Function at 0x427330
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x46cac6
mov eax, dword fs:[0]
push eax
sub esp, 0x920
mov eax, dword [0x4871a0]
xor eax, esp
mov dword [esp + 0x91c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4871a0]
xor eax, esp
push eax
lea eax, [esp + 0x934]
mov dword fs:[0], eax
mov edi, dword [esp + 0x944]
xor ebx, ebx
cmp edi, ebx
je 0x427632
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x427381
sub eax, edx
sar eax, 1
je 0x427632
mov eax, 0x5c
mov word [esp + 0x474], ax
mov dword [esp + 0x478], ebx
mov dword [esp + 0x47c], ebx
push 0x18e
lea edx, [esp + 0x7a6]
xor ecx, ecx
push ebx
mov dword [esp + 0x944], ebx
push edx
mov word [esp + 0x7ac], cx
call fcn.00453e20
push edi
push str._s.
lea eax, [esp + 0x7b4]
push 0x190
push eax
call fcn.00428ce0
add esp, 0x1c
lea eax, [esp + 0x7a0]
lea esi, [esp + 0x1c]
call fcn.00428bd0
test eax, eax
je 0x4275e3
jmp 0x427410
mov eax, dword [esp + 0x478]
cmp eax, ebx
jne 0x427426
mov eax, dword [esp + 0x47c]
xor ebp, ebp
jmp 0x427448
cmp dword [esp + 0x47c], ebx
jne 0x427433
xor ebp, ebp
jmp 0x42747f
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x47c], eax
mov ebp, eax
cmp eax, ebx
je 0x42747f
mov edx, dword [esp + 0x1c]
shr edx, 4
and edx, 1
je 0x42747f
cmp word [esp + 0x48], 0x2e
jne 0x42747f
mov ax, word [esp + 0x4a]
cmp ax, bx
je 0x4275db
cmp ax, 0x2e
jne 0x42747f
cmp word [esp + 0x4c], bx
je 0x4275db
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.00428b50
push eax
mov eax, 0xc8
mov byte [esp + 0x940], 1
call fcn.0040d900
lea ecx, [esp + 0x610]
mov esi, eax
mov eax, ecx
mov edx, 0x190
sub esi, eax
lea eax, [edx + 0x7ffffe6e]
test eax, eax
je 0x4274d2
movzx eax, word [esi + ecx]
cmp ax, bx
je 0x4274d2
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4274b2
jmp 0x4274d6
cmp edx, ebx
jne 0x4274d9
sub ecx, 2
xor edx, edx
mov byte [esp + 0x93c], bl
mov eax, dword [esp + 0x14]
mov word [ecx], dx
lea ecx, [eax - 0xc]
cmp ecx, 0x48b9c0
je 0x427512
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x427512
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004501ef
add esp, 4
cmp dword [esp + 0x47c], ebx
je 0x427578
mov eax, dword [esp + 0x1c]
shr eax, 4
and eax, 1
cmp eax, ebx
je 0x427578
push 0x18e
lea ecx, [esp + 0x486]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x48c], ax
call fcn.00453e20
lea edx, [esp + 0x61c]
push edx
push edi
push str._s_s
lea eax, [esp + 0x498]
push 0x190
push eax
call fcn.00428ce0
lea ecx, [esp + 0x4a0]
push ecx
call fcn.00427330
add esp, 0x24
jmp 0x4275db
push 0x18e
lea eax, [esp + 0x486]
xor edx, edx
push ebx
push eax
mov word [esp + 0x48c], dx
call fcn.00453e20
lea ecx, [esp + 0x61c]
push ecx
push edi
push str._s_s
lea edx, [esp + 0x498]
push 0x190
push edx
call fcn.00428ce0
add esp, 0x20
lea eax, [esp + 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4275db
push 4
push ebx
lea ecx, [esp + 0x488]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebp, ebx
jne 0x427410
mov eax, dword [esp + 0x478]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x47c], ebx
cmp eax, ebx
je 0x42760a
cmp eax, 0xffffffff
je 0x42760a
push eax
call esi
mov dword [esp + 0x478], ebx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 0x478]
mov dword [esp + 0x47c], ebx
cmp eax, ebx
je 0x42762b
cmp eax, 0xffffffff
je 0x42762b
push eax
call esi
mov eax, 1
jmp 0x427634
xor eax, eax
mov ecx, dword [esp + 0x934]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x91c]
xor ecx, esp
call fcn.0044fcda
add esp, 0x92c
ret