Function at 0x8f5cf0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x8f5cf8
mov eax, 0x8ddf40
call fcn.00411204
xor eax, eax
push ebp
push 0x8f6153
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x99fc50
call fcn.00409fc0
mov eax, 0x99fc54
call fcn.00409fc0
xor eax, eax
mov dword [0x99fc48], eax
xor eax, eax
mov dword [0x99fc4c], eax
call fcn.008dde88
lea eax, [ebp - 0x14]
call fcn.00740f54
mov edx, dword [ebp - 0x14]
mov eax, 0x99fc44
call fcn.0040a3a0
cmp dword [0x99fc44], 0
jne 0x8f5d6b
mov eax, 0x99fc44
mov edx, 0x8f616c
call fcn.0040a3a0
lea eax, [ebp - 0x18]
call fcn.00744928
mov edx, dword [ebp - 0x18]
mov eax, 0x99fc50
call fcn.0040a3a0
lea eax, [ebp - 0x1c]
call fcn.007459dc
mov edx, dword [ebp - 0x1c]
mov eax, 0x99fc54
call fcn.0040a3a0
lea edx, [ebp - 0x20]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x20]
mov edx, 0x8f6190
call fcn.0040b1c8
jne 0x8f5de9
mov eax, dword [0x90de38]
mov eax, dword [eax]
call fcn.0061fde4
mov eax, dword [0x90de38]
mov eax, dword [eax]
xor edx, edx
call fcn.00621b58
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov byte [eax + 0x6f], 0
mov eax, dword [0x90de38]
mov eax, dword [eax]
call fcn.0061ff58
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, dword [0x90de38]
mov eax, dword [eax]
call fcn.0061fde4
push dword [0x99fc50]
push 0x8f61bc
lea edx, [ebp - 0x28]
mov eax, dword [0x99fc44]
call fcn.0073ec1c
push dword [ebp - 0x28]
push 0x8f61d8
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040b118
mov eax, dword [ebp - 0x24]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
push dword [0x99fc50]
push 0x8f61bc
lea edx, [ebp - 0x30]
mov eax, dword [0x99fc44]
call fcn.0073ec1c
push dword [ebp - 0x30]
push 0x8f61fc
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.0040b118
mov eax, dword [ebp - 0x2c]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x34]
mov ecx, 0x8f61fc
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x34]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x38]
mov ecx, 0x8f6224
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x38]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
push dword [0x99fc50]
push 0x8f61bc
lea edx, [ebp - 0x40]
mov eax, dword [0x99fc44]
call fcn.0073ec1c
push dword [ebp - 0x40]
push 0x8f6224
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.0040b118
mov eax, dword [ebp - 0x3c]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x44]
mov ecx, 0x8f6248
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x44]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
push dword [0x99fc50]
push 0x8f6268
lea edx, [ebp - 0x4c]
mov eax, dword [0x99fc44]
call fcn.0073ec1c
push dword [ebp - 0x4c]
push 0x8f6248
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.0040b118
mov eax, dword [ebp - 0x48]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x50]
mov ecx, 0x8f6284
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x50]
mov dl, 1
call fcn.0042682c
test al, al
je 0x8f5fa8
lea eax, [ebp - 0x54]
mov ecx, 0x8f62ac
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x54]
call fcn.0040ae24
push eax
lea eax, [ebp - 0x58]
mov ecx, 0x8f6284
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x58]
call fcn.0040ae24
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x5c]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x5c]
mov edx, 0x8f62cc
call fcn.0040b1c8
je 0x8f5ffc
lea edx, [ebp - 0x60]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x60]
mov edx, 0x8f62ec
call fcn.0040b1c8
je 0x8f5ffc
lea edx, [ebp - 0x64]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x64]
mov edx, 0x8f6310
call fcn.0040b1c8
jne 0x8f6075
call fcn.007427a0
test al, al
jne 0x8f6069
lea edx, [ebp - 0x68]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x68]
mov edx, 0x8f6310
call fcn.0040b1c8
je 0x8f6069
push 0x2004
push 0x8f6328
push 0x8f6348
push 0
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x8f6069
lea edx, [ebp - 0x6c]
mov eax, 1
call fcn.00407388
mov eax, dword [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00407388
mov edx, dword [ebp - 0x70]
xor eax, eax
pop ecx
call fcn.007426f0
push 0
call sub.kernel32.dll_ExitProcess_1
call fcn.008da964
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x7c]
xor eax, eax
call fcn.00407388
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.004270c4
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00424eb8
mov eax, dword [ebp - 0x74]
mov edx, 0x8f6444
call fcn.0040b1c8
jne 0x8f6123
cmp dword [0x99fc50], 0
je 0x8f60ce
lea eax, [ebp - 0x80]
mov ecx, 0x8f61fc
mov edx, dword [0x99fc50]
call fcn.0040b090
mov eax, dword [ebp - 0x80]
call fcn.0042648c
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov edx, 0x8f6468
call fcn.0061f814
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov dl, 1
call fcn.00621b58
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov byte [eax + 0x6f], 1
mov ecx, dword [0x90dc0c]
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov edx, dword [0x8af0e0]
call fcn.0061fdfc
mov eax, dword [0x90de38]
mov eax, dword [eax]
call fcn.0061ff58
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
call sub.kernel32.dll_Sleep_2
push 0
call sub.kernel32.dll_Sleep_2
push 0
call sub.kernel32.dll_ExitProcess_1