Function at 0x467f10
Capabilities:
Delete file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
cmp dword [esi], 2
push edi
jne 0x467f4e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
push 5
push 4
mov edi, eax
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esi + 0x214]
push eax
call fcn.0047d3d0
add esp, 4
push str.IsWow64Process
push 0x53f174
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x467f90
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x24], 0
je 0x46805c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
jmp 0x467fa6
jmp 0x467faa
lea ebx, [ecx + 0x796f]
xor ebx, 0x501
or ebx, 0x781a
add ebx, 0x12
jmp 0x467fc2
lea edx, [ebx - 0xc]
and edx, 0x14
or edx, 0x199d6a
mov eax, 0x110
sub eax, edx
mov dword [esp + 0x24], eax
jmp 0x467fdc
mov edx, ecx
and edx, 0x3844
xor edx, eax
or edx, 0x41ab
mov edi, 0x796f
sub edi, edx
jmp 0x467ff7
jmp 0x467ffa
jmp 0x467ffe
jmp 0x468002
lea eax, [edi + edi*8]
add eax, eax
cdq
mov ebp, 0x18
idiv ebp
lea esi, [edi + ecx - 0x123]
and esi, 0x332
lea eax, [edi + 0x422b]
and edx, 0x154
xor esi, edx
mov edx, edi
sub edx, ecx
and esi, ebx
xor esi, eax
add edx, 0x332
lea eax, [edi - 0x3f55]
and edx, eax
or esi, edx
mov edx, 0x332
shl edx, cl
add edi, 0xffffbe31
and edi, edx
and edi, dword [esp + 0x24]
or esi, edi
jmp 0x46824a
mov dword [esp + 0x20], 0x110
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 0x8456
mov dword [esp + 0x18], 0x4287
mov dword [esp + 0x14], 0x332
mov dword [esp + 0x10], 0x3678
mov dword [esp + 0x1c], 0x12
jmp 0x46809b
pushaw
mov eax, dword [esp + 0x34]
jmp 0x4680a5
mov ebx, dword [esp + 0x28]
jmp 0x4680ac
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
jmp 0x4680bc
mov edi, dword [esp + 0x24]
and eax, ebx
jmp 0x4680c6
or eax, esi
and ebx, dword [esp + 0x38]
jmp 0x4680d0
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [esp + 0x30], ebx
jmp 0x4680dd
add edi, esi
and ebx, eax
jmp 0x4680e6
xor esi, edi
add esi, ebx
jmp 0x4680ed
sub ecx, esi
add edi, ebx
jmp 0x4680f5
xor ecx, edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], eax
jmp 0x468103
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], esi
jmp 0x468112
popaw
jmp 0x468117
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
lea edx, [ecx + eax]
mov eax, dword [esp + 0x10]
add esi, eax
and edx, esi
lea esi, [eax + eax*8]
add esi, esi
and esi, 0x23
xor edx, esi
and ecx, eax
or edx, ecx
or edx, dword [esp + 0x18]
add eax, edx
mov dword [esp + 0x10], eax
jmp 0x46814a
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, dword [esp + 0x24]
lea ecx, [eax + ebp]
xor edx, ecx
mov ecx, dword [esp + 0x1c]
add eax, ecx
xor eax, 0x19b
or edx, eax
add ecx, edx
mov dword [esp + 0x1c], ecx
jmp 0x468175
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub ecx, dword [esp + 0x18]
lea edx, [ecx + eax + 5]
and edx, eax
mov eax, dword [esp + 0x10]
imul eax, eax, 0xd8
sar eax, 2
or edx, eax
sub dword [esp + 0x20], edx
jmp 0x46819d
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, eax
and ecx, ebp
xor ecx, dword [esp + 0x20]
add edx, 0x12
xor edx, dword [esp + 0x14]
or ecx, edx
sub eax, ecx
mov dword [esp + 0x10], eax
jmp 0x4681c0
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
add eax, dword [esp + 0x18]
mov ecx, ebp
shl edx, cl
and eax, edx
and dword [esp + 0x20], eax
jmp 0x4681dd
mov esi, dword [esp + 0x24]
mov eax, esi
cdq
idiv dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + ecx*8]
add eax, eax
mov edi, edx
cdq
mov ebx, 0x18
idiv ebx
mov eax, dword [esp + 0x18]
add ecx, eax
add ecx, esi
add ecx, ebp
and ecx, dword [esp + 0x14]
and edi, edx
xor edi, ecx
and dword [esp + 0x1c], edi
jmp 0x468215
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x18]
mov edx, ecx
add esi, eax
sub edx, ebp
add edx, eax
mov eax, dword [esp + 0x24]
and esi, edx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor eax, dword [esp + 0x1c]
or esi, eax
or dword [esp + 0x20], esi
jmp 0x468246
mov esi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [esp + 0x34]
push esi
call ebx
push eax
call fcn.00402fc0
add esp, 8
push 1
call ebx
push eax
call fcn.00403c80
add esp, 8
call ebx
push eax
call fcn.00403d70
add esp, 4
call ebx
push eax
push str.CryptDiskProtectedSetProcess:_pid_d
call fcn.00468970
lea esi, [edi + 0x214]
push esi
xor ebp, ebp
call fcn.00467e10
add esp, 0xc
test eax, eax
jne 0x4682d2
mov eax, dword [edi]
sub eax, 1
je 0x4682b8
sub eax, 3
jne 0x468312
lea eax, [edi + 0x624]
push eax
push esi
call fcn.00486070
add esp, 8
jmp 0x468310
push 0
push 0
lea ecx, [edi + 0x624]
push ecx
lea edx, [edi + 0x41c]
push esi
push edx
call fcn.00485b60
jmp 0x46830d
cmp eax, 1
jne 0x468312
mov eax, dword [edi]
sub eax, 1
je 0x4682f5
sub eax, 3
jne 0x468312
lea eax, [edi + 0x624]
push eax
push esi
call fcn.004857d0
add esp, 8
jmp 0x468310
push 0
push 0
lea ecx, [edi + 0x624]
push ecx
lea edx, [edi + 0x41c]
push esi
push edx
call fcn.004850e0
add esp, 0x14
mov ebp, eax
lea esi, [edi + 0xc]
push esi
call fcn.0047dc40
add esp, 4
test eax, eax
je 0x46832b
push esi
call fcn.0046d450
add esp, 4
call ebx
push eax
call fcn.00403d80
add esp, 4
call ebx
push eax
push str.CryptDiskProtectedDelProcess:_pid_d
call fcn.00468970
add esp, 8
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret