Function at 0x402a70
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x7f14
call fcn.004032e0
push ebx
lea eax, [esp + 0x4868]
push esi
push eax
push 0xfa0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x402aa1
pop esi
mov eax, 1
pop ebx
add esp, 0x7f14
ret
push ebp
push edi
or ecx, 0xffffffff
lea edi, [esp + 0x4874]
xor eax, eax
lea edx, [esp + 0x11c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x11c4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.S2.TXT
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x2164]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x11c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4874]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x11c4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.A4.TXT
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x3104]
and ecx, 3
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x3104]
push ecx
call ebp
mov edx, 0x31313131
lea eax, [esp + 0x224]
mov dword [esp + 0x10], edx
mov ecx, 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov byte [eax], 0
add eax, 0x7d0
dec ecx
jne 0x402be2
lea eax, [esp + 0x5814]
mov ecx, 5
mov byte [eax], 0
add eax, 0x7d0
dec ecx
jne 0x402bf9
lea eax, [esp + 0x2164]
push 0x40d068
push eax
call fcn.004036c1
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x402c86
lea ecx, [esp + 0x2164]
push ecx
push 0x40dfa4
push 0x40e010
call fcn.00403000
add esp, 0xc
mov bl, byte [esp + 0x10]
lea ecx, [esp + 0x3104]
push 0x40dfa0
push ecx
call fcn.004036c1
add esp, 8
mov esi, eax
test esi, esi
pop edi
pop ebp
jne 0x402fb7
lea edx, [esp + 0x30fc]
push edx
push 0x40df88
push 0x40e010
call fcn.00403000
add esp, 0xc
mov eax, 1
pop esi
pop ebx
add esp, 0x7f14
ret
xor esi, esi
push ebx
lea edx, [esp + 0x40a8]
push 0x7d0
push edx
call fcn.0040362e
add esp, 0xc
test eax, eax
je 0x402d3b
test esi, esi
je 0x402cbf
push esi
push 0x40df64
push 0x40e010
call fcn.00403000
add esp, 0xc
jmp 0x402d0e
lea eax, [esp + 0x40a4]
lea ecx, [esp + 0x224]
push eax
push ecx
call fcn.00401450
lea edi, [esp + 0x22c]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x402cf9
push 0x40df48
call fcn.0040319c
add esp, 4
jmp 0x402d0e
lea edx, [esp + 0x224]
push edx
push 0x40df2c
call fcn.0040319c
add esp, 8
inc esi
cmp esi, 1
jl 0x402c88
push ebx
call fcn.004035b1
add esp, 4
lea ecx, [esp + 0x2164]
push ecx
call ebp
call fcn.00401c70
test eax, eax
jne 0x402d60
mov bl, 0x32
jmp 0x402c3d
lea eax, [esp + 0x2164]
push eax
push 0x40df14
push 0x40e010
call fcn.00403000
push ebx
call fcn.004035b1
add esp, 0x10
jmp 0x402c39
cmp dword [0x43c24c], 5
jb 0x402e17
push str.PREVIL.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x402d95
push str.LoadLibrary__PREVIL.dll__
push 0x40e010
call fcn.00403000
add esp, 8
mov bl, 0x33
jmp 0x402c3d
push str.IsOkPrivileges
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x402dc0
push str.GetProcAddress__loadDll__IsOkPrivileges__
push 0x40e010
call fcn.00403000
add esp, 8
mov bl, 0x33
jmp 0x402c3d
push esi
lea edx, [esp + 0x11c8]
push 0x40de54
push edx
call fcn.004036d4
add esp, 0xc
lea eax, [esp + 0x11c4]
push eax
push 0x40e010
call fcn.00403000
add esp, 8
call esi
test eax, eax
jne 0x402e0a
push str.IsOkPrivileges__
push 0x40e010
call fcn.00403000
add esp, 8
mov bl, 0x33
jmp 0x402c3d
push 0x40de08
call fcn.0040319c
add esp, 4
mov edi, 0x40de04
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x67b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x200
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x6f88]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TKIPPSK
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5818]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x228]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push edx
push str.admin
call fcn.004022d0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x402edb
push str.GetESSID__
push 0x40e010
call fcn.00403000
add esp, 8
cmp esi, 0xffffffff
jne 0x402c39
mov bl, 0x38
jmp 0x402c3d
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5fe4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x581c]
push ecx
call fcn.00401700
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jg 0x402f3e
lea edx, [esp + 0x5814]
push edx
push str.Encode___s__szWepAry_4__
jmp 0x402c2c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x7754]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x224]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x7754]
push ecx
push edx
push str.admin
call fcn.00402120
mov esi, eax
add esp, 0xc
test esi, esi
je 0x402f91
push str.SetEncryption2__
jmp 0x402ebe
push 0x40dd6c
call fcn.0040319c
lea eax, [esp + 0x228]
push eax
push str.admin
call fcn.00401fe0
add esp, 0xc
mov bl, 0x30
jmp 0x402c3d
movsx eax, byte [esp + 9]
movsx ecx, bl
push eax
push ecx
push str._c_n_c_n
push esi
call fcn.00403000
push esi
call fcn.004035b1
add esp, 0x14
xor eax, eax
pop esi
pop ebx
add esp, 0x7f14
ret