Function at 0x41b210
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b74e
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x5b4450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x454]
mov ebx, ecx
push str.DeleteDriverFileStd
push eax
mov dword [ebp - 0x438], ebx
call fcn.0040ac70
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x434], 1
call fcn.0040bea0
test ebx, ebx
jne 0x41b2a6
push ebx
push str.return___08x
lea ecx, [ebp - 0x454]
push 2
push ecx
call fcn.0040aed0
add esp, 0x10
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ae50
xor eax, eax
jmp 0x41ba7f
push 0x208
lea edx, [ebp - 0x420]
push 0
push edx
call fcn.005373f0
mov ecx, dword [ebx + 8]
add esp, 0xc
lea edi, [ebp - 0x420]
call fcn.0041bad0
lea ecx, [ebp - 0x44c]
call fcn.00441da6
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 1
call fcn.00441e85
mov esi, dword [ebx + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
test eax, eax
je 0x41b319
mov eax, dword [ebp - 0x444]
push esi
push eax
lea ecx, [ebp - 0x44c]
call fcn.004422ff
push esi
call edi
lea esi, [esi + eax*2 + 2]
push esi
call edi
test eax, eax
jne 0x41b2f8
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41b333
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 2
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x41b354
xor eax, eax
jmp 0x41b36f
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b360
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004016b0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.00534819
add esp, 8
test eax, eax
jne 0x41b396
or ecx, 0xffffffff
jmp 0x41b39c
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.00413980
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.00442275
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b3f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x41b3fd
xor eax, eax
jmp 0x41b411
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b402
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004016b0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.00534819
add esp, 8
test eax, eax
jne 0x41b438
or ecx, 0xffffffff
jmp 0x41b43e
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.00413980
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.00442275
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b494
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0x18]
test edx, edx
jne 0x41b49f
xor eax, eax
jmp 0x41b4b3
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b4a4
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004016b0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.00534819
add esp, 8
test eax, eax
jne 0x41b4da
or ecx, 0xffffffff
jmp 0x41b4e0
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.00413980
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.00442275
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b536
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x41b541
xor eax, eax
jmp 0x41b555
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b546
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x424]
call fcn.004016b0
mov esi, dword [ebp - 0x424]
push 0x5c
push esi
call fcn.00534819
add esp, 8
test eax, eax
jne 0x41b57c
or ecx, 0xffffffff
jmp 0x41b582
sub eax, esi
sar eax, 1
mov ecx, eax
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x424]
call fcn.00413980
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x444]
push eax
push edx
lea ecx, [ebp - 0x44c]
call fcn.00442275
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b5d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x428], 0
test ecx, ecx
jle 0x41ba1f
mov eax, dword [ebp - 0x428]
test eax, eax
js 0x41baa0
cmp eax, ecx
jge 0x41baa0
mov ecx, dword [ebp - 0x448]
mov esi, dword [ecx + eax*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x41b635
cmp eax, dword [esi - 0x10]
jne 0x41b635
lea ebx, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41b66d
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x41ba9b
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.005339f7
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0x430], ebx
push 0x5c
push ebx
mov byte [ebp - 4], 7
call fcn.00534819
add esp, 8
test eax, eax
jne 0x41b68e
or edi, 0xffffffff
jmp 0x41b694
sub eax, ebx
sar eax, 1
mov edi, eax
lea ecx, [ebp - 0x420]
push ecx
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
mov eax, dword [ebx - 0xc]
jne 0x41b6fc
sub eax, edi
push eax
lea edx, [ebp - 0x468]
push edx
lea ecx, [ebp - 0x430]
call fcn.00413980
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push 0x58b914
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41b746
sub eax, edi
push eax
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x430]
call fcn.00413980
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b752
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x438]
push ecx
push ebx
call fcn.0041bc20
add esp, 8
test eax, eax
jne 0x41b9de
push 0x20
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x434], eax
test eax, eax
jne case.0x41b7a5.4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x1e
ja case.0x41b7a5.4
movzx ecx, byte [eax + 0x41bab0]
jmp dword [ecx*4 + 0x41baa8]
mov dword [ebp - 0x434], 1
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x422], 0x5c
je 0x41b832
mov eax, dword [ebp - 0x438]
mov eax, dword [eax]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x430]
call fcn.00413980
mov edx, dword [eax]
push edx
push esi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push 0x58e300
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41b894
mov ecx, dword [ebp - 0x438]
mov eax, dword [ecx]
lea esi, [eax - 0x400]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebx - 0xc]
sub eax, edi
push eax
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x430]
call fcn.00413980
mov eax, dword [eax]
push eax
push esi
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x218]
push str._s_d_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b8a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x20
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00401210
push 3
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 8
call fcn.00413980
mov byte [ebp - 4], 9
mov ecx, dword [eax]
mov esi, dword [ebp - 0x42c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x41b957
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41b947
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x41b947
push eax
call fcn.004017c0
mov dword [ebp - 0x46c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x41b936
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x46c]
add ecx, 0x10
mov dword [ebp - 0x42c], ecx
jmp 0x41b957
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.004016b0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b97d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x42c]
push 0x58d6d8
push ecx
call fcn.00533c47
add esp, 8
test eax, eax
je 0x41b9ad
mov edx, dword [ebp - 0x42c]
push 0x58d6e0
push edx
call fcn.00533c47
add esp, 8
test eax, eax
jne 0x41b9b8
lea ecx, [ebp - 0x218]
call fcn.004172a0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b9de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b9fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x428], eax
cmp eax, ecx
jl 0x41b5f0
mov esi, dword [ebp - 0x424]
mov edi, dword [ebp - 0x434]
push edi
push str.return___08x
lea ecx, [ebp - 0x454]
push 2
push ecx
call fcn.0040aed0
lea eax, [esi - 0x10]
add esp, 0x10
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ba5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0
call fcn.004420db
lea ecx, [ebp - 0x454]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ae50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005337cb
mov esp, ebp
pop ebp
ret
call fcn.00401830
call fcn.004409a4
lea ecx, [ecx]
lodsb al, byte [esi]
mov bh, 65
add byte [esi + 0x41b7], dh
add byte [ecx], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
int3