Function at 0x409860
Capabilities:
Check if file exists
Delete file
Move file
Print debug messages
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf1e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x4f7458]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x19c], ecx
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4f89c8
call fcn.0042d1d0
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 4], 0
push str.maillock.sys
mov edx, dword [ebp - 0x1a4]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.0040f970
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
sub ecx, 0x10
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x78]
call fcn.00403de0
mov ecx, 0x4f89c8
call fcn.00434fb0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x409932
push 0
call fcn.00435150
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40991e
push str.DoUpdate_WowFsRedirection__FALSE__Succeed.
mov edx, dword [ebp - 0x19c]
push edx
call fcn.004028d0
add esp, 8
jmp 0x409932
push str.DoUpdate_WowFsRedirection__FALSE__Fail.
mov eax, dword [ebp - 0x19c]
push eax
call fcn.004028d0
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409955
push 0x80
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4caa50
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x28]
sub eax, 0x10
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
call fcn.00403de0
push 0x4caa50
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x29], al
mov edx, dword [ebp - 0x30]
sub edx, 0x10
mov dword [ebp - 0x98], edx
mov ecx, dword [ebp - 0x98]
call fcn.00403de0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x409a2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.MoveFile_strDriverPath__s_Fail.__d
mov edx, dword [ebp - 0x19c]
push edx
call fcn.004028d0
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x409a6d
push 1
call fcn.00435150
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x409a59
push str.DoUpdate_WowFsRedirection__TRUE__Succeed.
mov eax, dword [ebp - 0x19c]
push eax
call fcn.004028d0
add esp, 8
jmp 0x409a6d
push str.DoUpdate_WowFsRedirection__TRUE__Fail.
mov ecx, dword [ebp - 0x19c]
push ecx
call fcn.004028d0
add esp, 8
push str.maillockwp.sys
mov edx, dword [ebp - 0x19c]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0040f970
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409b27
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xa0], eax
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x34]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
mov edx, dword [ecx]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x38]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.maillockwp64.sys
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x1a8], eax
mov edx, dword [ebp - 0x1a8]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004118e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00402470
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409c18
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x40]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x44]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.maillockw8wp.sys
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x1ac], eax
mov edx, dword [ebp - 0x1ac]
mov dword [ebp - 0xdc], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x18]
call fcn.004118e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.00402470
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xe4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409d09
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xe8], eax
mov edx, dword [ebp - 0xe8]
mov eax, dword [edx]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x4c]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ecx]
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x50]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.maillockw8wp64.sys
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x1b0], eax
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x100], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x100]
push eax
lea ecx, [ebp - 0x18]
call fcn.004118e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x54]
call fcn.00402470
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409dfa
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x5c]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.maillock.sys
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x138], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x18]
call fcn.004118e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
call fcn.00402470
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409eeb
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov eax, dword [edx]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x64]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x68]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x68]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.maillock64.sys
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x1b8], eax
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x170], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x170]
push eax
lea ecx, [ebp - 0x18]
call fcn.004118e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c]
call fcn.00402470
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x178]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409fdc
push 0x4caa50
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x17c], eax
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx]
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x70]
call fcn.00402470
push 0x4caa50
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x74]
push eax
call fcn.0040f970
add esp, 0xc
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx]
mov dword [ebp - 0x18c], edx
mov eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x74]
call fcn.00402470
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402470
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret