Function at 0x41af00
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451a2e
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4643c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, 7
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xc4], esi
mov word [ebp - 0xd4], cx
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x5c], dx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x9c], cx
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], esi
mov word [ebp - 0x80], dx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x44c], esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], ax
lea ecx, [ebp - 0x40]
push ecx
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str._04d__02d__02d__02d__02d__02d__03d
lea ebx, [ebp - 0x43c]
call fcn.00407f10
lea edx, [ebp - 0x40]
push edx
mov byte [ebp - 4], 6
call fcn.00414dc0
lea ecx, [ebp - 0x3e]
add esp, 4
push ecx
call fcn.00414dc0
lea edx, [ebp - 0x3a]
add esp, 4
push edx
call fcn.00414dc0
lea ecx, [ebp - 0x38]
add esp, 4
push ecx
call fcn.00414dc0
lea edx, [ebp - 0x36]
add esp, 4
push edx
call fcn.00414dc0
lea ecx, [ebp - 0x34]
add esp, 4
push ecx
call fcn.00414dc0
lea edx, [ebp - 0x32]
add esp, 4
push edx
call fcn.00414dc0
add esp, 4
mov ecx, eax
lea esi, [ebp - 0x30]
call fcn.00408030
mov ebx, edi
mov byte [ebp - 4], bl
mov edi, eax
lea esi, [ebp - 0xb8]
call fcn.00407630
cmp dword [ebp - 0x1c], 8
jb 0x41b05b
mov eax, dword [ebp - 0x30]
push eax
call fcn.0043644d
add esp, 4
lea edx, [ebp - 0x43c]
xor ecx, ecx
xor esi, esi
push edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
mov word [ebp - 0x30], cx
mov byte [ebp - 4], 5
call fcn.00407140
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x444], esp
xor eax, eax
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x10], esi
push esi
mov word [ecx], ax
push 0x4660f0
or eax, 0xffffffff
call fcn.004138c0
lea ecx, [ebp - 0x10c]
call fcn.00432860
add esp, 0x1c
mov edi, eax
lea esi, [ebp - 0x5c]
mov byte [ebp - 4], 8
call fcn.00407630
mov byte [ebp - 4], 5
cmp dword [ebp - 0xf8], 8
jb 0x41b0d5
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.0043644d
add esp, 4
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov dword [ebp - 0x444], esp
push edx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x10], 0
push 0x4660f0
or eax, 0xffffffff
mov word [ecx], dx
call fcn.004138c0
lea ecx, [ebp - 0xf0]
call fcn.00432920
add esp, 0x1c
mov esi, eax
push 0x457918
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov byte [ebp - 4], 9
call fcn.00408320
add esp, 0xc
mov ecx, eax
lea eax, [ebp - 0xb8]
lea ebx, [ebp - 0x144]
mov byte [ebp - 4], 0xa
call fcn.004082e0
push eax
mov eax, 0x457918
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0xb
call fcn.00407910
add esp, 4
mov ecx, eax
mov eax, esi
lea ebx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.004190d0
mov edi, eax
lea esi, [ebp - 0xd4]
mov byte [ebp - 4], 0xd
call fcn.00407630
cmp dword [ebp - 0x1c], 8
jb 0x41b18b
mov edx, dword [ebp - 0x30]
push edx
call fcn.0043644d
add esp, 4
xor ebx, ebx
xor eax, eax
mov edi, 8
mov esi, 7
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
cmp dword [ebp - 0x114], edi
jb 0x41b1ba
mov ecx, dword [ebp - 0x128]
push ecx
call fcn.0043644d
add esp, 4
xor edx, edx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], ebx
mov word [ebp - 0x128], dx
cmp dword [ebp - 0x130], edi
jb 0x41b1e6
mov eax, dword [ebp - 0x144]
push eax
call fcn.0043644d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], ebx
mov word [ebp - 0x144], cx
cmp dword [ebp - 0xf8], edi
jb 0x41b212
mov edx, dword [ebp - 0x10c]
push edx
call fcn.0043644d
add esp, 4
xor eax, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xfc], ebx
mov word [ebp - 0x10c], ax
cmp dword [ebp - 0xdc], edi
jb 0x41b242
mov ecx, dword [ebp - 0xf0]
push ecx
call fcn.0043644d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x444], esp
push ebx
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push 0x4660f0
or eax, 0xffffffff
mov word [ecx], dx
call fcn.004138c0
lea ecx, [ebp - 0xf0]
call fcn.004329e0
add esp, 0x1c
mov edi, eax
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 0xe
call fcn.00407630
mov byte [ebp - 4], 5
cmp dword [ebp - 0xdc], 8
jb 0x41b2a1
mov eax, dword [ebp - 0xf0]
push eax
call fcn.0043644d
add esp, 4
mov ecx, dword [ebp - 0xd4]
mov eax, 8
cmp dword [ebp - 0xc0], eax
jae 0x41b2ba
lea ecx, [ebp - 0xd4]
cmp dword [0x466104], eax
mov eax, dword [0x4660f0]
jae 0x41b2cc
mov eax, 0x4660f0
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.00432ce0
mov dword [ebp - 0x444], eax
push 1
mov eax, 0x457934
lea ecx, [ebp - 0x5c]
call fcn.00408740
push ebx
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x458], esp
push ebx
lea eax, [ebp - 0x5c]
xor edx, edx
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
lea esi, [ebp - 0x440]
lea edi, [ebp - 0x394]
mov word [ecx], dx
call fcn.004138c0
mov edx, esi
mov ecx, edi
call fcn.00432140
add esp, 0x24
cmp eax, ebx
jne 0x41b599
cmp dword [ebp - 0x440], 0xffffffff
je 0x41b599
xor ecx, ecx
lea eax, [ebp - 0x368]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b360
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x368]
lea esi, [ebp - 0x30]
call fcn.00413470
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x20]
mov esi, eax
cmp eax, 1
jb 0x41b391
mov esi, 1
cmp dword [ebp - 0x1c], 8
mov edx, dword [ebp - 0x30]
jae 0x41b39d
lea edx, [ebp - 0x30]
mov ecx, 0x457918
cmp esi, ebx
jbe 0x41b3c3
mov di, word [edx]
cmp di, word [ecx]
jne 0x41b3b9
add edx, 2
add ecx, 2
dec esi
jne 0x41b3a6
jmp 0x41b3c3
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
cmp ecx, ebx
jne 0x41b3d7
cmp eax, 1
jae 0x41b3cd
or ecx, 0xffffffff
jmp 0x41b3d5
xor ecx, ecx
cmp eax, 1
setne cl
cmp ecx, ebx
sete cl
test cl, cl
jne 0x41b493
push 0x458078
mov edi, 2
lea ecx, [ebp - 0x30]
call fcn.00415c00
test eax, eax
je 0x41b493
test byte [ebp - 0x394], 0x10
je 0x41b41c
mov byte [ebp - 4], 5
cmp dword [ebp - 0x1c], 8
jb 0x41b4a9
mov eax, dword [ebp - 0x30]
push eax
jmp 0x41b4a1
mov ecx, dword [ebp - 0x380]
mov edx, dword [ebp - 0x37c]
lea eax, [ebp - 0x368]
mov dword [ebp - 0x64], ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x60], edx
push ecx
lea edx, [ebp - 0xf0]
push edx
call fcn.00408320
add esp, 0xc
mov edi, eax
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 0x10
call fcn.00407630
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0xdc], 8
jb 0x41b475
mov eax, dword [ebp - 0xf0]
push eax
call fcn.0043644d
add esp, 4
lea ecx, [ebp - 0x80]
lea edi, [ebp - 0x454]
call fcn.0041b700
mov byte [ebp - 4], 5
cmp dword [ebp - 0x1c], 8
jb 0x41b4a9
mov ecx, dword [ebp - 0x30]
push ecx
jmp 0x41b4a1
mov byte [ebp - 4], 5
cmp dword [ebp - 0x1c], 8
jb 0x41b4a9
mov edx, dword [ebp - 0x30]
push edx
call fcn.0043644d
add esp, 4
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x394]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b347
mov edi, dword [ebp - 0x450]
mov ebx, dword [ebp - 0x454]
mov ecx, edi
sub ecx, ebx
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 6
jbe 0x41b53e
push 0
push 0x419b30
push 0x24
push esi
push ebx
call fcn.004371c0
add esp, 0x14
cmp esi, 6
jbe 0x41b53e
add ebx, 0xd8
add esi, 0xfffffffa
lea esp, [esp]
call fcn.00431b80
cmp dword [ebx + 0x14], 8
jb 0x41b51f
mov eax, dword [ebx]
jmp 0x41b521
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41b532
call dword [sym.imp.KERNEL32.dll_GetLastError]
add ebx, 0x24
dec esi
jne 0x41b510
mov ebx, dword [ebp - 0x454]
cmp ebx, edi
je 0x41b5a5
push edi
mov ecx, ebx
mov eax, edi
call fcn.0041bce0
add esp, 4
mov dword [ebp - 0x440], eax
mov esi, eax
cmp eax, edi
je 0x41b58b
jmp 0x41b560
cmp dword [esi + 0x14], 8
jb 0x41b571
mov edx, dword [esi]
push edx
call fcn.0043644d
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x24
cmp esi, edi
jne 0x41b560
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x450], ecx
jmp 0x41b59f
mov ebx, dword [ebp - 0x454]
mov edi, dword [ebp - 0x450]
cmp dword [ebp - 0xa4], 8
jb 0x41b5bd
mov edx, dword [ebp - 0xb8]
push edx
call fcn.0043644d
add esp, 4
xor esi, esi
xor eax, eax
mov dword [ebp - 0xa4], 7
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], ax
cmp ebx, esi
je 0x41b618
mov esi, ebx
cmp ebx, edi
je 0x41b60d
cmp dword [esi + 0x14], 8
jb 0x41b5f3
mov ecx, dword [esi]
push ecx
call fcn.0043644d
add esp, 4
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], dx
add esi, 0x24
cmp esi, edi
jne 0x41b5e2
push ebx
call fcn.0043644d
add esp, 4
xor esi, esi
mov edi, 8
cmp dword [ebp - 0x6c], edi
jb 0x41b62e
mov eax, dword [ebp - 0x80]
push eax
call fcn.0043644d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], esi
mov word [ebp - 0x80], cx
cmp dword [ebp - 0x88], edi
jb 0x41b655
mov edx, dword [ebp - 0x9c]
push edx
call fcn.0043644d
add esp, 4
xor eax, eax
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x9c], ax
cmp dword [ebp - 0x48], edi
jb 0x41b67f
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.0043644d
add esp, 4
xor edx, edx
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x5c], dx
cmp dword [ebp - 0xc0], edi
jb 0x41b6a6
mov eax, dword [ebp - 0xd4]
push eax
call fcn.0043644d
add esp, 4
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436268
mov esp, ebp
pop ebp
ret