Function at 0x44fd3c
Capabilities:
Delete file
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x30], ebx
test dl, dl
je 0x44fd5f
add esp, 0xfffffff0
call fcn.00403118
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x45045b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00402e74
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 1
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
call fcn.00403a20
mov eax, dword [esi + 0x28]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov al, byte [esi + 0x2c]
mov edx, dword [ebp - 4]
mov byte [edx + 0x2c], al
mov eax, esi
call fcn.004507d8
mov ebx, eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp byte [ebx + 0x14], 0
je 0x44fe09
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
test edi, edi
je 0x44ff01
xor edx, edx
mov eax, edi
call fcn.00442e6c
mov edx, 2
mov eax, edi
call fcn.00442e78
mov edx, 1
mov eax, edi
call fcn.00442e88
jmp 0x44ff01
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00449974
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
push eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004498a4
pop edx
sub edx, eax
mov dword [ebp - 0x28], edx
mov eax, dword [esi + 0x14]
add eax, dword [ebp - 0x28]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
test edi, edi
je 0x44fe73
xor edx, edx
mov eax, edi
call fcn.00442e6c
mov eax, dword [esi + 0x1c]
movzx edx, word [eax + 6]
inc edx
mov eax, edi
call fcn.00442e78
mov edx, 1
mov eax, edi
call fcn.00442e88
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x450488
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004498a4
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x68]
mov ecx, 3
mov eax, 0x4504b0
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407464
test al, al
je 0x44ff4a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403e0c
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x44ff4a
push 0x4504f8
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x450518
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00403d08
mov eax, dword [ebp - 0x38]
call fcn.0044f948
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
push ebp
push 0x450409
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403e0c
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x44ffc7
push 0x450524
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x45053c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x6c]
call fcn.00407230
push dword [ebp - 0x6c]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00403d08
mov eax, dword [ebp - 0x38]
call fcn.0044f948
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x450016
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x6c]
call fcn.00407230
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x38]
mov edx, 0x450550
call fcn.00403c94
mov eax, dword [ebp - 0x38]
call fcn.0044f948
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x450043
mov eax, 0x45057c
call fcn.0044f948
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [esi + 0x18]
add eax, dword [edx + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x10]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
cmp byte [ebx + 0x14], 0
je 0x4500c5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406344
mov eax, esi
call fcn.004507d8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x448f88]
call fcn.004499c0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
jmp 0x4503a8
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x54]
mov edx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406344
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x20]
call fcn.004498a4
sub ebx, eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x20]
call fcn.004498a4
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0
lea edx, [ebp - 0x84]
mov ecx, 2
mov eax, 0x45059c
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x4505d8
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 8]
add dword [eax + 0x50], edx
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0
lea edx, [ebp - 0x8c]
xor ecx, ecx
mov eax, 0x450604
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x28]
add dword [eax + 0x20], edx
cmp dword [ebp - 8], 0
je 0x4501f1
push ebp
call fcn.0044fba8
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ebx, eax
add ebx, 0xf8
movzx eax, word [eax + 6]
test eax, eax
jle 0x4503a8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 1
test edi, edi
je 0x450223
mov edx, dword [ebp - 0x2c]
mov eax, edi
call fcn.00442e88
mov edx, 0x450618
mov eax, ebx
mov ecx, 8
call fcn.00407a38
test eax, eax
jne 0x4502fc
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x450628
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
mov eax, esi
call fcn.004507d8
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x448f88]
call fcn.004499c0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
mov dword [ebx + 0x10], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.004498a4
mov dword [ebx + 8], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x450668
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
jmp 0x450399
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004498a4
mov ecx, eax
mov eax, dword [ebx + 0x14]
add eax, dword [esi + 0x10]
push eax
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x10]
add eax, dword [ebp - 0x24]
pop edx
call fcn.00406344
mov edx, ebx
lea eax, [ebp - 0x30]
mov ecx, 8
call fcn.00403ab0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x30]
call fcn.00403e0c
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 6
mov eax, dword [ebx + 0x14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.004498a4
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x68]
mov ecx, 3
mov eax, 0x4506a8
call fcn.00407f94
mov eax, dword [ebp - 0x38]
call fcn.00446d20
cmp dword [ebp - 0x24], 0
je 0x450399
mov eax, dword [ebp - 0x24]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0xc], eax
add ebx, 0x28
inc dword [ebp - 0x2c]
dec dword [ebp - 0x34]
jne 0x450215
mov eax, dword [ebp - 4]
mov bl, byte [eax + 0x2c]
test bl, bl
je 0x4503bc
mov eax, dword [ebp - 4]
call fcn.00450880
mov byte [eax], bl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_FlushViewOfFile
test eax, eax
jne 0x4503dd
mov eax, 0x4506d8
call fcn.0044f948
test edi, edi
je 0x4503f1
mov eax, edi
call fcn.00442cf0
mov edx, eax
mov eax, edi
call fcn.00442e88
mov eax, dword [ebp - 4]
call fcn.004507d8
mov edx, dword [ebp - 4]
mov dword [eax + 0x2c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x450435
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450462
lea eax, [ebp - 0x6c]
call fcn.004039cc
lea eax, [ebp - 0x38]
call fcn.004039cc
lea eax, [ebp - 0x30]
call fcn.004039cc
ret