Function at 0x41eff0
Capabilities:
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bb36
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x5d7ce0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x10]
push str.Wow64DisableWow64FsRedirection
xor ebx, ebx
push str.kernel32
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x24c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x250], eax
cmp eax, ebx
je 0x41f074
lea ecx, [ebp - 0x24c]
push ecx
call eax
mov dword [ebp - 4], ebx
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f091
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 1
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f0c1
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f0f1
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 3
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f121
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 4
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f151
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x240], eax
push 1
lea ecx, [ebp - 0x230]
push ecx
push ecx
mov byte [ebp - 4], 5
mov esi, esp
mov dword [ebp - 0x228], esp
mov dword [ebp - 0x228], esi
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f199
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, str.strDstDir
mov byte [ebp - 4], 6
test ecx, 0xffff0000
jne 0x41f1d2
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
cmp eax, ebx
je 0x41f1e0
push edi
push eax
mov ecx, esi
call fcn.004074b0
jmp 0x41f1e0
push 9
push str.strDstDir
mov ecx, esi
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0x220]
push eax
call fcn.0043b9d0
cmp dword [0x5e084c], 0
mov dword [ebp - 0x22c], eax
jne 0x41f226
push 0x60
call fcn.0044c8d5
add esp, 4
test eax, eax
je 0x41f21f
mov esi, eax
call fcn.00445620
jmp 0x41f221
xor eax, eax
mov dword [0x5e084c], eax
mov edi, dword [ebp - 0x230]
movzx ecx, word [edi]
xor eax, eax
mov edx, edi
test cx, cx
je 0x41f29b
cmp cx, 0x5c
jne 0x41f246
test eax, eax
jne 0x41f248
mov eax, edx
jmp 0x41f248
xor eax, eax
movzx ecx, word [edx + 2]
add edx, 2
test cx, cx
jne 0x41f238
test eax, eax
je 0x41f29b
sub eax, edi
sar eax, 1
mov esi, eax
jns 0x41f26a
push 0x80070057
call fcn.00407ad0
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x41f28d
push esi
lea ecx, [ebp - 0x230]
call fcn.004077a0
mov edi, dword [ebp - 0x230]
cmp esi, dword [edi - 8]
jg 0x41f260
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
push 1
push 0x5ad338
lea ecx, [ebp - 0x230]
call fcn.004138d0
cmp dword [ebp - 0x22c], 0
jne 0x41f3ad
mov ecx, 0xa0000001
lea esi, [ebp - 0x220]
call fcn.0041ae20
mov ecx, dword [ebp - 0x23c]
push eax
mov byte [ebp - 4], 7
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f332
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f358
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f37e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41fe77
push 1
lea ecx, [ebp - 0x224]
push ecx
push ecx
mov esi, esp
mov dword [ebp - 0x228], esp
mov dword [ebp - 0x228], esi
call fcn.0044d418
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41f3df
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, str.strDeleteFile
mov byte [ebp - 4], 8
test ecx, 0xffff0000
jne 0x41f418
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
test eax, eax
je 0x41f426
push edi
push eax
mov ecx, esi
call fcn.004074b0
jmp 0x41f426
push 0xd
push str.strDeleteFile
mov ecx, esi
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0x220]
push eax
call fcn.0043b9d0
xor ebx, ebx
mov dword [ebp - 0x22c], eax
cmp eax, ebx
je 0x41f460
mov ecx, dword [ebp - 0x224]
cmp dword [ecx - 0xc], ebx
jne 0x41f54e
mov dword [ebp - 0x22c], ebx
mov ecx, 0xa0000001
lea esi, [ebp - 0x220]
call fcn.0041ae20
mov ecx, dword [ebp - 0x23c]
push eax
mov byte [ebp - 4], 9
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f4a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
mov dword [ecx], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f4d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f4fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f520
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f546
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
jmp 0x41fe7b
push 1
lea ecx, [ebp - 0x240]
push ecx
push ecx
mov esi, esp
mov dword [ebp - 0x228], esp
mov dword [ebp - 0x228], esi
call fcn.0044d418
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41f580
push 0x80004005
call fcn.00407ad0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, str.iSystemBits
mov byte [ebp - 4], 0xa
test ecx, 0xffff0000
jne 0x41f5b9
mov edx, ecx
movzx edi, dx
push edi
call fcn.0044d834
cmp eax, ebx
je 0x41f5c7
push edi
push eax
mov ecx, esi
call fcn.004074b0
jmp 0x41f5c7
push 0xb
push str.iSystemBits
mov ecx, esi
call fcn.00407870
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0x220]
push eax
call fcn.0043b9d0
mov dword [ebp - 0x22c], eax
test eax, eax
jne 0x41f6dd
mov ecx, 0xa0000001
lea esi, [ebp - 0x220]
call fcn.0041ae20
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.0040d290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f630
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x244]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
mov dword [ecx], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f662
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f688
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f6ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41fe77
mov edi, dword [ebp - 0x240]
push edi
call fcn.0054df0d
add esp, 4
cmp dword [0x5d9fb8], 0
mov esi, eax
je 0x41f742
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f738
lea ecx, [ebp - 0x280]
push ecx
call eax
mov ax, word [ebp - 0x280]
cmp ax, 9
je 0x41f72e
cmp ax, 6
jne 0x41f738
mov dword [0x5e0c44], 1
mov dword [0x5d9fb8], 0
test esi, esi
je 0x41f75c
cmp esi, 1
jne 0x41f7d9
cmp dword [0x5e0c44], 0
jne 0x41f7eb
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.004135f0
add esp, 0xc
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
mov esi, dword [ebp - 0x224]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x41f8a0
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41f890
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x41f890
push eax
call fcn.00407af0
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x41f7cb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x224], ebx
jmp 0x41f8a0
cmp esi, 2
jne 0x41f7eb
cmp dword [0x5e0c44], 0
jne 0x41f75c
lea eax, [edi - 0x10]
mov dword [ebp - 0x22c], 1
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f815
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f83b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f861
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41fe77
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x224]
call fcn.00407870
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f8c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x224]
push ecx
mov dword [ebp - 0x228], esp
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add ebx, 0xfffffff0
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41f8fc
cmp eax, dword [ebx]
jne 0x41f8fc
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41f938
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41f915
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x228]
call fcn.0044a6f0
add esp, 4
mov byte [ebp - 4], 0xd
push eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x220], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
jl 0x41f97c
cmp eax, dword [ebx]
jne 0x41f97c
mov esi, ebx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41f9b8
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41f995
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x248]
call fcn.0044a7b0
add esp, 4
push eax
lea edx, [ebp - 0x254]
push edx
mov byte [ebp - 4], 0xe
call fcn.004135f0
add esp, 0xc
mov byte [ebp - 4], 0xf
mov ecx, dword [eax]
mov esi, dword [ebp - 0x234]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x41fa4a
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41fa3a
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x41fa3a
push eax
call fcn.00407af0
mov dword [ebp - 0x220], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x41fa29
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x10
mov dword [ebp - 0x234], ecx
jmp 0x41fa4a
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x234]
call fcn.00407870
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41fa70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fa96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fabc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x228], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41fae8
cmp eax, dword [ebx]
jne 0x41fae8
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41fb24
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41fb01
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
lea esi, [ebp - 0x248]
call fcn.0044a990
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
mov esi, dword [ebp - 0x238]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x41fba2
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x41fb92
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x41fb92
push eax
call fcn.00407af0
mov dword [ebp - 0x228], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x41fb81
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x228]
add ecx, 0x10
mov dword [ebp - 0x238], ecx
jmp 0x41fba2
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x238]
call fcn.00407870
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41fbc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x228], esp
mov edi, esp
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41fbf4
cmp eax, dword [ebx]
jne 0x41fbf4
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41fc30
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x41fc0d
call fcn.0043d450
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebx + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0054de82
add esp, 0x10
add esi, 0x10
mov dword [edi], esi
call fcn.0044aaa0
add esp, 4
test eax, eax
je 0x41fd4d
mov esi, dword [ebp - 0x224]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x41fc68
and eax, 0xfffffffe
jne 0x41fc60
mov eax, 0x80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
jne 0x41fd45
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.00550f40
mov edx, dword [ebp - 0x238]
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push esi
push 0x5ae6f8
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x41fd45
mov ecx, dword [ebp - 0x224]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
lea eax, [ebp - 0x21c]
push eax
push ecx
call edi
lea edx, [ebp - 0x21c]
push edx
test eax, eax
jne 0x41fd10
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x224]
push 4
push esi
push eax
call edi
mov ecx, dword [ebp - 0x25c]
mov esi, eax
mov dword [ebp - 0x22c], esi
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41fd59
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 0x22c], esi
test esi, esi
jne 0x41fd45
push 2
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push esi
lea ecx, [ebp - 0x21c]
push ecx
call edi
mov esi, eax
mov dword [ebp - 0x22c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41fd59
mov eax, dword [ebp - 0x258]
mov esi, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x244]
test esi, esi
jne 0x41fdc5
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x10]
mov dword [ecx], edx
mov ecx, eax
lea esi, [ebp - 0x220]
call fcn.0041ae20
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x234]
mov eax, dword [edi + 0x2c]
push edx
mov edx, dword [ebp - 0x23c]
push ecx
push eax
push edx
call fcn.00409220
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fde8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41fde8
mov edx, dword [ebp + 8]
mov dword [ecx], 2
mov ecx, dword [ebp - 0x234]
mov eax, dword [edx + 0x30]
mov edx, dword [ebp - 0x23c]
push ecx
push eax
push edx
call fcn.00409220
add esp, 0xc
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe77
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fe9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x250], 0
je 0x41fed1
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fed1
mov ecx, dword [ebp - 0x24c]
push ecx
call eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054bd91
mov esp, ebp
pop ebp
ret