Function at 0x466717
Capabilities:
Delete file

Disassembly:
push 0x9c
mov eax, 0x50c963
call fcn.005060cc
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0045d959
test eax, eax
je 0x466cb6
mov ebx, 0x100
mov eax, ebx
call fcn.004f0800
mov ecx, esp
mov edx, ebx
push 0x5d
push dword [0xd584c8]
call fcn.004e1a81
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004094e6
xor ecx, ecx
mov edx, str._file___s_
mov dword [ebp - 0x2c], ecx
mov edi, str.___s__from_the_registry
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 4]
add ecx, 0xfffffffd
cmp ecx, 7
lea ecx, [ebp - 0x38]
cmova edx, edi
push edx
mov edx, eax
call fcn.00405cb9
xor ecx, ecx
mov edx, eax
inc ecx
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x34]
mov dword [esp], 0x51e64c
call fcn.00405cb9
pop ecx
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov edx, dword [ebp - 0x38]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4667c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4667e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x100
call fcn.004f0800
mov edi, esp
lea eax, [ebp - 0x44]
push dword [esi + 0x20]
push dword [ebp - 0x34]
push eax
call fcn.00423158
push 0x51eb64
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00405cb9
mov esi, eax
mov byte [ebp - 4], 6
mov edx, 0x100
push 0x60
push dword [0xd584c8]
mov ecx, edi
call fcn.004e1a81
push eax
mov edx, esi
lea ecx, [ebp - 0x24]
call fcn.00405cb9
add esp, 0x1c
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466857
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, ebx
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466875
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x18]
sub ecx, 0x10
call fcn.004098e7
lea esi, [eax + 0x10]
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 0xa
test esi, esi
je 0x46689f
push 0x5c
push esi
call fcn.004f2400
pop ecx
pop ecx
mov edx, eax
jmp 0x4668a1
xor edx, edx
test edx, edx
lea eax, [edx + 1]
mov ecx, esi
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.004094e6
push 0x55a2dc
mov byte [ebp - 4], 0xb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x466908
push 0x55a2e8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x466908
push str.regedit.exe
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x466908
push str.scanregw.exe
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x466908
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x46690c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
add eax, 0x4414
push edi
mov ecx, eax
mov dword [ebp - 0x48], eax
call fcn.0041c9c9
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
je 0x466ad6
mov ecx, edi
call fcn.0045d87b
test eax, eax
jne 0x466ad6
cmp dword [edi + 0x68], eax
jne 0x466955
cmp dword [ebp - 0x30], 2
jne 0x466955
mov ecx, esi
call fcn.00423518
test eax, eax
je 0x466ad6
mov eax, 0x100
call fcn.004f0800
mov ecx, dword [ebp + 8]
mov edi, esp
mov ecx, dword [ecx + 0x18]
sub ecx, 0x10
call fcn.004098e7
lea ebx, [eax + 0x10]
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
xor eax, eax
mov byte [ebp - 4], 0xc
inc eax
mov edx, 0x100
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
push ebx
push dword [eax + 0x68]
push dword [ebp - 0x24]
push 0x5e
push dword [0xd584c8]
call fcn.004e1a81
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xa8]
call fcn.004c7974
lea edx, [ebx - 0x10]
mov byte [ebp - 4], 0xe
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4669ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xa8]
call fcn.00469180
cmp eax, 1
je 0x4669f2
lea ecx, [ebp - 0xa8]
call fcn.00464506
jmp 0x466bf7
cmp dword [ebp - 0x5c], 0
mov edi, dword [ebp + 8]
je 0x466a01
push edi
call fcn.004664b6
cmp dword [ebp - 0x58], 0
je 0x466ab4
mov ecx, dword [edi + 0x18]
sub ecx, 0x10
call fcn.004098e7
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.0042354f
mov byte [ebp - 4], 0xe
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x466a42
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
sub ecx, 0x10
call fcn.004098e7
lea edi, [eax + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x466a71
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
push ebx
push 5
push ecx
mov edi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x28], edi
mov ecx, dword [eax + 0x18]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 8]
push ecx
mov eax, esp
mov byte [ebp - 4], pe_nt_image_headers32
push dword [edi + 0x20]
push str._s:_startup_file_deleted
push eax
call fcn.00423158
add esp, 0xc
mov byte [ebp - 4], 0xe
call fcn.00437175
xor eax, eax
cmp dword [ebp - 0x54], eax
push 1
pop ecx
cmovne eax, ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x2c], eax
call fcn.00464506
jmp 0x466bfe
mov ecx, edi
call fcn.0045d87b
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x466bbd
mov ecx, dword [ebp - 0x14]
call fcn.0046591d
test eax, eax
je 0x466bbd
mov eax, 0x100
call fcn.004f0800
mov edi, esp
lea ecx, [ebp - 0x20]
push 0x55a20c
call fcn.004094e6
mov ebx, eax
mov byte [ebp - 4], 0x11
mov edx, 0x100
push 0x326
push dword [0xd584c8]
mov ecx, edi
call fcn.004e1a81
push eax
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.00405cb9
push 0x55451c
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1c]
call fcn.00405cb9
add esp, 0x10
push 0x30
push 0x51e630
push dword [eax]
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x1c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466b81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466b9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466bbd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x100
call fcn.004f0800
mov edi, dword [ebp - 0x24]
mov ecx, esp
push 0x5e
push dword [0xd584c8]
mov edx, 0x100
call fcn.004e1a81
pop ecx
pop ecx
push 0x21
push eax
mov eax, dword [ebp - 0x14]
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x466bfb
xor edi, edi
jmp 0x466c42
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004d219a
test eax, eax
jne 0x466c22
push ecx
mov ecx, esp
push 0x51e784
call fcn.004094e6
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
call fcn.00437612
pop ecx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x466c31
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x30], ecx
jne 0x466c3d
mov ecx, dword [ebp - 0x48]
add eax, eax
push eax
push edi
call fcn.0041c9ed
xor eax, eax
lea edi, [eax + 1]
mov byte [ebp - 4], 0xa
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466c60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x466c7b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466c99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x466cb4
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
lea esp, [ebp - 0xb8]
call fcn.00506076
ret 8