Function at 0x40357a
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x290], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
push 0xd
mov dword [esp + 0x30], eax
mov ebx, edx
pop eax
mov dword [esp + 0x28], ecx
mov esi, eax
mov edi, 0xa0
mov dword [esp + 0xc], esi
mov edx, edi
mov ecx, ebx
call fcn.00402125
add eax, 0xe
cmp eax, edi
ja 0x4036b3
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x403a36
lea eax, [esp + 0xb8]
push 0x180
push eax
call dword [sym.imp.msvcrt.dll__chmod]
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 0xc
lea eax, [esp + 0xb8]
push edi
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
push 0x1001
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
lea eax, [esp + 0xb8]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
cmp edi, 0xffffffff
jne 0x403652
push 4
jmp 0x4036b5
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x40672c]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x4036b3
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x4063f0]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x403888
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 6
pop eax
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404bf0
mov esp, ebp
pop ebp
ret 4
mov cl, byte [edi + 1]
cmp cl, 0x3a
jne 0x4036db
cmp byte [edi + 2], 0x5c
je 0x4036e5
cmp byte [edi], 0x5c
jne 0x4036ef
cmp cl, 0x5c
jne 0x4036ef
mov byte [esp + 0x158], 0
jmp 0x40371f
mov esi, dword [esp + 0x28]
mov edx, 0xa0
mov ecx, esi
call fcn.00402125
mov ecx, 0xa0
cmp eax, ecx
jge 0x4036b3
mov edx, ecx
lea ecx, [esp + 0x158]
push esi
call fcn.00401590
test eax, eax
js 0x403a36
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402125
mov edx, 0xa0
lea ecx, [esp + 0x158]
mov esi, eax
call fcn.00402125
add esi, eax
mov eax, 0xa0
cmp esi, eax
jae 0x4036b3
push edi
mov edx, eax
lea ecx, [esp + 0x15c]
call fcn.004015c3
test eax, eax
js 0x403a36
mov edi, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x1c]
call fcn.00402125
mov edx, 0xa0
mov ecx, ebx
mov esi, eax
call fcn.00402125
inc eax
mov ecx, 0xa0
add eax, esi
cmp eax, ecx
jae 0x4036b3
push edi
push ebx
push 0x401144
push ecx
lea eax, [esp + 0xc8]
push eax
call fcn.0040162e
add esp, 0x14
test eax, eax
js 0x403a36
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401270
call 0x40fdde
test eax, eax
je 0x4038a5
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call 0x40fdde
test eax, eax
je 0x4038a5
mov edi, dword [esp + 0x18]
cmp byte [edi], 0x40
jne 0x40382e
cmp byte [0x406cc0], 0
je 0x4038a1
mov esi, dword [esp + 0xc]
mov dword [esp + 0x24], 1
jmp 0x403865
lea edx, [esp + 0xb8]
lea ecx, [esp + 0x158]
call 0x40fdde
movzx esi, ax
push 0xd
pop eax
mov dword [esp + 0xc], esi
cmp si, ax
jne 0x4038ac
lea eax, [esp + 0xb8]
push 0x100
push eax
call dword [sym.imp.msvcrt.dll__chmod]
pop ecx
pop ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x10]
add edi, eax
mov dword [esp + 0x18], edi
call fcn.00402125
mov ecx, dword [esp + 0x10]
inc ecx
add ecx, eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402125
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4036cd
jmp 0x4038ac
push 3
jmp 0x4038a7
push 7
pop esi
mov dword [esp + 0xc], esi
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edi, 0xa0
mov ecx, ebx
mov edx, edi
call fcn.00402125
add eax, 0xe
cmp eax, edi
ja 0x4036b3
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x403a36
mov edi, dword [esp + 0x2c]
mov edx, 0xa0
mov ecx, ebx
mov byte [edi], 0
call fcn.00402125
mov ecx, 0xa0
cmp eax, ecx
jae 0x4036b3
mov edx, ecx
lea ecx, [esp + 0x1f8]
push ebx
call fcn.00401590
test eax, eax
js 0x403a36
push 0xd
pop eax
mov byte [edi], 0x5c
cmp si, ax
jne 0x4039c6
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call fcn.00403482
test eax, eax
je 0x4039b8
sub esp, 0x88
lea esi, [esp + 0xb8]
mov edx, ebx
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.00403482
test eax, eax
je 0x4039b8
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x280]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.00403482
test eax, eax
jne 0x4039bf
push 7
jmp 0x4036b5
mov esi, dword [esp + 0xc]
push 0xd
pop eax
cmp dword [esp + 0x24], 0
je 0x403a2e
cmp si, ax
jne 0x403a2e
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, eax
test esi, esi
je 0x4036b3
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalLock]
test eax, eax
je 0x4036a7
lea ecx, [esp + 0xb8]
push ecx
push ecx
push eax
push esi
push ebx
push dword [esp + 0x3c]
push ecx
push ecx
call fcn.004018e1
push dword [0x40672c]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ax, si
jmp 0x4036b6
call fcn.00402159
int3