Function at 0x41f670
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
mov eax, dword [0x4630e0]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
push ebp
mov ebp, dword [eax + 0x10]
push esi
mov esi, dword [eax + 8]
push edi
xor edi, edi
push 0x1000
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x14], edi
add esi, esi
add ebp, ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], edi
call fcn.0040a330
add esp, 8
cmp eax, edi
mov dword [esp + 0x14], eax
jge 0x41f6ec
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.0043b76b
add esp, 0xc8
ret
lea eax, [ebp + 7]
cdq
and edx, 7
add eax, edx
mov edi, eax
lea eax, [ebp + 0x1ff]
cdq
and edx, 0x1ff
add eax, edx
mov ecx, eax
lea eax, [esi + 0x1ff]
cdq
push ebx
and edx, 0x1ff
add eax, edx
sar eax, 9
mov ebx, eax
push 0x80
mov dword [esp + 0x4c], eax
sar ecx, 9
lea eax, [esp + 0x58]
imul ebx, ecx
push 0
push eax
sar edi, 3
mov dword [esp + 0x44], ecx
call fcn.0043ae80
mov ecx, dword [esp + 0x20]
mov dx, word [ecx + 0x20]
mov word [esp + 0x64], si
shr esi, 0x10
mov word [esp + 0x66], di
shr edi, 0x10
mov eax, ebp
add esp, 0xc
and eax, 0x80000007
mov dword [esp + 0x54], 0x80
mov word [esp + 0x74], si
mov word [esp + 0x76], di
mov byte [esp + 0x78], 4
mov word [esp + 0x7a], dx
jns 0x41f784
dec eax
or eax, 0xfffffff8
inc eax
je 0x41f78e
mov cl, 8
sub cl, al
mov byte [esp + 0x72], cl
mov esi, dword [esp + 0x18]
push 0x80
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0040a3f0
add esp, 0xc
cmp eax, 0x80
je 0x41f7b9
mov dword [esp + 0x10], 1
jmp 0x41fa5f
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add ebx, ebx
add ebx, ebx
push ebx
push 0x42
mov dword [esp + 0x34], ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x41f9f5
mov eax, dword [esp + 0x2c]
push eax
push ebp
push esi
call fcn.0040a3f0
mov esi, dword [esp + 0x38]
add esp, 0xc
cmp eax, esi
jne 0x41f9f5
push 0x10000
push 0x42
call edi
push eax
call ebx
test eax, eax
mov dword [esp + 0x20], eax
je 0x41f9f5
push 0x10000
push 0x42
call edi
push eax
call ebx
test eax, eax
mov dword [esp + 0x30], eax
je 0x41f9f5
push 0x10000
push 0x42
call edi
push eax
call ebx
xor edi, edi
cmp eax, edi
mov dword [esp + 0x28], eax
je 0x41f9f5
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], edi
mov dword [esp + 0x1c], edi
jle 0x41f9b6
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x18]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x34], ebx
jle 0x41f99a
lea ebx, [ebx]
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push ecx
add eax, ebx
push eax
push edx
call fcn.0041f580
test eax, eax
jne 0x41f9f5
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], eax
jmp 0x41f8a0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
lea ecx, [edx + ecx*2]
xor esi, esi
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x40]
cmp edx, dword [esp + 0x48]
jge 0x41f95f
lea ecx, [esi + ebx*2]
cmp ecx, dword [esp + 0x38]
jge 0x41f95f
mov ebx, dword [esp + 0x30]
add eax, esi
shl eax, 5
add eax, dword [esp + 0x20]
push ebx
push eax
call fcn.0041e320
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x5c]
push eax
push ecx
push ebx
call fcn.0041dee0
add esp, 0x18
test eax, eax
jne 0x41f9f5
mov ebx, dword [esp + 0x50]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
call fcn.0040a3f0
add esp, 0xc
cmp eax, ebx
jne 0x41f9f5
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
lea ecx, [ecx + edx*2]
imul ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
add eax, eax
add ecx, eax
mov eax, dword [esp + 0x3c]
add ecx, esi
neg edx
sbb edx, edx
and edx, 0x8000
or cx, dx
mov word [ebp + edi*4 + 2], bx
mov ebx, dword [esp + 0x34]
mov word [ebp + edi*4], cx
add edi, 1
add esi, 1
cmp esi, 2
jl 0x41f8b1
add dword [esp + 0x24], 1
add eax, 0x200
cmp eax, 0x400
mov dword [esp + 0x3c], eax
jl 0x41f8a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
add ebx, 1
cmp ebx, eax
mov dword [esp + 0x34], ebx
jl 0x41f870
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, 1
cmp eax, dword [ecx + 0x14]
mov dword [esp + 0x1c], eax
jl 0x41f855
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
push 0
push 0x80
push edi
call fcn.0040a3a0
add esp, 0xc
cmp eax, 0x80
jne 0x41f9f5
push esi
push ebp
push edi
call fcn.0040a3f0
add esp, 0xc
cmp eax, esi
jne 0x41f9f5
push edi
call fcn.0040a380
add esp, 4
test eax, eax
mov dword [esp + 0x18], 0xffffffff
je 0x41f9fd
mov dword [esp + 0x10], 1
test ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x41fa1f
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x41fa33
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x41fa47
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x41fa5b
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov esi, dword [esp + 0x18]
cmp esi, 0xffffffff
pop ebx
jle 0x41fa6e
push esi
call fcn.0040a380
add esp, 4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41fa81
mov edx, dword [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0xd0]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0043b76b
add esp, 0xc8
ret