Function at 0x41c550
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a470f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2934
call fcn.00495720
mov eax, dword [0x4c9144]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x288c], eax
lea eax, [ebp - 0x2860]
xor edi, edi
push eax
mov dword [ebp - 0x2898], edx
mov byte [ebp - 0x285a], 1
mov dword [ebp - 0x287c], edi
mov dword [ebp - 4], edi
call fcn.0041be20
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2860]
mov eax, dword [ecx - 0xc]
cmp eax, 2
jl 0x41c621
cmp eax, edi
jge 0x41c5d9
push 0x80070057
call fcn.00417580
cmp word [ecx], 0x22
jne 0x41c5f8
lea ecx, [ebp - 0x2860]
push ecx
mov eax, 1
xor ecx, ecx
call fcn.00418b70
mov ecx, dword [ebp - 0x2860]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
cmp eax, edi
jl 0x41c5cf
cmp eax, edx
jg 0x41c5cf
cmp word [ecx + eax*2], 0x22
jne 0x41c621
lea ecx, [edx - 1]
lea edx, [ebp - 0x2860]
push edx
mov eax, 1
call fcn.00418b70
lea eax, [ebp - 0x2860]
push eax
lea ecx, [ebp - 0x2874]
push ecx
call fcn.00418610
add esp, 8
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x2860]
mov byte [ebp - 0x285b], 0
mov ecx, 0x4ab688
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c676
test dx, dx
je 0x41c672
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c676
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c650
xor eax, eax
jmp 0x41c67b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41c6cd
lea edx, [ebp - 0x2870]
push edx
mov ecx, 0x4ab684
call fcn.0041be20
lea eax, [ebp - 0x2870]
lea edi, [ebp - 0x2860]
mov byte [ebp - 4], 3
call fcn.00417620
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2870]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c736
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41c736
mov eax, dword [edi - 0xc]
cmp eax, 1
jle 0x41c736
test eax, eax
jns 0x41c6e3
push 0x80070057
call fcn.00417580
cmp word [edi], 0x2a
jne 0x41c6fb
lea ecx, [ebp - 0x2860]
push ecx
mov byte [ebp - 0x2866], 1
xor ecx, ecx
jmp 0x41c726
lea ecx, [eax - 1]
test ecx, ecx
js 0x41c5cf
cmp ecx, eax
jg 0x41c5cf
cmp word [edi + ecx*2], 0x2a
jne 0x41c736
lea edx, [ebp - 0x2860]
mov byte [ebp - 0x2866], 0
lea ecx, [eax - 1]
push edx
mov eax, 1
mov byte [ebp - 0x285b], al
call fcn.00418b70
mov edi, dword [ebp - 0x2874]
mov byte [ebp - 0x2859], 0
mov ecx, 0x4ab688
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c776
test dx, dx
je 0x41c772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c776
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c750
xor eax, eax
jmp 0x41c77b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41c7cd
lea eax, [ebp - 0x2870]
push eax
mov ecx, 0x4ab684
call fcn.0041be20
lea eax, [ebp - 0x2870]
lea edi, [ebp - 0x2874]
mov byte [ebp - 4], 4
call fcn.00417620
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2870]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c836
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41c836
mov eax, dword [edi - 0xc]
cmp eax, 1
jle 0x41c836
test eax, eax
jns 0x41c7e3
push 0x80070057
call fcn.00417580
cmp word [edi], 0x2a
jne 0x41c7fb
lea ecx, [ebp - 0x2874]
push ecx
mov byte [ebp - 0x2865], 1
xor ecx, ecx
jmp 0x41c826
lea ecx, [eax - 1]
test ecx, ecx
js 0x41c5cf
cmp ecx, eax
jg 0x41c5cf
cmp word [edi + ecx*2], 0x2a
jne 0x41c836
lea edx, [ebp - 0x2874]
mov byte [ebp - 0x2865], 0
lea ecx, [eax - 1]
push edx
mov eax, 1
mov byte [ebp - 0x2859], al
call fcn.00418b70
lea eax, [ebp - 0x2878]
push eax
mov ecx, esi
call fcn.0041be20
push 0xa4
lea ecx, [ebp - 0x2940]
push 0
push ecx
mov byte [ebp - 4], 5
call fcn.0048bb40
mov eax, dword [ebp - 0x2878]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41c880
mov edx, dword [eax - 0xc]
push edx
lea eax, [ebp - 0x2878]
push eax
call fcn.004173b0
mov eax, dword [ebp - 0x2878]
lea ecx, [ebp - 0x2940]
mov dword [ebp - 0x293c], eax
mov dword [ebp - 0x2938], 1
mov dword [ebp - 0x2870], 0
call fcn.00405590
mov edi, eax
mov eax, dword [ebp - 0x2878]
mov ecx, dword [eax - 8]
push ecx
push eax
mov dword [ebp - 0x287c], edi
call fcn.00489835
add esp, 8
test eax, eax
js 0x41c5cf
mov ecx, dword [ebp - 0x2878]
cmp eax, dword [ecx - 8]
jg 0x41c5cf
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x2878]
xor ecx, ecx
mov word [edx + eax*2], cx
test edi, edi
je 0x41cd7d
cmp dword [ebp - 0x2934], ecx
jne 0x41cd7d
test ebx, ebx
je 0x41c97d
cmp byte [ebx], cl
je 0x41c97d
lea eax, [ebp - 0x2864]
push eax
mov esi, ebx
call fcn.0041cec0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2864]
cmp dword [eax - 4], 1
jle 0x41c936
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [ebp - 0x2864]
push edx
call fcn.00418e60
mov eax, dword [ebp - 0x2864]
push 0x7f
push eax
lea esi, [edi + 0x1c18]
push esi
call fcn.004888e0
mov byte [esi + 0x7f], 0
add esp, 0xc
lea esi, [ebp - 0x2864]
call fcn.00418ac0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2864]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c97d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov bl, byte [ebp - 0x2865]
xor esi, esi
test esi, esi
jne 0x41cd66
push 0x283c
lea ecx, [ebp - 0x2858]
push esi
push ecx
call fcn.0048bb40
mov edi, dword [ebp - 0x287c]
add esp, 0xc
lea ecx, [ebp - 0x2858]
mov edx, edi
call fcn.00405880
mov esi, eax
cmp esi, 0xa
je 0x41cd6b
test esi, esi
jne 0x41cd66
cmp word [ebp - 0x2458], ax
je 0x41c985
lea edx, [ebp - 0x2884]
push edx
lea ecx, [ebp - 0x1858]
call fcn.0041be20
lea eax, [ebp - 0x2884]
push eax
lea ecx, [ebp - 0x2888]
push ecx
mov byte [ebp - 4], 7
call fcn.00418610
add esp, 8
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x2860]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x41cada
cmp byte [ebp - 0x285b], 0
je 0x41cac0
cmp byte [ebp - 0x2866], 0
mov edx, dword [ebp - 0x2884]
jne 0x41caa5
push ecx
push esi
push edx
call fcn.00489b8c
add esp, 0xc
test eax, eax
je 0x41cada
push 0
push 0
xor ecx, ecx
mov edx, edi
call fcn.00405b40
mov esi, eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2888]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ca76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2884]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c985
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41c985
mov eax, dword [edx - 0xc]
cmp eax, ecx
jl 0x41ca41
sub eax, ecx
lea eax, [edx + eax*2]
push esi
push eax
call fcn.00489d2d
add esp, 8
jmp 0x41ca39
lea ecx, [ebp - 0x2860]
push ecx
mov ecx, dword [ebp - 0x2884]
call fcn.0041cf60
test eax, eax
jne 0x41ca41
mov esi, dword [ebp - 0x2874]
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x41cb4b
cmp byte [ebp - 0x2859], 0
je 0x41cb31
mov edx, dword [ebp - 0x2888]
test bl, bl
jne 0x41cb0e
push ecx
push esi
push edx
call fcn.00489b8c
add esp, 0xc
test eax, eax
je 0x41cb4b
jmp 0x41ca41
mov eax, dword [edx - 0xc]
cmp eax, ecx
jl 0x41ca41
sub eax, ecx
lea eax, [edx + eax*2]
push esi
push eax
call fcn.00489d2d
add esp, 8
test eax, eax
je 0x41cb4b
jmp 0x41ca41
lea ecx, [ebp - 0x2874]
push ecx
mov ecx, dword [ebp - 0x2888]
call fcn.0041cf60
test eax, eax
jne 0x41ca41
lea edx, [ebp - 0x286c]
push edx
call fcn.0041b8b0
mov ecx, dword [ebp - 0x288c]
lea eax, [ebp - 0x2890]
push eax
mov byte [ebp - 4], 9
call fcn.0041be20
lea eax, [ebp - 0x2890]
lea edi, [ebp - 0x286c]
mov byte [ebp - 4], 0xa
call fcn.00417620
lea eax, [ebp - 0x2890]
mov byte [ebp - 4], 9
call fcn.0041b950
mov edx, dword [ebp - 0x286c]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x41cbc4
lea ecx, [eax - 1]
test ecx, ecx
js 0x41c5cf
cmp ecx, eax
jg 0x41c5cf
cmp word [edx + ecx*2], 0x5c
je 0x41cbc4
mov edx, 0x4ab668
mov eax, edi
call fcn.00418b00
mov esi, dword [ebp - 0x2898]
lea eax, [ebp - 0x286c]
mov edx, esi
test esi, esi
jne 0x41cbdc
lea edx, [ebp - 0x1858]
call fcn.00418b00
mov ecx, dword [ebp - 0x286c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41cc04
mov edx, dword [ebp - 0x286c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x288c]
lea eax, [ebp - 0x2864]
push eax
call fcn.0041be20
mov byte [ebp - 4], 0xb
test esi, esi
je 0x41cca8
lea ecx, [ebp - 0x2880]
push ecx
mov ecx, esi
call fcn.0041be20
lea esi, [ebp - 0x2880]
mov byte [ebp - 4], 0xc
call fcn.00418d40
lea esi, [ebp - 0x2864]
mov edi, eax
call fcn.00418d40
mov edx, dword [ebp - 0x287c]
push eax
push 2
mov ecx, edi
call fcn.00405b40
mov esi, eax
mov eax, dword [ebp - 0x2880]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00489835
add esp, 8
test eax, eax
js 0x41c5cf
mov ecx, dword [ebp - 0x2880]
cmp eax, dword [ecx - 8]
jg 0x41c5cf
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x2880]
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x2880]
mov byte [ebp - 4], 0xb
call fcn.0041b950
jmp 0x41ccc5
lea esi, [ebp - 0x2864]
call fcn.00418d40
mov edx, dword [ebp - 0x287c]
push eax
push 2
xor ecx, ecx
call fcn.00405b40
mov esi, eax
mov eax, dword [ebp - 0x2864]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00489835
add esp, 8
test eax, eax
js 0x41c5cf
mov ecx, dword [ebp - 0x2864]
cmp eax, dword [ecx - 8]
jg 0x41c5cf
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x2864]
xor edx, edx
mov word [ecx + eax*2], dx
test esi, esi
jne 0x41cd4b
xor eax, eax
je 0x41cd33
lea edx, [ebp - 0x2894]
push edx
lea ecx, [ebp - 0x1858]
call fcn.0041be20
lea eax, [ebp - 0x2894]
push eax
mov byte [ebp - 4], 0xd
call fcn.00417a50
lea eax, [ebp - 0x2894]
call fcn.0041b950
mov ecx, dword [ebp - 0x286c]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc dword [ebp - 0x2870]
lea eax, [ebp - 0x2864]
call fcn.0041b950
lea eax, [ebp - 0x286c]
call fcn.0041b950
jmp 0x41ca50
cmp esi, 0xa
jne 0x41cd74
cmp dword [ebp - 0x2870], 0
jne 0x41cd83
mov byte [ebp - 0x285a], 0
jmp 0x41cd83
mov byte [ebp - 0x285a], cl
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2878]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cda9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2874]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cdcf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2860]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cdf5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x287c]
xor ebx, ebx
mov dword [ebp - 4], 0xf
cmp edi, ebx
je 0x41ce2d
lea esi, [edi + 0x6cd0]
mov cl, 1
cmp dword [esi + 0xc], ebx
je 0x41ce55
mov dword [esi + 0xc], ebx
inc dword [esi + 0xc1c]
push edi
call fcn.004057d0
push edi
call fcn.00487ef3
add esp, 4
mov al, byte [ebp - 0x285a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00487efe
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x41ce18
cmp byte [esi + 0x10], bl
jne 0x41ce9a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test cl, cl
jne 0x41ce7a
cmp dword [0x4d289c], ebx
jne 0x41ce9a
xor eax, eax
lea esp, [esp]
cmp eax, 0x100
jae 0x41ce9a
cmp dword [eax*4 + 0x4cf228], esi
je 0x41ce93
inc eax
jmp 0x41ce80
mov dword [eax*4 + 0x4cf228], ebx
mov dword [esi + 4], 0xffffffff
test cl, cl
jne 0x41ce18
cmp byte [esi + 0x14], bl
je 0x41ce18
call fcn.00405fe0
int3