Function at 0x401ad0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
call fcn.00403fe0
mov byte [ebp - 0x65], 0x17
mov al, byte [ebp - 0x65]
mov byte [ebp - 0xc4], al
cmp byte [ebp - 0xc4], 0x17
je 0x401b1a
cmp byte [ebp - 0xc4], 0x1c
je 0x401b0b
jmp 0x401bfa
movzx ecx, byte [ebp - 0x65]
push ecx
call section..text
jmp 0x401bfa
mov edx, dword [section..data]
mov dword [ebp - 0x98], edx
mov byte [ebp - 0xb1], 0xd5
movzx eax, byte [ebp - 0xb1]
cmp eax, 0x92
je 0x401beb
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0xc8], ecx
cmp dword [ebp - 0xc8], 0x654a
je 0x401b59
jmp 0x401bc3
mov edx, dword [section..data]
sub edx, 0x60f6
mov dword [ebp - 0x98], edx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x40]
push edx
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x98]
and eax, 0x6afc
cmp eax, dword [section..data]
je 0x401ba8
mov dword [ebp - 0x40], 0xe90a
movzx ecx, byte [ebp - 0x65]
push ecx
call section..text
jmp 0x401bc1
movsx edx, byte [ebp - 0x65]
cmp edx, 0x12
jl 0x401bc1
mov eax, dword [section..data]
xor eax, 0x313f
mov dword [ebp - 0x98], eax
jmp 0x401be9
mov ecx, 0xc4e
mov word [ebp - 0xb0], cx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x60], eax
mov cx, word [ebp - 0xb0]
mov word [ebp - 0x94], cx
jmp 0x401bfa
mov edx, dword [section..data]
shl edx, 0x1d
mov dword [ebp - 0x98], edx
mov al, byte [ebp - 0x65]
mov byte [ebp - 0xcc], al
cmp byte [ebp - 0xcc], 0x17
je 0x401c1e
cmp byte [ebp - 0xcc], 0x4b
je 0x401e3a
jmp 0x401e6b
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x80], ecx
lea edx, [ebp - 0xb1]
mov dword [ebp - 0xb8], edx
lea eax, [ebp - 0x65]
mov dword [ebp - 0xc0], eax
mov ecx, dword [ebp - 0x80]
sub ecx, dword [ebp - 0x64]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x64]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x80]
cdq
idiv dword [ebp - 0x98]
cmp ecx, eax
jge 0x401c92
mov edx, dword [ebp - 0xb8]
mov al, byte [edx]
mov byte [ebp - 0xa9], al
mov cx, word [ebp - 0xb0]
mov word [ebp - 0xc], cx
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x40]
shl edx, cl
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x80]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x65]
mov dword [ebp - 0x84], ecx
mov edx, 0x1c2
mov word [ebp - 0xbc], dx
lea eax, [ebp - 0x94]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
movzx eax, word [ebp - 0x94]
or edx, eax
movzx eax, word [ebp - 0xb0]
movzx ecx, word [ebp - 0xc]
sar eax, cl
cmp edx, eax
jle 0x401d1d
lea ecx, [ebp - 0xa9]
mov dword [ebp - 0x54], ecx
movsx edx, word [ebp - 0xbc]
cmp edx, 0x722
jge 0x401d0e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x5c], edx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x90], eax
jmp 0x401d1d
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ecx]
and eax, dword [edx]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
movzx ecx, word [ebp - 0xb0]
sub eax, ecx
mov word [ebp - 0x94], ax
lea edx, [ebp - 0xa9]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x90]
mov eax, dword [edx]
add eax, dword [ebp - 0x88]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xb8]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x54]
movzx ecx, byte [eax]
add edx, ecx
mov eax, dword [ebp - 0xa8]
movzx ecx, byte [eax]
movzx eax, byte [ebp - 0xa9]
sub ecx, eax
cmp edx, ecx
jl 0x401dc9
lea ecx, [ebp - 0xbc]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0xa4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x64]
mov ecx, dword [eax]
shl edx, cl
mov dword [ebp - 0x98], edx
lea eax, [ebp - 0xa9]
mov dword [ebp - 0x50], eax
movzx edx, word [ebp - 0x94]
movzx ecx, word [ebp - 0xc]
sar edx, cl
mov word [ebp - 0xb0], dx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x44], eax
jmp 0x401e2a
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov word [ebp - 0x94], cx
movzx eax, byte [ebp - 0xb1]
mov ecx, dword [ebp - 0xb8]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 0xa9], al
mov eax, dword [ebp - 0xc0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x84]
movsx eax, byte [edx]
or ecx, eax
mov byte [ebp - 0x65], cl
push 0xc6
mov ecx, dword [ebp - 0x8c]
push ecx
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x98]
add eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x401e6b
movzx ecx, word [ebp - 0xb0]
add ecx, 0x14f
mov word [ebp - 0x94], cx
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [ebp - 0x58], eax
movzx edx, byte [ebp - 0xb1]
push edx
call fcn.00402d60
movsx eax, byte [ebp - 0x65]
sar eax, 3
mov byte [ebp - 0x65], al
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov dword [ebp - 0x64], eax
movzx edx, word [ebp - 0x94]
or edx, 0x2ca
movzx eax, word [ebp - 0xb0]
cmp edx, eax
je 0x401ed7
movzx ecx, word [ebp - 0xb0]
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 0xd0], 0xd6c
je 0x401eb5
jmp 0x401ec4
mov edx, dword [ebp - 0x48]
mov eax, dword [edx]
sub eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
jmp 0x401ed7
movzx edx, byte [ebp - 0x65]
push edx
movzx eax, byte [ebp - 0x65]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.004017a0
mov edx, dword [ebp - 0x60]
add edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov dword [eax], edx
movzx ecx, byte [ebp - 0xb1]
and ecx, 0xc6
mov byte [ebp - 0xb1], cl
mov eax, dword [section..data]
mov esp, ebp
pop ebp
ret