Function at 0x4473d1
Capabilities:
Delete file
Inspect section memory permissions

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x974]
mov ecx, dword [eax + 0x10c]
push edi
xor edi, edi
cmp ecx, edi
jne 0x4473f3
cmp dword [eax + 0x110], edi
je 0x4477ba
test cl, 0x10
je 0x447404
push dword [esi + 0xa30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x974]
push ebx
xor ebx, ebx
inc ebx
test byte [eax + 0x110], 2
jne 0x447424
cmp dword [eax + 0x10], edi
je 0x447424
mov dword [esi + 0xb00], ebx
jmp 0x44742a
mov dword [esi + 0xb00], edi
test byte [eax + 0x110], 4
je 0x447439
mov dword [esi + 0xad8], ebx
test dword [eax + 0x10c], 0x20000000
je 0x44744b
mov dword [esi + 0xb00], ebx
mov ecx, 0x40000
test dword [eax + 0x10c], ecx
je 0x44745e
mov dword [esi + 0xb98], ebx
test dword [eax + 0x10c], 0x40000000
je 0x447470
mov dword [esi + 0xbb8], ebx
test byte [eax + 0x110], 0x20
je 0x44747f
mov dword [esi + 0xb10], edi
test byte [eax + 0x10c], 0x40
je 0x44748e
mov dword [esi + 0xb14], ebx
test byte [eax + 0x110], 0x80
je 0x44749d
mov dword [esi + 0xb18], ebx
test dword [eax + 0x110], 0x200
je 0x4474af
mov dword [esi + 0xb1c], ebx
test dword [eax + 0x110], ecx
je 0x4474bd
mov dword [esi + 0xb28], edi
test byte [eax + 0x10c], 4
je 0x4474c9
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x974]
test dword [eax + 0x10c], 0x1000
je 0x4474e8
lea eax, [esi + 0x978]
push eax
call fcn.00446fc0
pop ecx
mov eax, dword [esi + 0x974]
test dword [eax + 0x10c], 0x2000
je 0x447507
lea eax, [esi + 0x978]
push eax
call fcn.00446faf
pop ecx
mov eax, dword [esi + 0x974]
test dword [eax + 0x10c], 0x4000
je 0x447526
lea eax, [esi + 0x978]
push eax
call fcn.00446fd1
pop ecx
mov eax, dword [esi + 0x974]
test dword [eax + 0x10c], 0x8000
je 0x447545
lea eax, [esi + 0x978]
push eax
call fcn.00446fe2
pop ecx
mov eax, dword [esi + 0x974]
test byte [eax + 0x110], 8
je 0x44755a
mov dword [esi + 0xb0c], ebx
test dword [eax + 0x110], 0x10000
je 0x44756c
mov dword [esi + 0xb20], ebx
test dword [eax + 0x10c], 0x20000
je 0x447588
or dword [esi + 0xadc], 0x80000000
mov dword [esi + 0xb24], ebx
test dword [eax + 0x110], 0x100000
je 0x4475a0
mov dword [esi + 0xb68], ebx
mov dword [esi + 0xb34], edi
test dword [eax + 0x110], 0x200000
je 0x4475b8
mov dword [esi + 0xb6c], ebx
mov dword [esi + 0xb38], edi
test dword [eax + 0x110], 0x400000
je 0x4475ca
mov dword [esi + 0xb70], ebx
test dword [eax + 0x110], 0x400
je 0x4475e2
mov dword [esi + 0xb44], edi
mov dword [esi + 0xb40], ebx
mov ecx, 0x800
test dword [eax + 0x110], ecx
je 0x4475f5
mov dword [esi + 0xb4c], ebx
test dword [eax + 0x10c], ecx
je 0x44760f
mov dword [esi + 0xb48], ebx
mov dword [esi + 0xb44], ebx
mov dword [esi + 0xb40], edi
test dword [eax + 0x10c], 0x1000000
je 0x447621
mov dword [esi + 0xb64], ebx
mov edi, 0x2000000
test dword [eax + 0x10c], edi
je 0x447634
mov dword [esi + 0xb5c], ebx
test dword [eax + 0x110], 0x800000
je 0x447646
mov dword [esi + 0xb74], ebx
test dword [eax + 0x110], 0x2000
je 0x447656
and dword [eax + 4], 0
mov eax, dword [esi + 0x974]
mov ecx, 0x4000000
test dword [eax + 0x10c], ecx
je 0x44766f
mov dword [esi + 0xb54], ebx
mov edx, 0x8000000
test dword [eax + 0x110], edx
je 0x447683
and dword [esi + 0xb54], 0
test dword [eax + 0x110], ecx
je 0x447691
mov dword [esi + 0xb58], ebx
test dword [eax + 0x110], 0x20000000
je 0x4476a3
mov dword [esi + 0xb7c], ebx
test dword [eax + 0x110], 0x40000000
je 0x4476b5
mov dword [esi + 0xb80], ebx
test dword [eax + 0x110], 0x1000000
je 0x4476c7
mov dword [esi + 0xb8c], ebx
test dword [eax + 0x110], edi
je 0x4476d5
mov dword [esi + 0xb90], ebx
test dword [eax + 0x110], 0x1000
je 0x4476e7
mov dword [esi + 0xb94], ebx
test dword [eax + 0x10c], edx
je 0x4476f5
mov dword [esi + 0xb88], ebx
test byte [eax + 0x10c], bl
je 0x4477b9
lea eax, [esi + 0x97c]
xor edi, edi
cmp dword [eax], edi
je 0x447720
push eax
call fcn.00446f19
mov eax, dword [esi + 0x974]
pop ecx
mov dword [eax + 0x140], edi
mov eax, dword [esi + 0x974]
mov dword [eax + 0x64], edi
cmp dword [esi + 0xb24], edi
je 0x44774a
mov ecx, dword [esi + 0xadc]
test cl, 2
je 0x44774a
and ecx, 0xffffefff
mov dword [esi + 0xadc], ecx
jmp 0x447750
mov dword [esi + 0xadc], ebx
mov eax, dword [esi + 0x974]
push 3
pop ecx
mov dword [esi + 0xae0], edi
mov dword [eax + 0x38], ecx
lea eax, [esi + 0x978]
mov dword [esi + 0xbe4], ebx
mov dword [esi + 0xbd0], 2
mov dword [esi + 0xb04], ebx
mov dword [esi + 0xb44], edi
mov dword [esi + 0xbd4], edi
mov dword [esi + 0xb38], edi
mov dword [esi + 0xb34], edi
mov dword [esi + 0xb10], edi
mov dword [esi + 0xb00], edi
cmp dword [eax], edi
jne 0x4477b9
push edi
push edi
push ecx
push ebx
push dword [esi + 0xa10]
push eax
call fcn.00446de7
add esp, 0x18
pop ebx
pop edi
xor eax, eax
pop esi
ret