Function at 0x435430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4070
call fcn.0052c010
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor al, al
push edi
mov dword [ebp - 0x4064], ecx
mov dword [ebp - 0x406c], esi
mov dword [ebp - 0x4068], ebx
mov byte [ebp - 0x405d], al
test esi, esi
je 0x435ba8
cmp word [esi], 0
je 0x435ba8
test ebx, ebx
je 0x435ba8
mov eax, esi
call fcn.004376f0
mov edi, eax
cmp edi, 0x1bc
je 0x4354d0
cmp edi, 0x1cc
je 0x4354d0
cmp edi, 0x5f4
je 0x4354d0
cmp edi, 0x5f8
je 0x4354d0
cmp edi, 0x5fc
je 0x4354d0
cmp edi, 0xe24
je 0x4354d0
cmp edi, 0xe4c
je 0x4354d0
cmp edi, 0xe58
jne 0x435bc2
mov eax, esi
mov esi, dword [ebp - 0x4064]
call fcn.00449600
test al, al
je 0x435bc2
cmp edi, 0x1bc
jne 0x43555d
mov ecx, edi
lea eax, [ebp - 0x39c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4354f5
mov edi, dword [ebp - 0x4064]
mov esi, 0x1bc
lea edx, [ebp - 0x39c]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov ax, word [ebp - 0x37c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x398]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x378]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x264]
mov word [ebx + 0x20], ax
rep movsd dword es:[edi], dword [esi]
jmp 0x435b59
cmp edi, 0x1cc
jne 0x4355fd
mov ecx, edi
lea eax, [ebp - 0x1dc]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435571
mov edi, dword [ebp - 0x4064]
mov esi, 0x1cc
lea edx, [ebp - 0x1dc]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov edx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1d8]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x1bc]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x1b0]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x1ac]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x1a8]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x94]
mov dword [ebx + 0x30], edx
rep movsd dword es:[edi], dword [esi]
jmp 0x435b59
cmp edi, 0x5f4
jne 0x4356f3
mov ecx, edi
lea eax, [ebp - 0x994]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435611
mov edi, dword [ebp - 0x4064]
mov esi, 0x5f4
lea edx, [ebp - 0x994]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov ax, word [ebp - 0x974]
mov edx, dword [ebp - 0x96c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x990]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x970]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x964]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x968]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x960]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x84c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
test edi, edi
je 0x4356b3
lea ebx, [ebp - 0x7c8]
call fcn.00437760
mov ebx, dword [ebp - 0x4068]
lea ecx, [ebx + 0xe34]
test ecx, ecx
je 0x4356c8
lea eax, [ebp - 0x3b0]
call fcn.00437a00
add ebx, 0xe54
je 0x435b59
mov dl, byte [ebp - 0x3a3]
mov al, byte [ebp - 0x3a4]
mov cl, byte [ebp - 0x3a2]
mov byte [ebx + 1], dl
mov byte [ebx], al
mov byte [ebx + 2], cl
jmp 0x435b59
cmp edi, 0x5f8
jne 0x4357e5
mov ecx, edi
lea eax, [ebp - 0xf8c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435707
mov edi, dword [ebp - 0x4064]
mov esi, 0x5f8
lea edx, [ebp - 0xf8c]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov eax, dword [ebp - 0xf68]
mov dx, word [ebp - 0xf6c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0xf88]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xf64]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xf5c]
mov dword [ebx + 0x28], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0xf58]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0xe44]
mov word [ebx + 0x20], dx
mov edx, dword [ebp - 0xf60]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
test edi, edi
je 0x4357a9
lea ebx, [ebp - 0xdc0]
call fcn.00437810
mov ebx, dword [ebp - 0x4068]
lea ecx, [ebx + 0xe34]
lea eax, [ebp - 0x9a8]
call fcn.00437a30
add ebx, 0xe54
je 0x435b59
mov cl, byte [ebp - 0x997]
mov dl, byte [ebp - 0x998]
mov al, byte [ebp - 0x996]
mov byte [ebx + 1], cl
mov byte [ebx], dl
mov byte [ebx + 2], al
jmp 0x435b59
cmp edi, 0x5fc
jne 0x4358c4
mov ecx, edi
lea eax, [ebp - 0x158c]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435800
mov edi, dword [ebp - 0x4064]
mov esi, 0x5fc
lea edx, [ebp - 0x158c]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov edx, dword [ebp - 0x1568]
mov eax, dword [ebp - 0x1564]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1588]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x156c]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x1560]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x155c]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x1558]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x1444]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
mov dword [ebx + 0x30], edx
test edi, edi
je 0x4358a2
lea ebx, [ebp - 0x13c0]
call fcn.00437810
mov ebx, dword [ebp - 0x4068]
lea ecx, [ebx + 0xe34]
lea eax, [ebp - 0xfa8]
call fcn.00437a30
mov eax, dword [ebp - 0xf98]
mov ecx, dword [ebp - 0xf94]
jmp 0x435b4d
cmp edi, 0xe24
jne 0x4359a2
mov ecx, edi
lea eax, [ebp - 0x405c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4358d8
mov edi, dword [ebp - 0x4064]
mov esi, 0xe24
lea edx, [ebp - 0x405c]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov eax, dword [ebp - 0x4038]
mov dx, word [ebp - 0x403c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x4058]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x4034]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x402c]
mov dword [ebx + 0x28], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x4028]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x3f14]
mov word [ebx + 0x20], dx
mov edx, dword [ebp - 0x4030]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
test edi, edi
je 0x435974
lea edx, [ebp - 0x3e90]
call fcn.004378c0
lea ecx, [ebx + 0xe34]
lea eax, [ebp - 0x3250]
call fcn.00437a30
mov ecx, dword [ebp - 0x3240]
mov edx, dword [ebp - 0x323c]
mov dword [ebx + 0xe54], ecx
mov dword [ebx + 0xe58], edx
jmp 0x435b59
cmp edi, 0xe4c
jne 0x435a7e
mov ecx, edi
lea eax, [ebp - 0x23dc]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4359b6
mov edi, dword [ebp - 0x4064]
mov esi, 0xe4c
lea edx, [ebp - 0x23dc]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov ax, word [ebp - 0x23bc]
mov edx, dword [ebp - 0x23b4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x23d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x23b8]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x23ac]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x23b0]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x23a8]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x2294]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
mov ecx, 0x31a
lea esi, [ebp - 0x2210]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xe34]
lea eax, [ebp - 0x15a8]
call fcn.00437a30
mov edx, dword [ebp - 0x1598]
mov eax, dword [ebp - 0x1594]
mov dword [ebx + 0xe54], edx
mov dword [ebx + 0xe58], eax
jmp 0x435b59
cmp edi, 0xe58
jne 0x435b60
mov ecx, edi
lea eax, [ebp - 0x3234]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435a92
mov edi, dword [ebp - 0x4064]
mov esi, 0xe58
lea edx, [ebp - 0x3234]
call fcn.00449680
cmp eax, esi
jne 0x435b60
mov edx, dword [ebp - 0x3210]
mov eax, dword [ebp - 0x320c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x3230]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x3214]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x3208]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x3204]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x3200]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov ecx, 0x21
lea esi, [ebp - 0x30ec]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x1cc]
mov ecx, 0x31a
lea esi, [ebp - 0x3068]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xe34]
mov dword [ebx + 0x30], edx
test ecx, ecx
je 0x435b41
lea eax, [ebp - 0x2400]
call fcn.00437a70
mov eax, dword [ebp - 0x23e4]
mov ecx, dword [ebp - 0x23e0]
mov dword [ebx + 0xe58], ecx
mov dword [ebx + 0xe54], eax
mov byte [ebp - 0x405d], 1
mov esi, dword [ebp - 0x4064]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x435b7c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov bl, byte [ebp - 0x405d]
test bl, bl
je 0x435b93
mov edx, dword [ebp - 0x406c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x405d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4