Function at 0x1004b7d2
Capabilities:
Delete directory

Disassembly:
push 0x264
mov eax, 0x1018a2c7
call fcn.10188ede
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], esi
push 0x208
lea eax, [ebp - 0x220]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x248], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebp - 4], 1
xor dl, dl
mov ecx, ebx
call fcn.1004ae6b
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x268]
call fcn.100440e8
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x23c]
test edi, edi
js 0x1004bbf9
cmp dword [ebp - 0x240], esi
je 0x1004b860
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], esi
push esi
lea eax, [ebp - 0x240]
mov edx, 0x2001f
push eax
push esi
mov ecx, ebx
call fcn.1013db2f
mov dword [ebp - 0x23c], eax
test eax, eax
jns 0x1004b8c5
mov ecx, dword [0x101c33f0]
cmp ecx, 0x101c33f0
je 0x1004b8ad
test byte [ecx + 0x44], 1
je 0x1004b8ad
push eax
push dword [ecx + 0x3c]
mov edx, 0x1001db38
push dword [ecx + 0x38]
push 0x27
pop ecx
call fcn.1004a069
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x250]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1004bc32
mov ecx, dword [ebp - 0x240]
lea edx, [ebp - 0x220]
push 0x104
call fcn.1013d9f0
mov dword [ebp - 0x23c], eax
test eax, eax
jns 0x1004b92b
mov ecx, dword [0x101c33f0]
cmp ecx, 0x101c33f0
je 0x1004b913
test byte [ecx + 0x44], 1
je 0x1004b913
push eax
push dword [ecx + 0x3c]
mov edx, 0x1001db38
push dword [ecx + 0x38]
push 0x28
pop ecx
call fcn.1004a069
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x254]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1004bc32
lea ecx, [ebp - 0x240]
call fcn.1004afec
lea ecx, [eax - 1]
mov dword [ebp - 0x248], ecx
mov edx, ecx
lea ecx, [ebp - 0x240]
call fcn.1004b03a
lea ecx, [ebp - 0x268]
call fcn.1004417d
mov dword [ebp - 4], esi
jmp 0x1004b9eb
test edi, edi
jns 0x1004ba5d
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004b9ae
test byte [eax + 0x44], 1
je 0x1004b9ae
push edi
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x2a
pop ecx
call fcn.1004a069
push edi
lea ecx, [ebp - 0x258]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1004bc32
cmp edi, 0x80070002
jne 0x1004b980
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004bbde
test byte [eax + 0x44], 4
je 0x1004bbde
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x29
pop ecx
call fcn.1004a093
jmp 0x1004bbde
mov ecx, dword [ebp - 0x248]
test ecx, ecx
je 0x1004ba9b
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004bbde
test byte [eax + 0x44], 4
je 0x1004bbde
push ecx
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x2b
pop ecx
call fcn.1004a0f3
jmp 0x1004bbde
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004bac1
test byte [eax + 0x44], 4
je 0x1004bac1
push ebx
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x2c
pop ecx
call fcn.1004a093
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
push eax
lea ecx, [ebp - 0x268]
call fcn.100440e8
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x23c]
test edi, edi
jns 0x1004bb25
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004bb0d
test byte [eax + 0x44], 1
je 0x1004bb0d
push edi
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x2d
pop ecx
call fcn.1004a069
push edi
lea ecx, [ebp - 0x25c]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1004bc32
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x238]
call fcn.1005236c
push esi
push esi
push ecx
lea edx, [ebp - 0x238]
mov byte [ebp - 4], 5
xor ecx, ecx
call fcn.1006d7e5
push esi
push 1
lea ecx, [ebp - 0x238]
call fcn.10052803
mov ecx, dword [ebp - 0x240]
call fcn.1004b725
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1004bbb1
mov dl, 1
lea ecx, [ebp - 0x220]
call fcn.1006d272
test eax, eax
jns 0x1004bbb1
mov ecx, dword [0x101c33f0]
cmp ecx, 0x101c33f0
je 0x1004bbb1
test byte [ecx + 0x44], 1
je 0x1004bbb1
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
push dword [ecx + 0x3c]
push dword [ecx + 0x38]
push 0x2e
pop ecx
call fcn.1004a1f2
cmp dword [ebp - 0x240], 0
je 0x1004bbd3
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
mov dword [ebp - 0x240], esi
call fcn.1004b1b1
lea ecx, [ebp - 0x268]
call fcn.1004417d
cmp dword [ebp - 0x240], 0
je 0x1004bbf3
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10188e18
ret
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1004bc1f
test byte [eax + 0x44], 1
je 0x1004bc1f
push edi
push dword [eax + 0x3c]
mov edx, 0x1001db38
push dword [eax + 0x38]
push 0x26
pop ecx
call fcn.1004a069
push edi
lea ecx, [ebp - 0x24c]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3