Function at 0x4e2de0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x134
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], str.testfile.dll
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x150
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp + 4], str.Expected_a_valid_file_handle_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov esi, dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x155
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x156
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0x7e
je 0x4e2ee8
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Expected_ERROR_MOD_NOT_FOUND_or_ERROR_INVALID_PARAMETER__got__ld_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x5e6420
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x15d
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x15e
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0x7e
je 0x4e2f86
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Expected_ERROR_MOD_NOT_FOUND_or_ERROR_DLL_NOT_FOUND__got__ld_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], str.testfile.dll
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x165
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x166
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0x20
je 0x4e3020
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Unexpected_last_error__got__ld_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdeadbeef
mov dword [esp], str.testfile.dll
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x16c
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x16d
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0x20
je 0x4e30be
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Unexpected_last_error__got__ld_n
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.testfile.dll
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x174
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x175
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Expected_ERROR_SHARING_VIOLATION__got__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x20
sete al
mov dword [esp], eax
call fcn.004df840
mov ecx, dword [0x57f340]
test ecx, ecx
jne 0x4e3768
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], str.testfile.dll
call esi
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x188
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x110]
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x189
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Expected_ERROR_FILE_INVALID__got__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x3ee
sete al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.testfile.dll
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
sub esp, 4
mov dword [esp + 4], 0x104
mov dword [esp], ebx
mov dword [ebp - 0x120], eax
call eax
mov eax, dword [sym.imp.msvcrt.dll_strlen]
sub esp, 8
mov dword [esp], ebx
mov dword [ebp - 0x11c], eax
call eax
cmp byte [ebp + eax - 0x111], 0x5c
je 0x4e3266
mov edx, 0x5c
mov word [ebx + eax], dx
add eax, 1
add eax, ebx
mov dword [eax], 0x6e72656b
mov dword [eax + 4], 0x32336c65
mov dword [eax + 8], 0x6c6c642e
mov byte [eax + 0xc], 0
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x195
xor eax, eax
mov dword [esp + 4], str.Expected_valid_module_handle_n
mov edx, dword [ebp - 0x114]
test edx, edx
setne al
mov dword [esp], eax
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x196
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0xdeadbeef
je 0x4e3304
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Expected_0xdeadbeef_or_ERROR_SUCCESS__got__ld_n
mov dword [esp], eax
call fcn.004df840
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0xdeadbeef
mov dword [ebp - 0x114], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdeadbeef
mov dword [esp], ebx
call esi
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x4e3800
mov eax, dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [esp], edi
mov dword [ebp - 0x114], eax
call eax
sub esp, 4
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0xdeadbeef
mov dword [ebp - 0x118], edx
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0x5e65fb
call esi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1a5
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], str.Expected_valid_module_handle_n
mov dword [esp], eax
call fcn.004df840
call fcn.0057d110
mov edx, dword [ebp - 0x118]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1a6
mov eax, dword [edx + 0x34]
mov dword [esp + 4], 0x5e6e2f
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edx + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], edi
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
sub esp, 8
mov dword [esp], ebx
mov eax, dword [ebp - 0x11c]
call eax
cmp byte [ebp + eax - 0x111], 0x5c
je 0x4e343a
mov edi, 0x5c
mov word [ebx + eax], di
add eax, 1
add eax, ebx
mov edi, dword fs:[0x18]
mov dword [eax], 0x6e72656b
mov dword [eax + 4], 0x32336c65
mov dword [eax + 8], 0x6c6c642e
mov byte [eax + 0xc], 0
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call esi
sub esp, 0xc
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov edx, dword [ebp - 0x118]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1b2
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1b3
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5e6e50
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 2
sete al
mov dword [esp], eax
call fcn.004df840
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], str.comctl32.dll
call esi
sub esp, 0xc
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1ba
xor eax, eax
mov dword [esp + 4], str.Expected_valid_module_handle_n
mov ecx, dword [ebp - 0x118]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.004df840
mov eax, dword [ebp - 0x118]
mov dword [edi + 0x34], 0xdeadbeef
add eax, 0x1230
mov dword [esp], eax
mov ecx, dword [ebp - 0x114]
call ecx
sub esp, 4
mov dword [ebp - 0x124], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1be
xor eax, eax
mov dword [esp + 4], str.Free_succeeded_on_wrong_handle_n
mov ecx, dword [ebp - 0x124]
test ecx, ecx
sete al
mov dword [esp], eax
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1bf
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5e6856
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0xc1
sete al
mov dword [esp], eax
call fcn.004df840
mov eax, dword [ebp - 0x118]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp], eax
mov ecx, dword [ebp - 0x114]
call ecx
sub esp, 4
mov dword [ebp - 0x124], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1c3
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Expected_to_be_able_to_free_the_module__failed_with__ld_n
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x124]
mov dword [esp], ecx
call fcn.004df840
mov eax, dword [ebp - 0x118]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp], eax
mov ecx, dword [ebp - 0x114]
call ecx
sub esp, 4
mov dword [ebp - 0x118], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1c6
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.Unexpected_ability_to_free_the_module__failed_with__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x118]
xor eax, eax
test edx, edx
sete al
mov dword [esp], eax
call fcn.004df840
mov dword [esp + 4], 0x104
mov dword [esp], ebx
mov eax, dword [ebp - 0x120]
call eax
sub esp, 8
mov dword [esp], ebx
mov eax, dword [ebp - 0x11c]
call eax
cmp byte [ebp + eax - 0x111], 0x5c
je 0x4e36a5
mov edx, 0x5c
mov word [ebx + eax], dx
add eax, 1
add eax, ebx
mov dword [eax], 0x6e72656b
mov dword [eax + 4], 0x32336c65
mov byte [eax + 8], 0
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call esi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1ce
xor eax, eax
test edi, edi
setne al
mov dword [esp + 8], edi
mov dword [esp + 4], 0x5e6a4c
mov dword [esp], eax
call fcn.004df840
mov dword [esp], edi
mov edi, dword [ebp - 0x114]
call edi
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call esi
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x1d3
xor eax, eax
test ebx, ebx
setne al
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5e6a4c
mov dword [esp], eax
call fcn.004df840
mov dword [esp], ebx
call edi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call esi
sub esp, 0xc
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x17d
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.Expected_0__got__p_n
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x17e
mov edx, dword [edi + 0x34]
mov eax, 1
cmp edx, 0x7e
je 0x4e37e7
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.Expected_ERROR_MOD_NOT_FOUND_or_ERROR_INVALID_PARAMETER__got__ld_n
mov dword [esp], eax
call fcn.004df840
jmp 0x4e3175
call fcn.0057d110
mov edx, dword [ebp - 0x114]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x19e
mov eax, dword [edx + 0x34]
mov dword [esp + 4], 0x5e6856
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edx + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.004df840
jmp 0x4e334e