Function at 0x535788
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd5c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x288], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 4]
call fcn.00407558
lea eax, [ebp - 0x280]
mov edx, dword [0x40eb1c]
call fcn.00408308
xor eax, eax
push ebp
push 0x535b58
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x535b12
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x535827
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x535827
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406a40
mov ebx, eax
test ebx, ebx
je 0x535832
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x288]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407d60
mov eax, dword [ebp - 0x288]
mov edx, 0x535b74
call fcn.00407cf8
je 0x53586c
lea eax, [ebp - 8]
mov ecx, 0x535b74
mov edx, dword [ebp - 4]
call fcn.00407a54
jmp 0x535877
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004075c4
lea eax, [ebp - 0x28c]
mov ecx, 0x535b84
mov edx, dword [ebp - 8]
call fcn.00407a54
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.00415238
test eax, eax
jne 0x535b00
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x26c]
call fcn.00414230
mov eax, dword [ebp - 0xc]
mov edx, 0x535b98
call fcn.00407cf8
je 0x535ae2
mov eax, dword [ebp - 0xc]
mov edx, 0x535ba8
call fcn.00407cf8
je 0x535ae2
lea edx, [ebp - 0x294]
mov eax, dword [0x544954]
mov eax, dword [eax]
call fcn.004b3824
mov eax, dword [ebp - 0x294]
lea edx, [ebp - 0x290]
call fcn.004155f0
mov eax, dword [ebp - 0x290]
mov edx, dword [ebp - 8]
call fcn.004080d0
test eax, eax
jne 0x53591e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x535b1c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00407a54
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0041518c
mov eax, dword [ebp - 0x270]
test al, 0x10
je 0x535985
lea eax, [ebp - 0x298]
mov ecx, 0x535b74
mov edx, dword [ebp - 0xc]
call fcn.00407a54
mov edx, dword [ebp - 0x298]
mov eax, dword [ebp - 0x284]
mov eax, dword [eax + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x535ae2
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x284]
call fcn.00535788
jmp 0x535a8a
mov edx, eax
and edx, 0x1ff
cmp eax, edx
jne 0x535a8a
lea edx, [ebp - 0x29c]
mov eax, dword [ebp - 0xc]
call fcn.004155b4
mov edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x284]
mov eax, dword [eax + 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x535ae2
mov eax, dword [ebp - 0xc]
call fcn.004e00ec
mov ecx, dword [ebp - 0x284]
add eax, dword [ecx + 0x30]
adc edx, dword [ecx + 0x34]
mov ecx, dword [ebp - 0x284]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x284]
call fcn.005354f8
mov eax, dword [ebp - 0xc]
call fcn.004075fc
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x535a7e
lea edx, [ebp - 0x2a4]
mov eax, dword [ebp - 0x26c]
call fcn.004156f0
mov eax, dword [ebp - 0x2a4]
lea edx, [ebp - 0x2a0]
call fcn.00413c78
mov eax, dword [ebp - 0x2a0]
mov edx, 0x535bbc
call fcn.00407cf8
jne 0x535a7e
mov eax, dword [ebp - 0x26c]
mov edx, 0x535bd4
call fcn.00407cf8
je 0x535a7e
push 0
mov edx, dword [ebp - 0x26c]
mov eax, dword [0x52ed34]
call fcn.00531bb0
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
call fcn.004075fc
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [0x544954]
mov eax, dword [eax]
call fcn.004b2cb0
mov eax, dword [ebp - 0x284]
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
add eax, 1
adc edx, 0
mov ecx, dword [ebp - 0x284]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], edx
xor eax, eax
push ebp
push 0x535acc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0x284]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x535ae2
lea eax, [ebp - 0x280]
call fcn.00415288
test eax, eax
je 0x5358a8
lea eax, [ebp - 0x280]
call fcn.004152ac
mov eax, dword [ebp - 8]
call fcn.004158c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x535b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535b5f
lea eax, [ebp - 0x2a4]
mov edx, 8
call fcn.00407568
lea eax, [ebp - 0x280]
mov edx, dword [0x40eb1c]
call fcn.004083e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407568
ret