Function at 0x401024
Capabilities:
Delete file

Disassembly:
call 0x4070a6
mov dword [0x409a64], eax
mov edi, 0x44d840
mov eax, 0x60000000
stosd dword es:[edi], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
stosd dword es:[edi], eax
mov edx, dword [eax + 0x3c]
lea edx, [edx + eax + 0x18]
mov eax, section..text
add edx, dword [edx + 4]
stosd dword es:[edi], eax
xchg edx, eax
stosd dword es:[edi], eax
push esi
push str.kernel32
call sub.kernel32.dll_LoadLibraryA
xchg esi, eax
push str.SetProcessUserModeExceptionPolicy
push esi
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x401072
push 0
call eax
pop esi
xor ecx, ecx
mov edx, 0x44a3d4
mov al, 0x30
mov ah, 0x30
mov word [edx + ecx*2], ax
inc ecx
inc ah
cmp ah, 0x39
jbe 0x40107e
inc al
cmp al, 0x39
jbe 0x40107c
mov byte [edx + 0xd6], 0x30
fninit
push 0x499602d2
call fcn.004042a0
movups xmm0, xmmword [eax]
mov edx, 0x44a4a9
sub edx, eax
jns 0x4010b2
add edx, 2
call fcn.00405134
movups xmmword [eax], xmm0
push 1
add edx, eax
push edx
call fcn.00405146
mov dword [0x44ea9c], 0x2f3a7074
call fcn.004051bc
mov edi, 0x44d86c
call sub.kernel32.dll_GetConsoleWindow
or eax, eax
je 0x4010e6
mov eax, 0xfde9
stosd dword es:[edi], eax
or eax, eax
je 0x4010f7
push eax
push eax
call sub.kernel32.dll_SetConsoleCP
call sub.kernel32.dll_SetConsoleOutputCP
mov eax, 0xfde9
stosd dword es:[edi], eax
xor esi, esi
xor edi, edi
xor ebx, ebx
push 0x7f
call fcn.00401ef7
push 7
push 0x7f
call fcn.00406b1e
push esi
push 0x7f
push 0xc0000001
call fcn.00402c99
mov esi, eax
push 1
push esi
call fcn.0040256b
je 0x401353
mov edi, 0x40902c
push esi
push edi
push ebx
push ecx
push esi
mov esi, edi
xor edx, edx
xor ecx, ecx
xor ebx, ebx
lodsb al, byte [esi]
or eax, eax
je 0x4011a9
cmp al, 0x40
jb 0x40114f
cmp al, 0x5a
jbe 0x401187
cmp al, 0x61
jb 0x401157
cmp al, 0x7a
jbe 0x401187
cmp al, 0x26
je 0x401187
cmp al, 0x3a
je 0x401187
cmp al, 0x2b
je 0x401187
cmp al, 0x2d
je 0x401187
cmp al, 0x2a
je 0x401187
cmp al, 0x24
je 0x401187
cmp al, 0x23
je 0x401187
cmp al, 0x5c
je 0x401187
cmp al, 0x2f
je 0x401187
cmp al, 0x3f
je 0x401187
cmp al, 0x30
jb 0x4011a4
cmp al, 0x39
ja 0x4011a4
and al, 0x3f
jne 0x40118f
xor al, byte [esi]
and al, 0x3f
add bl, al
shl edx, 6
or dl, al
inc ecx
cmp ecx, 6
jne 0x4011a4
mov bh, bl
mov dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis], edx
cmp ecx, 0xb
jb 0x401142
pop ecx
push ecx
mov esi, edx
xor edi, edi
movzx eax, bh
push eax
inc eax
shl eax, 2
sub eax, 4
push eax
push 0x409069
call fcn.00405080
push edi
push 0x7f
push 0xc0000001
call fcn.00402c99
mov edi, eax
mov eax, ecx
push 1
call fcn.00401be0
push 0x3e8
push 0x40906b
call fcn.00405080
push edi
push edi
push str.
push 0x7f
push 0x7f
push 0xc0000004
call fcn.00402c99
mov edi, eax
pop ecx
push edi
mov eax, 0x7206a6a
stosd dword es:[edi], eax
dec ecx
imul eax, esi, 0xffffff81
add eax, 0xffffff84
bswap eax
mov esi, eax
push edx
or edx, 0xffffffff
mul edx
xchg edx, eax
pop edx
dec ecx
js 0x401224
stosd dword es:[edi], eax
jmp 0x40120c
mov ecx, dword [0x44d274]
push eax
mov eax, dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis]
imul eax, eax, 0xffffff81
add eax, 0xffffff84
bswap eax
mov dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis], eax
push edx
or edx, 0xffffffff
mul edx
xchg edx, eax
pop edx
pop edx
xor eax, edx
xor eax, ecx
stosd dword es:[edi], eax
shr ecx, 2
imul eax, esi, 0xffffff81
add eax, 0xffffff84
bswap eax
mov esi, eax
push edx
or edx, 0xffffffff
mul edx
xchg edx, eax
pop edx
push eax
mov eax, dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis]
imul eax, eax, 0xffffff81
add eax, 0xffffff84
bswap eax
mov dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis], eax
push edx
or edx, 0xffffffff
mul edx
xchg edx, eax
pop edx
pop edx
xor eax, edx
xor eax, dword [edi]
stosd dword es:[edi], eax
dec ecx
jns 0x40124e
movzx ecx, bl
mov eax, dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis]
imul eax, eax, 0xffffff81
add eax, 0xffffff84
bswap eax
mov dword [str.CiaoCiaoSWxxproNproAarg1arg2arg3arg4arg5arg6AhmedMohamedYonis], eax
push edx
or edx, 0xffffffff
mul edx
xchg edx, eax
pop edx
stosd dword es:[edi], eax
dec ecx
jns 0x401287
pop ebx
pop ecx
push ecx
call fcn.00401fd0
push eax
push dword [0x44e984]
push ecx
push 0xc0000001
call fcn.00402c99
mov dword [0x44e984], eax
pop edx
push dword [edx + eax - 4]
mov dword [edx + eax - 4], 0x7a79782e
xchg ecx, eax
pop eax
stosd dword es:[edi], eax
sub edi, ebx
push 0x4f
push ecx
push 0xa
call fcn.00401522
cmp eax, 0xffffffff
jne 0x4012f5
pushal
push str._Line_9:_Open__O__failed_
push 1
push 2
call fcn.00402c99
popal
push edi
pop dword [0x44ee50]
push ebx
push 0x2c1
call fcn.00402c99
push edx
push 8
push 0xffffffffffffffff
call fcn.00404eb0
pop edx
push 7
push dword [0x44eaf4]
call fcn.004015f1
push 0xa
pop eax
call fcn.004013b4
push ebx
call fcn.00403ea1
mov ebx, eax
xchg ecx, eax
pop ecx
pop ebx
pop edi
pop esi
push str.Encoded_as
push eax
push 1
push 3
call fcn.00402c99
push ecx
push esi
call fcn.0040347a
push eax
call sub.kernel32.dll_DeleteFileW
pop ecx
jmp 0x401362
push str.No_commandline_found:
push esi
push 1
push 3
call fcn.00402c99
push 0
push 0xffffffffffffffff
call fcn.00403c6a
push 0xffffffffffffffff
call fcn.00403ea1
mov esi, 0x44eb04
push 9
pop edi
lodsd eax, dword [esi]
or eax, eax
je 0x401385
push eax
call sub.kernel32.dll_FreeLibrary
dec edi
jns 0x40137a
call sub.kernel32.dll_ExitProcess