Function at 0x40aad0
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43fd4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x288
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2a8]
lea eax, [esp + 0x180]
push eax
push ecx
mov dword [esp + 0x2a8], 0
call fcn.00436de1
test eax, eax
je 0x40b091
mov esi, dword [esp + 0x2ac]
test esi, esi
jne 0x40ab35
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b062
lea ecx, [esp + 0x24]
call fcn.0041c0c7
mov edx, dword [esp + 0x2a8]
push 0
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a8], 1
call fcn.0041c18a
lea ecx, [esp + 0x24]
call fcn.0041c3aa
mov eax, dword [esp + 0x24]
push 0x10
lea ecx, [esp + 0x28]
call dword [eax + 0x38]
test eax, eax
lea ecx, [esp + 0x24]
jne 0x40afc7
call fcn.0041c140
cmp esi, 1
je 0x40add6
cmp esi, 3
je 0x40add6
cmp esi, 4
je 0x40aba0
cmp esi, 6
jne 0x40b080
mov edx, dword [esp + 0x2a8]
lea ecx, [esp + 0x40]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, dword [esp + 0x60]
cmp eax, 0xffffffff
jne 0x40abc0
mov esi, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x2b0]
xor eax, eax
cmp esi, ecx
jne 0x40b080
cmp eax, dword [esp + 0x2b4]
jne 0x40b080
mov eax, dword [esp + 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40adc9
mov ebp, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x530], 2
jne 0x40acbc
call fcn.00437b20
test eax, eax
je 0x40ac38
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ac3a
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push eax
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
je 0x40ac71
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x2a1
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push 2
push edx
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
jne 0x40ac4e
call fcn.00437b20
test eax, eax
je 0x40ac83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ac85
xor eax, eax
mov eax, dword [eax + 0x1c]
push 1
push eax
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
je 0x40acbc
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x2a1
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push 3
push edx
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
jne 0x40ac99
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x530], 3
jne 0x40ada0
mov ecx, dword [0x450e6c]
mov dword [esp + 0x10], ecx
push 0x5c
lea ecx, [esp + 0x2ac]
mov byte [esp + 0x2a4], 4
call fcn.004316eb
mov edx, dword [esp + 0x2a8]
inc eax
mov ecx, dword [edx - 8]
push ecx
push eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0x2b0]
push eax
call fcn.00431561
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], 5
call fcn.00432ad7
lea ecx, [esp + 0x20]
mov byte [esp + 0x2a0], 4
call fcn.0043299e
lea ecx, [esp + 0x10]
push str.___AutoFireWall
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00432c33
mov eax, dword [eax]
push eax
push 0
call ebp
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0043299e
test esi, esi
je 0x40ad8f
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
push str.___AutoFireWall
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00432c33
mov eax, dword [eax]
push eax
push 0
call ebp
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0043299e
test esi, esi
jne 0x40ad58
lea ecx, [esp + 0x10]
mov byte [esp + 0x2a0], 1
call fcn.0043299e
mov edx, dword [esp + 0x2a8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40ac0d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b051
mov ecx, dword [esp + 0x2a8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40afba
mov ebp, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x18]
cmp dword [edx + 0x530], 2
jne 0x40aead
call fcn.00437b20
test eax, eax
je 0x40ae29
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ae2b
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push eax
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
je 0x40ae62
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x2a1
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push 2
push edx
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
jne 0x40ae3f
call fcn.00437b20
test eax, eax
je 0x40ae74
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ae76
xor eax, eax
mov eax, dword [eax + 0x1c]
push 1
push eax
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
je 0x40aead
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x2a1
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push 3
push edx
call edi
push eax
call fcn.00433d07
mov esi, eax
test esi, esi
jne 0x40ae8a
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x530], 3
jne 0x40af91
mov ecx, dword [0x450e6c]
mov dword [esp + 0x10], ecx
push 0x5c
lea ecx, [esp + 0x2ac]
mov byte [esp + 0x2a4], 2
call fcn.004316eb
mov edx, dword [esp + 0x2a8]
inc eax
mov ecx, dword [edx - 8]
push ecx
push eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2b0]
push eax
call fcn.00431561
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4], 3
call fcn.00432ad7
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a0], 2
call fcn.0043299e
lea ecx, [esp + 0x10]
push str.___AutoFireWall
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00432c33
mov eax, dword [eax]
push eax
push 0
call ebp
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0043299e
test esi, esi
je 0x40af80
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
push str.___AutoFireWall
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00432c33
mov eax, dword [eax]
push eax
push 0
call ebp
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0043299e
test esi, esi
jne 0x40af49
lea ecx, [esp + 0x10]
mov byte [esp + 0x2a0], 1
call fcn.0043299e
mov edx, dword [esp + 0x2a8]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40adfe
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b051
call fcn.0041c140
cmp esi, 2
je 0x40b0cd
cmp esi, 3
je 0x40b0cd
cmp esi, 5
je 0x40afec
cmp esi, 6
jne 0x40b080
mov ecx, dword [esp + 0x2a8]
push ecx
mov ecx, ebx
call fcn.0040a9b0
cmp eax, dword [esp + 0x2b0]
jne 0x40b080
cmp edx, dword [esp + 0x2b4]
jne 0x40b080
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ecx
lea edx, [esp + 0x2ac]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.00432713
mov ecx, ebx
call fcn.0040a7e0
test eax, eax
jne 0x40b04d
push 0x14
call esi
mov eax, dword [esp + 0x2a8]
push 0x80
push eax
call edi
jmp 0x40b019
push 0xa
call esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a0], 0
call fcn.0041c104
lea ecx, [esp + 0x2a8]
mov dword [esp + 0x2a0], 0xffffffff
call fcn.0043299e
mov eax, 1
jmp 0x40b0b2
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a0], 0
call fcn.0041c104
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x2a8]
mov dword [esp + 0x2a0], 0xffffffff
call fcn.0043299e
xor eax, eax
mov ecx, dword [esp + 0x298]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x294
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ecx
lea edx, [esp + 0x2ac]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.00432713
mov ecx, ebx
call fcn.0040a7e0
test eax, eax
jne 0x40b04d
push 0x14
call esi
mov eax, dword [esp + 0x2a8]
push 0x80
push eax
call edi
jmp 0x40b0d9