Function at 0x1804272b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ecx, 0x182736d0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
call fcn.18019d30
lea eax, [esi + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.18011e32
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.18009fcf
add eax, 0x10
xor edx, edx
inc edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov ecx, edx
cmp dword [eax - 0xc], ebx
je 0x180427ae
mov ecx, dword [edi + 4]
sub ecx, 0x10
call fcn.18009fcf
push 3
pop ecx
lea esi, [eax + 0x10]
cmp dword [esi - 0xc], ebx
je 0x180427b2
mov ecx, dword [edi + 8]
sub ecx, 0x10
call fcn.18009fcf
add eax, 0x10
push 7
pop ecx
cmp dword [eax - 0xc], ebx
je 0x180427b6
mov byte [esp + 0x10], bl
jmp 0x180427b6
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test cl, 4
je 0x180427cb
mov dword [esp + 0x18], ecx
lea ecx, [eax - 0x10]
call fcn.18006a60
mov ecx, dword [esp + 0x18]
test cl, 2
je 0x180427d8
lea ecx, [esi - 0x10]
call fcn.18006a60
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.18006a60
cmp byte [esp + 0x10], bl
je 0x180427f4
mov ebx, 0x80070057
jmp 0x18042a0f
call fcn.18006a78
push eax
lea ecx, [esp + 0x14]
call fcn.18007187
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
push edi
call fcn.18042faa
mov esi, eax
test esi, esi
js 0x18042a01
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.1801270e
mov ecx, dword [eax]
call fcn.1800ba43
mov ecx, dword [esp + 0x1c]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18006a60
test esi, esi
js 0x18042a01
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
call fcn.1801270e
lea ecx, [esp + 0x14]
push dword [eax]
call fcn.18006fb5
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.18006a60
call fcn.180175e4
lea eax, [esp + 0x1c]
push eax
call fcn.1801787e
mov esi, dword [esp + 0x14]
push esi
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
mov ecx, dword [esp + 0x1c]
mov edi, eax
add ecx, 0xfffffff0
call fcn.18006a60
test edi, edi
mov edi, dword [esp + 0x10]
je 0x180428bb
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
je 0x180428bb
mov ecx, 0x182736f0
call fcn.18019d30
jmp 0x180429f7
mov eax, dword [ebp + 0xc]
mov edx, edi
push ecx
mov ecx, dword [eax]
call fcn.1800dc1b
pop ecx
test eax, eax
jns 0x180428d4
mov ebx, eax
jmp 0x180429f7
mov edx, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
call fcn.180430e2
mov dword [esp + 0x1c], eax
test eax, eax
jns 0x18042963
movzx ecx, byte [0x1827e6e4]
mov edi, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x18042953
push 7
pop edx
push 0xfffffffffffffffe
pop eax
push eax
push edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.18008c56
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x10]
mov eax, dword [ebp + 0x10]
mov edx, edi
mov esi, dword [eax]
call fcn.18006cbf
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x30]
push str._failed_to_verify_hash_for_file__s__expected_hash__s_
push eax
call fcn.18006ca0
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18006a60
mov esi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [esp + 0x1c]
jmp 0x180429f7
lea ecx, [esp + 0x10]
call fcn.18043126
mov dword [esp + 0x18], eax
test eax, eax
jns 0x180429e9
movzx ecx, byte [0x1827e6e4]
mov edi, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0x1827e000
je 0x180429dc
push 7
pop edx
push 0xfffffffffffffffe
pop eax
push eax
push edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.18008c56
mov edx, edi
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x14]
call fcn.18006cbf
push dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push ebx
push str._failed_to_verify_Microsoft_signature_for_file__0x_08x___s_
push eax
call fcn.18006ca0
mov ecx, dword [esp + 0x24]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18006a60
jmp 0x180429e0
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180429f7
mov ecx, 0x182736f0
call fcn.18019d30
mov edi, dword [esp + 0x10]
lea ecx, [esi - 0x10]
call fcn.18006a60
jmp 0x18042a07
mov edi, dword [esp + 0x10]
mov ebx, esi
lea ecx, [edi - 0x10]
call fcn.18006a60
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
call dword [edx + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc