Function at 0x403623
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x290], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
push 0xd
mov dword [esp + 0x30], eax
mov ebx, edx
pop eax
mov dword [esp + 0x28], ecx
mov esi, eax
mov edi, 0xa0
mov dword [esp + 0xc], esi
mov edx, edi
mov ecx, ebx
call fcn.004021e7
add eax, 0xe
cmp eax, edi
ja 0x40375c
push ebx
push 0x401270
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.004016aa
add esp, 0x10
test eax, eax
js 0x403ae3
lea eax, [esp + 0xb8]
push 0x180
push eax
call dword [sym.imp.msvcrt.dll__chmod]
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 0xc
lea eax, [esp + 0xb8]
push edi
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
push 0x1001
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
lea eax, [esp + 0xb8]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
cmp edi, 0xffffffff
jne 0x4036fb
push 4
jmp 0x40375e
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x40672c]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x40375c
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x4063f0]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x403933
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 6
pop eax
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404d30
mov esp, ebp
pop ebp
ret 4
mov cl, byte [edi + 1]
cmp cl, 0x3a
jne 0x403784
cmp byte [edi + 2], 0x5c
je 0x40378e
cmp byte [edi], 0x5c
jne 0x403798
cmp cl, 0x5c
jne 0x403798
mov byte [esp + 0x158], 0
jmp 0x4037ca
mov esi, dword [esp + 0x28]
mov edx, 0xa0
mov ecx, esi
call fcn.004021e7
mov ecx, 0xa0
cmp eax, ecx
jge 0x40375c
push ecx
push esi
push ecx
mov edx, ecx
lea ecx, [esp + 0x164]
call fcn.0040170f
test eax, eax
js 0x403ae3
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.004021e7
mov edx, 0xa0
lea ecx, [esp + 0x158]
mov esi, eax
call fcn.004021e7
add esi, eax
mov eax, 0xa0
cmp esi, eax
jae 0x40375c
push edi
mov edx, eax
lea ecx, [esp + 0x15c]
call fcn.00401645
test eax, eax
js 0x403ae3
mov edi, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x1c]
call fcn.004021e7
mov edx, 0xa0
mov ecx, ebx
mov esi, eax
call fcn.004021e7
inc eax
mov ecx, 0xa0
add eax, esi
cmp eax, ecx
jae 0x40375c
push edi
push ebx
push 0x401154
push ecx
lea eax, [esp + 0xc8]
push eax
call fcn.004016aa
add esp, 0x14
test eax, eax
js 0x403ae3
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.0040fcc1
test eax, eax
je 0x403950
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40128c
call fcn.00403525
test eax, eax
je 0x403950
mov edi, dword [esp + 0x18]
cmp byte [edi], 0x40
jne 0x4038d9
cmp byte [0x406cc0], 0
je 0x40394c
mov esi, dword [esp + 0xc]
mov dword [esp + 0x24], 1
jmp 0x403910
lea edx, [esp + 0xb8]
lea ecx, [esp + 0x158]
call fcn.00403c97
movzx esi, ax
push 0xd
pop eax
mov dword [esp + 0xc], esi
cmp si, ax
jne 0x403957
lea eax, [esp + 0xb8]
push 0x100
push eax
call dword [sym.imp.msvcrt.dll__chmod]
pop ecx
pop ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x10]
add edi, eax
mov dword [esp + 0x18], edi
call fcn.004021e7
mov ecx, dword [esp + 0x10]
inc ecx
add ecx, eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.004021e7
mov dword [esp + 0x20], eax
test eax, eax
jne 0x403776
jmp 0x403957
push 3
jmp 0x403952
push 7
pop esi
mov dword [esp + 0xc], esi
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edi, 0xa0
mov ecx, ebx
mov edx, edi
call fcn.004021e7
add eax, 0xe
cmp eax, edi
ja 0x40375c
push ebx
push 0x401270
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.004016aa
add esp, 0x10
test eax, eax
js 0x403ae3
mov edi, dword [esp + 0x2c]
mov edx, 0xa0
mov ecx, ebx
mov byte [edi], 0
call fcn.004021e7
mov ecx, 0xa0
cmp eax, ecx
jae 0x40375c
push ecx
push ebx
push ecx
mov edx, ecx
lea ecx, [esp + 0x204]
call fcn.0040170f
test eax, eax
js 0x403ae3
push 0xd
pop eax
mov byte [edi], 0x5c
cmp si, ax
jne 0x403a73
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40128c
call fcn.0040fcc1
test eax, eax
je 0x403a65
sub esp, 0x88
lea esi, [esp + 0xb8]
mov edx, ebx
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401290
call fcn.0040fcc1
test eax, eax
je 0x403a65
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x280]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401290
call fcn.00403525
test eax, eax
jne 0x403a6c
push 7
jmp 0x40375e
mov esi, dword [esp + 0xc]
push 0xd
pop eax
cmp dword [esp + 0x24], 0
je 0x403adb
cmp si, ax
jne 0x403adb
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, eax
test esi, esi
je 0x40375c
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalLock]
test eax, eax
je 0x403750
lea ecx, [esp + 0xb8]
push ecx
push ecx
push eax
push esi
push ebx
push dword [esp + 0x3c]
push ecx
push ecx
call fcn.00401975
push dword [0x40672c]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ax, si
jmp 0x40375f
call fcn.0040221a
int3