Function at 0x4115d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fe47
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x4778e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x890], ecx
mov dword [ebp - 0x880], 0
mov byte [ebp - 0xd], 0
push 0x463b84
call fcn.0040d2d0
add esp, 4
push 0x463b88
call fcn.0040d330
add esp, 4
lea ecx, [ebp - 0x87c]
call fcn.0040ee00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.0040de10
mov byte [ebp - 4], 1
push 0
push 0x463b8c
lea ecx, [ebp - 0x87c]
call fcn.0040f020
test eax, eax
je 0x41193e
push 3
call fcn.0040de00
add esp, 4
mov dword [ebp - 0x884], 0
jmp 0x411683
mov eax, dword [ebp - 0x884]
add eax, 1
mov dword [ebp - 0x884], eax
mov ecx, dword [ebp - 0x884]
cmp ecx, dword [ebp + 0xc]
jge 0x4118cf
cmp dword [ebp - 0x884], 0
je 0x4116b0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x884]
movsx eax, byte [edx - 1]
test eax, eax
jne 0x4118ca
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x884]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x4116c3
jmp 0x411674
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x884]
movsx edx, byte [ecx]
test edx, edx
je 0x4118ca
mov eax, dword [ebp - 0x890]
add eax, 0x56
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x884]
push ecx
call fcn.0044a728
add esp, 8
test eax, eax
je 0x4118ca
push str.Run.dad
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x884]
push edx
call fcn.0044a728
add esp, 8
test eax, eax
je 0x4118ca
push 0x463ba0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x884]
push eax
call fcn.0044a728
add esp, 8
test eax, eax
jne 0x411758
mov byte [ebp - 0xd], 1
push 2
call fcn.0040de00
add esp, 4
mov ecx, dword [ebp - 0x890]
call fcn.00412820
push 3
call fcn.0040de00
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x884]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0040e160
test eax, eax
je 0x4117c9
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x884]
push edx
lea ecx, [ebp - 0x5c]
call fcn.0040e3f0
lea ecx, [ebp - 0x5c]
call fcn.0040dea0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x884]
push eax
push 0x463bac
push 1
mov ecx, dword [ebp - 0x890]
mov edx, dword [ecx + 0x2c]
mov eax, dword [ebp - 0x890]
mov ecx, dword [eax + 0x2c]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
cmp dword [ebp - 0x880], 0
jne 0x4117c9
mov dword [ebp - 0x880], 1
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x4117f0
push 2
call fcn.0040de00
add esp, 4
mov ecx, dword [ebp - 0x890]
call fcn.00412940
push 3
call fcn.0040de00
add esp, 4
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x884]
push edx
call fcn.0043a920
add esp, 4
mov dword [ebp - 0x888], eax
push str..cps
mov eax, dword [ebp - 0x884]
add eax, dword [ebp - 0x888]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax - 4]
push edx
call fcn.0044a728
add esp, 8
test eax, eax
jne 0x4118ca
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x884]
push eax
push 0x463bcc
push 1
mov ecx, dword [ebp - 0x890]
mov edx, dword [ecx + 0x2c]
mov eax, dword [ebp - 0x890]
mov ecx, dword [eax + 0x2c]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x884]
push ecx
call fcn.00419070
add esp, 4
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x884]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x463be4
push 1
mov eax, dword [ebp - 0x890]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebp - 0x890]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
push str.QQLogin.cps
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x884]
push eax
call fcn.0044a728
add esp, 8
test eax, eax
jne 0x4118ca
mov dword [ebp - 0x880], 3
jmp 0x411674
cmp dword [ebp + 0xc], 0
jne 0x411934
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0040e160
test eax, eax
je 0x411934
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x5c]
call fcn.0040e3f0
lea ecx, [ebp - 0x5c]
call fcn.0040dea0
mov eax, dword [ebp + 8]
push eax
push 0x463c08
push 1
mov ecx, dword [ebp - 0x890]
mov edx, dword [ecx + 0x2c]
mov eax, dword [ebp - 0x890]
mov ecx, dword [eax + 0x2c]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0xc]
call eax
add esp, 0x10
cmp dword [ebp - 0x880], 0
jne 0x411934
mov dword [ebp - 0x880], 1
push 1
call fcn.0040de00
add esp, 4
lea ecx, [ebp - 0x87c]
call fcn.0040ee80
push str.data.tmp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x880]
mov dword [ebp - 0x88c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.0040e0b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x87c]
call fcn.0040ef90
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8