Function at 0x41f930
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
mov eax, dword [0x4630b0]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
push ebp
mov ebp, dword [eax + 0x10]
push esi
mov esi, dword [eax + 8]
push edi
xor edi, edi
push 0x1000
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x14], edi
add esi, esi
add ebp, ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], edi
call fcn.0040a5e0
add esp, 8
cmp eax, edi
mov dword [esp + 0x14], eax
jge 0x41f9ac
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.0043b3fc
add esp, 0xc8
ret
lea eax, [ebp + 7]
cdq
and edx, 7
add eax, edx
mov edi, eax
lea eax, [ebp + 0x1ff]
cdq
and edx, 0x1ff
add eax, edx
mov ecx, eax
lea eax, [esi + 0x1ff]
cdq
push ebx
and edx, 0x1ff
add eax, edx
sar eax, 9
mov ebx, eax
push 0x80
mov dword [esp + 0x4c], eax
sar ecx, 9
lea eax, [esp + 0x58]
imul ebx, ecx
push 0
push eax
sar edi, 3
mov dword [esp + 0x44], ecx
call fcn.0043b0e0
mov ecx, dword [esp + 0x20]
mov dx, word [ecx + 0x20]
mov word [esp + 0x64], si
shr esi, 0x10
mov word [esp + 0x66], di
shr edi, 0x10
mov eax, ebp
add esp, 0xc
and eax, 0x80000007
mov dword [esp + 0x54], 0x80
mov word [esp + 0x74], si
mov word [esp + 0x76], di
mov byte [esp + 0x78], 4
mov word [esp + 0x7a], dx
jns 0x41fa44
dec eax
or eax, 0xfffffff8
inc eax
je 0x41fa4e
mov cl, 8
sub cl, al
mov byte [esp + 0x72], cl
mov esi, dword [esp + 0x18]
push 0x80
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0040a6a0
add esp, 0xc
cmp eax, 0x80
je 0x41fa79
mov dword [esp + 0x10], 1
jmp 0x41fd1f
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add ebx, ebx
add ebx, ebx
push ebx
push 0x42
mov dword [esp + 0x34], ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x41fcb5
mov eax, dword [esp + 0x2c]
push eax
push ebp
push esi
call fcn.0040a6a0
mov esi, dword [esp + 0x38]
add esp, 0xc
cmp eax, esi
jne 0x41fcb5
push 0x10000
push 0x42
call edi
push eax
call ebx
test eax, eax
mov dword [esp + 0x20], eax
je 0x41fcb5
push 0x10000
push 0x42
call edi
push eax
call ebx
test eax, eax
mov dword [esp + 0x30], eax
je 0x41fcb5
push 0x10000
push 0x42
call edi
push eax
call ebx
xor edi, edi
cmp eax, edi
mov dword [esp + 0x28], eax
je 0x41fcb5
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], edi
mov dword [esp + 0x1c], edi
jle 0x41fc76
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x34], ebx
jle 0x41fc5a
lea ebx, [ebx]
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push ecx
add eax, ebx
push eax
push edx
call fcn.0041f840
test eax, eax
jne 0x41fcb5
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], eax
jmp 0x41fb60
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
lea ecx, [edx + ecx*2]
xor esi, esi
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x40]
cmp edx, dword [esp + 0x48]
jge 0x41fc1f
lea ecx, [esi + ebx*2]
cmp ecx, dword [esp + 0x38]
jge 0x41fc1f
mov ebx, dword [esp + 0x30]
add eax, esi
shl eax, 5
add eax, dword [esp + 0x20]
push ebx
push eax
call fcn.0041e5e0
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x5c]
push eax
push ecx
push ebx
call fcn.0041e1a0
add esp, 0x18
test eax, eax
jne 0x41fcb5
mov ebx, dword [esp + 0x50]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
call fcn.0040a6a0
add esp, 0xc
cmp eax, ebx
jne 0x41fcb5
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
lea ecx, [ecx + edx*2]
imul ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
add eax, eax
add ecx, eax
mov eax, dword [esp + 0x3c]
add ecx, esi
neg edx
sbb edx, edx
and edx, 0x8000
or cx, dx
mov word [ebp + edi*4 + 2], bx
mov ebx, dword [esp + 0x34]
mov word [ebp + edi*4], cx
add edi, 1
add esi, 1
cmp esi, 2
jl 0x41fb71
add dword [esp + 0x24], 1
add eax, 0x200
cmp eax, 0x400
mov dword [esp + 0x3c], eax
jl 0x41fb60
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
add ebx, 1
cmp ebx, eax
mov dword [esp + 0x34], ebx
jl 0x41fb30
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, 1
cmp eax, dword [ecx + 0x14]
mov dword [esp + 0x1c], eax
jl 0x41fb15
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
push 0
push 0x80
push edi
call fcn.0040a650
add esp, 0xc
cmp eax, 0x80
jne 0x41fcb5
push esi
push ebp
push edi
call fcn.0040a6a0
add esp, 0xc
cmp eax, esi
jne 0x41fcb5
push edi
call fcn.0040a630
add esp, 4
test eax, eax
mov dword [esp + 0x18], 0xffffffff
je 0x41fcbd
mov dword [esp + 0x10], 1
test ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x41fcdf
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x41fcf3
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x41fd07
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x41fd1b
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov esi, dword [esp + 0x18]
cmp esi, 0xffffffff
pop ebx
jle 0x41fd2e
push esi
call fcn.0040a630
add esp, 4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41fd41
mov edx, dword [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0xd0]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0043b3fc
add esp, 0xc8
ret