Function at 0x40bc5a
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40bc62
call fcn.0041cbe0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x138]
call fcn.00411f60
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40c0ec
mov dword [0x422b30], 1
call fcn.0040a46d
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0x13c]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cc40
lea eax, [esp + 0xc]
push eax
call fcn.0041cca0
push dword [ebp + 0x140]
call fcn.00411f60
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40bcef
mov dword [esp + 0x10], pe_nt_image_headers32
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jne 0x40bd02
mov dword [esp + 0x10], 1
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 2
jne 0x40bd15
mov dword [esp + 0x10], 4
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 3
jne 0x40bd28
mov dword [esp + 0x10], 2
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jne 0x40bd3b
mov dword [esp + 0x10], 6
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 5
jne 0x40bd4e
mov dword [esp + 0x10], 5
jmp 0x40bd69
mov ebx, dword [esp + 0xc]
cmp ebx, 6
jne 0x40bd61
mov dword [esp + 0x10], 3
jmp 0x40bd69
mov dword [esp + 0x10], 7
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040c645
lea eax, [esp + 0x18]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040352f
lea eax, [esp + 0x1c]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
lea eax, [esp + 0x20]
push eax
call fcn.0041cca0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00409c1b
mov ebx, eax
and ebx, ebx
jne 0x40bde5
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.004130e4
jmp 0x40c11c
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00415125
lea eax, [esp + 0x24]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.004151a4
lea eax, [esp + 0x28]
push eax
call fcn.0041cca0
push 1
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0041c820
mov ebx, eax
and ebx, ebx
jne 0x40bf7e
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00415057
lea eax, [esp + 0x2c]
push eax
call fcn.0041cca0
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
call fcn.004111a2
add dword [esp], edx
call fcn.00415057
lea eax, [esp + 0x30]
push eax
call fcn.0041cca0
push 1
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.0041c820
mov ebx, eax
and ebx, ebx
jne 0x40bec3
jmp 0x40bf79
push edx
call fcn.0041cb30
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
call fcn.004111a2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.004111c0
push dword [esp + 0x14]
call fcn.00414e43
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40bf14
jl 0x40bf10
cmp ebx, 0xffffffff
ja 0x40bf14
xor eax, eax
jmp 0x40bf19
mov eax, 1
or eax, eax
je 0x40bf34
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041cb30
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
call fcn.004111a2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.004111c0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
jmp 0x40c061
push dword [esp + 0x20]
call fcn.00414e43
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40bf99
cmp edi, 0xffffffff
jne 0x40bf99
xor eax, eax
jmp 0x40bf9e
mov eax, 1
or eax, eax
je 0x40bfab
push dword [esp + 0x20]
call fcn.00401aab
push edx
call fcn.0041cb30
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
call fcn.004111a2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.004111c0
push dword [esp + 0x14]
call fcn.00414e43
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40bffc
jl 0x40bff8
cmp ebx, 0xffffffff
ja 0x40bffc
xor eax, eax
jmp 0x40c001
mov eax, 1
or eax, eax
je 0x40c01c
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041cb30
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
call fcn.004111a2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.004111c0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x144]
call fcn.00411f60
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x30]
cmp ebx, 1
jne 0x40c0bf
call fcn.0040a46d
push dword [esp + 0x14]
call fcn.00404ef5
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
push dword [esp + 0x20]
call fcn.00415125
call fcn.004111a2
add dword [esp], edx
call fcn.0040469a
call fcn.004111c0
mov edx, dword [esp + 0x14]
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cc40
push 0x422c10
call fcn.0041cca0
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.004130e4
jmp 0x40c11a
push edx
call fcn.0041cb30
pop edx
push eax
push edx
call fcn.0041cb30
pop edx
push eax
call fcn.00412ed0
lea eax, [esp + 0x38]
push eax
call fcn.0041cca0
push dword [esp + 0x34]
mov eax, str.cpath
push eax
call fcn.004130e4
xor eax, eax
push dword [esp + 0x18]
call fcn.0041cd30
push dword [esp + 0x2c]
call fcn.0041cd30
push dword [esp + 0x14]
call fcn.0041cd30
push dword [esp + 0x24]
call fcn.0041cd30
push dword [esp + 8]
call fcn.0041cd30
push dword [esp + 0x28]
call fcn.0041cd30
push dword [esp + 0x20]
call fcn.0041cd30
push dword [esp + 0x1c]
call fcn.0041cd30
push dword [esp + 0x34]
call fcn.0041cd30
add esp, 0x38
pop edi
pop ebx
pop ebp
ret 4