ebp - 0x10], 0
mov byte [ebp - 2], al
cmp dword [ebp - 0x10], 8
jae 0x4132f0
inc dword [ebp - 0x10]
cmp byte [ebp - 2], 1
je 0x41322f
cmp byte [ebp - 2], 2
jne 0x41324a
cmp dword [ebp - 0x10], 1
jne 0x4132ec
cmp byte [ebx + 0x1168], 2
jne 0x4132ec
mov byte [ebp - 2], 3
cmp byte [ebp - 2], 9
je 0x413466
cmp byte [ebx + 0x11], 4
je 0x413484
cmp dword [ebp - 0x10], 1
jne 0x413279
push str..backup
push esi
mov esi, dword [ebp - 0x14]
mov eax, edi
call fcn.0041242a
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
mov al, byte [ebx + 0x11]
cmp al, 6
je 0x413284
cmp al, 1
jne 0x4132c8
push esi
mov eax, edi
call fcn.00412510
cmp byte [ebx + 0x12], 6
pop ecx
jne 0x4132c8
mov al, byte [ebx + 0x11]
push esi
push esi
mov byte [ebp - 6], al
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov eax, edi
call fcn.00412510
cmp byte [ebx + 0x11], 5
pop ecx
jne 0x413216
cmp byte [ebx + 0x12], 7
jne 0x413216
mov al, byte [ebp - 6]
mov byte [ebx + 0x11], al
mov byte [ebx + 0x12], 6
mov al, byte [ebx + 0x11]
cmp al, 5
je 0x4132ec
cmp al, 3
je 0x4134a1
cmp al, 2
jne 0x413381
cmp dword [0x49c414], 0
jne 0x41345d
mov byte [ebp - 1], 0x78
mov ecx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp word [ecx], ax
je 0x413334
cmp byte [ebp - 3], al
je 0x413325
lea ecx, [edi + 0x38]
push ecx
push eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.00412d91
add esp, 0x1c
push 0x80
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call ebx
cmp byte [ebp - 1], 0x68
jne 0x41334e
push dword [ebp - 0x20]
call fcn.00411507
push dword [ebp - 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp byte [ebp - 5], 0
je 0x41336a
mov eax, dword [ebp - 0x18]
cmp word [eax], 0
je 0x41336a
push 0x80
push eax
call esi
push dword [ebp - 0x18]
call ebx
cmp byte [ebp - 1], 0x70
pop esi
pop ebx
jne 0x413376
mov byte [ebp - 1], 0x78
mov al, byte [ebp - 1]
mov byte [edi + 0x21], al
movzx eax, al
leave
ret
cmp al, 1
jne 0x413450
mov al, byte [ebx + 0x12]
cmp al, 6
je 0x4134ba
cmp al, 0xa
jne 0x4133c2
cmp dword [0x49c414], 0
jne 0x41345d
mov al, byte [ebp - 4]
cmp al, 1
je 0x4133b9
cmp al, 2
je 0x4133b9
cmp byte [ebp - 2], al
jne 0x413213
mov byte [ebp - 1], 0x6a
jmp 0x4132f0
cmp al, 0x10
jne 0x4133dc
cmp dword [0x49c414], 0
jne 0x41345d
mov byte [ebp - 1], 0x77
jmp 0x4132f0
cmp al, 9
je 0x4133e8
cmp al, 8
jne 0x4132ec
push str..cleaned
push esi
mov esi, dword [ebp - 0x18]
mov eax, edi
call fcn.0041242a
pop ecx
pop ecx
mov byte [ebp - 1], al
test al, al
jne 0x4132f0
push dword [edi + 0x1c]
mov eax, edi
call fcn.00412510
cmp byte [ebx + 0x12], 6
pop ecx
je 0x4134ce
cmp dword [0x49c414], 0
je 0x41342f
mov byte [ebp - 2], 9
mov esi, dword [ebp - 0xc]
jmp 0x413216
mov al, byte [ebp - 4]
cmp al, 1
je 0x4132f0
cmp al, 2
je 0x4132f0
cmp byte [ebp - 2], al
je 0x4132f0
mov byte [ebp - 2], al
jmp 0x413427
cmp dword [0x49c414], 0
je 0x4132f0
mov byte [ebp - 2], 9
jmp 0x413216
lea eax, [edi + 0x38]
push eax
push edi
push 1
push 0x20
push dword [ebp - 0x1c]
push esi
push esi
call fcn.00412d91
add esp, 0x1c
mov byte [ebp - 1], al
jmp 0x4132f0
cmp byte [0x49c410], 9
jne 0x413498
lea eax, [edi + 0x38]
push eax
push edi
push 1
push 2
jmp 0x41346f
mov byte [ebp - 1], 0x74
jmp 0x4132f0
push 0
push edi
mov eax, esi
mov byte [ebp - 3], 1
mov dword [ebp - 0x10], 2
call fcn.00413084
pop ecx
pop ecx
jmp 0x41347c
mov byte [ebp - 3], 1
mov dword [ebp - 0x10], 4
mov byte [ebp - 1], 0x68
jmp 0x4132f0
push dword [ebp - 0xc]
mov eax, edi
push esi
mov byte [ebp - 3], 1
mov dword [ebp - 0x10], 4
call fcn.004124ac
pop ecx
pop ecx
mov byte [ebp - 1], al
cmp al, 0x69
jne 0x4134f1
mov byte [ebp - 5], 0
push dword [ebp - 0x20]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x4132f0