Function at 0x4a1ef0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6be358
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x7f3784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push str.AdobeGCData_folder:_checking_for_junction_symlink
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
mov dword [ebp - 0x74], esi
call fcn.005645a0
mov ecx, esi
mov dword [ebp - 0x48], 0
add esp, 0x14
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1f53
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x58]
call fcn.0049f3b0
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov ecx, esi
mov dword [edx + 0x10], 0
lea edi, [ecx + 1]
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a1f88
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.0049f3b0
call fcn.004c9450
add esp, 0x18
test al, al
je 0x4a2070
push str.AdobeGCData_folder_is_a_junction__deleting_it_and_creating_new_again
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x58]
add esp, 0x14
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x44], 0x10
lea edi, [ebp - 0x58]
mov dword [ebp - 0x2c], 7
cmovae edx, dword [ebp - 0x58]
add eax, edx
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x7c], eax
cmovae edi, dword [ebp - 0x58]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0x40], cx
push eax
lea ecx, [ebp - 0x40]
call fcn.00491e40
push dword [ebp - 0x74]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x7c]
push edi
call fcn.0049e180
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 0x74]
call fcn.004c11d0
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 8
jb 0x4a248b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a2481
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24d8
jmp 0x4a2481
push 1
sub esp, 0x18
mov ecx, esi
mov edx, esp
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a2090
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.0049f3b0
call fcn.004c74c0
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4a248b
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x71880c
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a1a60
add esp, 0xc
push 0xe
push str.AdobeGCData.db
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0049f250
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a2150
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a213d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24dd
push edx
push ecx
call fcn.0063bb18
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.00489080
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048d700
call fcn.004c9450
add esp, 0x18
test al, al
je 0x4a21ac
push str.AdobeGCData.db_is_a_symlink__deleting_it
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00665876
add esp, 0x18
push 0x71880c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a1a60
add esp, 0xc
push 0x15
push str.AdobeGCLaunchEvent.db
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0049f250
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a2232
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a221f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24e2
push edx
push ecx
call fcn.0063bb18
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.00489080
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048d700
call fcn.004c9450
add esp, 0x18
test al, al
je 0x4a228e
push str.AdobeGCLaunchEvent.db_is_a_symlink__deleting_it
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00665876
add esp, 0x18
push 0x71880c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a1a60
add esp, 0xc
push 0x13
push str.AdobeNGLAppIDMap.db
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0049f250
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a2314
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a2301
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24e7
push edx
push ecx
call fcn.0063bb18
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.00489080
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048d700
call fcn.004c9450
add esp, 0x18
test al, al
je 0x4a2370
push str.AdobeNGLAppIDMap.db_is_a_symlink__deleting_it
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00665876
add esp, 0x18
push 0x71880c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004a1a60
add esp, 0xc
push 0xf
push str.AdobeAGMData.db
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.0049f250
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x14]
movq qword [ebp - 0x78], xmm1
movups xmmword [ebp - 0x38], xmm0
cmp edx, 0x10
jb 0x4a23f6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a23e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24ec
push edx
push ecx
call fcn.0063bb18
movups xmm0, xmmword [ebp - 0x38]
add esp, 8
movq xmm1, qword [ebp - 0x78]
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x18], xmm1
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 4], 2
call fcn.00489080
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0048d700
call fcn.004c9450
add esp, 0x18
test al, al
je 0x4a2452
push str.AdobeAGMData.db_is_a_symlink__deleting_it
push 0
push 4
push 0x718614
push dword [0x7f9e6c]
call fcn.005645a0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00665876
add esp, 0x18
push esi
call fcn.004c8a50
mov edx, dword [ebp - 0x14]
add esp, 4
cmp edx, 0x10
jb 0x4a248b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a2481
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24f1
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x4a24bb
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4a24b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a24f6
push edx
push ecx
call fcn.0063bb18
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063bad7
mov esp, ebp
pop ebp
ret 4
call fcn.0065a824
call fcn.0065a824
call fcn.0065a824
call fcn.0065a824
call fcn.0065a824
call fcn.0065a824
call fcn.0065a824
int3