Function at 0x41a5ae
Capabilities:
Delete file
Get file size
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ecx + 0x2c]
mov ebx, ecx
sub esp, 0x144
mov dword [ecx + 0x5ac], 0
push 0
push esi
call fcn.00403579
test eax, eax
mov dword [ebp - 0x12c], 0
pop edi
pop edx
jle 0x41afb0
push ecx
push esi
mov edi, eax
push str.Forward_file__s
push dword [0x45c28c]
call fcn.0040418c
lea eax, [ebp - 0xec]
add esp, 0xc
push 0x30
push 0x433360
push eax
call fcn.00428f18
lea eax, [ebp - 0xbc]
add esp, 0xc
push 0xa4
push 0
push eax
call fcn.00428f38
lea eax, [ebp - 0xec]
mov ecx, 0x400
add esp, 0xc
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x5a4]
add eax, 0x3ff
cdq
idiv ecx
lea edx, [ebp - 0x124]
mov dword [ebp - 0x12c], edx
push eax
push 0x440e30
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x118]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xe8], edx
pop edx
pop ecx
push 0x440e33
push eax
mov dword [ebp - 0xd8], eax
call fcn.004034b5
add esp, 0x10
test eax, eax
mov dword [ebp - 0xc8], eax
jne 0x41a6b2
mov dword [ebp - 0xdc], 0
jmp 0x41a6bb
add eax, 3
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x118], 0x30
push eax
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
lea eax, [eax + 0x2bc]
sub esp, 0xc
mov dword [ebp - 0x12c], edx
push eax
push 8
push dword [section..bss]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x12c]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x28], eax
push edx
push eax
push edi
call fcn.004035ff
pop eax
pop edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebp - 0x12c]
mov edi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x5a8]
lea edx, [ecx + edx + 8]
push eax
push dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push str._.500s_s_8.8X.msg
mov dword [ebp - 0xd0], edx
push edx
call edi
lea eax, [ebx + 0x22c]
add esp, 0x20
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], eax
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41a825
cmp byte [eax], 0
je 0x41a825
push ecx
push ecx
push 0xa
push dword [ebx + 0x18]
call fcn.004033da
add esp, 0x10
test eax, eax
mov dword [ebx + 0x14], eax
je 0x41a7c4
cmp word [eax - 2], 0x5c20
jne 0x41a7b0
cmp word [eax - 3], 0x5c20
jne 0x41a7b0
cmp byte [eax - 1], 0xd
jne 0x41a7b0
cmp byte [eax - 2], 0x5c
jne 0x41a7a5
mov byte [eax - 2], 0x20
mov eax, dword [ebx + 0x14]
mov word [eax - 1], 0x2020
jmp 0x41a76f
lea edx, [eax + 1]
mov dword [ebx + 0x14], edx
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
sub eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x41a7da
mov edi, dword [ebx + 0x18]
sub esp, 0xc
push edi
call fcn.00428f74
lea eax, [edi + eax - 1]
add esp, 0x10
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x18]
jbe 0x41a7f9
push edx
push edx
movsx eax, byte [eax]
push eax
push str.__t_r_n
call fcn.004033da
add esp, 0x10
test eax, eax
jne 0x41a83d
mov eax, dword [ebx + 0x18]
movsx eax, byte [eax]
test al, al
je 0x41a84b
push edi
push edi
push eax
push str.__t_r_n
call fcn.004033da
add esp, 0x10
test eax, eax
je 0x41a84b
mov eax, dword [ebx + 0x18]
lea edx, [eax + 1]
mov dword [ebx + 0x18], edx
mov byte [eax], 0
jmp 0x41a7f9
push esi
push dword [ebx + 0x28]
push 0
push dword [section..bss]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x41afb0
mov eax, dword [ebx + 0x1c]
lea edx, [eax - 1]
mov dword [ebx + 0x1c], edx
mov byte [eax], 0
jmp 0x41a7da
mov eax, dword [ebx + 0x18]
mov edx, dword [eax]
cmp edx, 0x20666923
jne 0x41a9bd
add eax, 4
mov dword [ebx + 0x1c], eax
push ecx
push ecx
push str._in_text_
push dword [ebx + 0x1c]
call fcn.004034d9
add esp, 0x10
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x41a8cf
push edx
push edx
push 0x29
push eax
call fcn.004033da
add esp, 0x10
test eax, eax
mov dword [ebx + 0x20], eax
je 0x41a8cf
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebx + 0x1c]
add eax, 9
push eax
push dword [ebx + 8]
call fcn.004034d9
mov ecx, dword [ebx + 0x1c]
mov edi, eax
mov eax, dword [ebx + 0x20]
add esp, 0xc
sub eax, ecx
inc eax
push eax
push 0x20
push ecx
call fcn.00428f38
mov ecx, dword [ebx + 0x1c]
add esp, 0x10
test edi, edi
setne al
add eax, 0x30
mov byte [ecx], al
mov eax, dword [ebx + 0x20]
jmp 0x41a85f
mov eax, dword [ebx + 0x18]
push ecx
push dword [ebx + 0x5ac]
push 0x440e59
add eax, 4
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop edi
push dword [ebx + 0x1c]
call fcn.0040631b
mov eax, dword [ebx + 0x14]
push str.endif
push 0x440e63
push str.endif
inc eax
push eax
call fcn.0040638d
add esp, 0x20
test eax, eax
mov dword [ebx + 0x1c], eax
jne 0x41a935
push dword [ebx + 0x14]
push dword [ebx + 0x24]
push str.Error_in__.255s_forward:_endif_not_found_r_n:_s
push dword [0x45c28c]
call fcn.0040418c
jmp 0x41a98b
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
push str.endif
push 0x440e63
push 0x440e96
inc eax
push eax
call fcn.0040638d
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0xbc]
mov byte [eax], 0x23
mov eax, dword [ebx + 0x18]
add eax, 4
mov dword [esp], eax
call fcn.00405c4e
add esp, 0xc
test eax, eax
mov eax, dword [ebx + 0x20]
je 0x41a990
test eax, eax
je 0x41a9e7
push edx
mov edx, dword [ebx + 0x1c]
sub edx, eax
push edx
push 0x20
push eax
call fcn.00428f38
add esp, 0x10
jmp 0x41a9e7
mov edx, dword [ebx + 0x1c]
test eax, eax
mov dword [ebx + 0x14], edx
je 0x41a9e7
mov dx, word [eax + 3]
cmp dx, 0x6573
jne 0x41a9aa
mov dword [ebx + 0x14], eax
jmp 0x41a9e7
cmp dx, 0x6669
jne 0x41a9e7
lea edx, [eax + 2]
mov dword [ebx + 0x14], edx
mov byte [eax + 2], 0x23
jmp 0x41a9e7
ja 0x41ae47
cmp edx, 0x6d7223
jne 0x41a9f2
sub esp, 0xc
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
mov dword [ebp - 0x12c], 1
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
jmp 0x41a75b
cmp byte [eax], 0x23
je 0x41a9e7
push ecx
push ecx
lea ecx, [ebp - 0xbc]
push eax
push esi
call fcn.00406054
mov eax, dword [ebx + 0x18]
pop edi
pop edx
cmp byte [eax], 0x21
jne 0x41adab
test byte [0x465799], 8
jne 0x41aa25
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
jne 0x41a9e7
push edx
push edx
push 0x24
push eax
call fcn.00404a66
add esp, 0x10
test eax, eax
lea eax, [ebx + 0x2d]
mov dword [ebp - 0x130], eax
jne 0x41aa66
push eax
push eax
mov eax, dword [ebx + 0x18]
push dword [ebx + 0x5a8]
push dword [ebp + 8]
push dword [ebx + 0x24]
inc eax
push eax
push str._.512s__s_s_8.8X.msg
push dword [ebp - 0x130]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [ebp - 0x10c]
push edi
push 0x3c
push esi
push eax
call fcn.0041a55d
lea eax, [ebp - 0x104]
add esp, 0xc
push 0x3e
push esi
push eax
call fcn.0041a55d
mov eax, dword [ebp - 0x104]
add esp, 0x10
test eax, eax
je 0x41ab34
mov byte [eax], 0
mov eax, dword [ebp - 0x104]
xor edi, edi
cmp byte [eax - 1], 0x3e
jne 0x41aab3
mov byte [eax - 1], 0
mov edi, 1
lea edx, [ebp - 0xfc]
push ecx
push 0x3e
push esi
push edx
mov dword [ebp - 0x13c], edx
call fcn.0041a55d
mov eax, edi
add esp, 0x10
mov edx, dword [ebp - 0x13c]
not eax
add eax, dword [ebp - 0x104]
cmp byte [eax], 0x32
jne 0x41ab0b
mov byte [eax], 0
lea eax, [ebp - 0x104]
mov ecx, dword [eax]
xchg dword [edx], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
add edi, edi
test eax, eax
je 0x41ab4a
cmp byte [eax - 1], 0x3e
jne 0x41ab4a
mov byte [eax - 1], 0
or edi, 1
jmp 0x41ab4a
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41ab4a
cmp byte [eax - 1], 0x3e
jne 0x41ab4a
mov byte [eax - 1], 0
mov eax, dword [ebp - 0xfc]
or edi, 2
cmp byte [eax - 2], 0x32
jne 0x41ab4a
mov byte [eax - 2], 0
jmp 0x41ab4a
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
xor edi, edi
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x41ab57
mov byte [eax], 0
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x41ab64
mov byte [eax], 0
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x41ab71
mov byte [eax], 0
cmp dword [ebp - 0x10c], 0
mov dword [0x466040], 0x44
mov dword [0x46606c], 0x181
mov word [0x466070], 0
je 0x41aba9
cmp dword [ebp - 0x104], 0
je 0x41aba9
cmp dword [ebp - 0xfc], 0
jne 0x41abc8
push eax
push eax
push 2
push 0x440ec1
call fcn.00403579
mov dword [0x466078], eax
mov dword [0x46607c], eax
mov dword [0x466080], eax
pop eax
pop edx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x41abf1
mov byte [eax], 0
mov eax, dword [ebp - 0x10c]
push ecx
push ecx
push 0
inc eax
push eax
call fcn.00403579
test eax, eax
pop edx
pop ecx
jle 0x41abf1
mov dword [0x466078], eax
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x41ac3e
test edi, 1
jne 0x41ac1c
mov eax, dword [ebp - 0x104]
sub esp, 0xc
inc eax
push eax
call fcn.004035ad
add esp, 0xc
test eax, eax
jg 0x41ac2d
jmp 0x41ac3e
inc eax
push edx
push edx
push 1
push eax
call fcn.00403579
test eax, eax
pop ecx
pop edx
jle 0x41ac03
push edx
push 2
push 0
push eax
mov dword [0x46607c], eax
call fcn.0040364b
pop ecx
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41acb2
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebp - 0xfc]
inc eax
push eax
mov eax, dword [ebp - 0x104]
inc eax
push eax
call fcn.00403416
add esp, 0x10
test eax, eax
je 0x41aca8
and edi, 2
jne 0x41ac8b
mov eax, dword [ebp - 0xfc]
sub esp, 0xc
inc eax
push eax
call fcn.004035ad
add esp, 0xc
test eax, eax
jg 0x41ae93
jmp 0x41acb2
mov eax, dword [ebp - 0xfc]
push edi
push edi
push 1
inc eax
push eax
call fcn.00403579
test eax, eax
pop edx
pop ecx
jg 0x41ae93
jmp 0x41ac6e
mov eax, dword [0x46607c]
mov dword [0x466080], eax
push ecx
push dword [ebp - 0x130]
push str.Run:__s
push dword [0x45c28c]
call fcn.0040418c
lea eax, [ebx + 0x5c0]
mov dword [esp], eax
push 0x466040
push dword [ebx + 0x24]
push 0
push dword [ebp - 0x130]
call fcn.004077d6
add esp, 0x20
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41ad6b
push eax
push eax
mov eax, dword [0x42a488]
shl eax, 0xa
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebx + 0x5ac]
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebx + 0x5ac], 0x103
pop eax
pop edx
jne 0x41ad55
push dword [0x42a488]
push esi
push str.Mail_script:_executable__s_still_active_more_then__u_seconds_and_will_be_hard_terminated_by_server.
push dword [0x45c28c]
call fcn.0040418c
pop eax
pop edx
push 0
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ecx
pop eax
sub esp, 0xc
push dword [ebx + 0x5c4]
call edi
push dword [ebx + 0x5c0]
call edi
add esp, 0xc
sub esp, 0xc
push dword [0x46607c]
call edi
mov eax, dword [0x466078]
add esp, 0xc
cmp dword [0x46607c], eax
je 0x41ad8f
sub esp, 0xc
push eax
call edi
add esp, 0xc
mov eax, dword [0x466080]
cmp dword [0x46607c], eax
je 0x41a9e7
sub esp, 0xc
push eax
call edi
jmp 0x41ae3f
push ecx
push ecx
push 0x40
push esi
call fcn.004033da
add esp, 0x10
test eax, eax
je 0x41a9e7
mov eax, dword [ebx]
push edx
push edx
push 0x20
add eax, 5
push eax
mov dword [ebx + 0x20], eax
call fcn.004033da
add esp, 0x10
test eax, eax
mov dword [ebx + 0x1c], eax
jne 0x41aea9
jmp 0x41a9e7
push dword [ebx + 0x5a8]
push eax
push str._.500s_8.8X.msg
push dword [ebp - 0x134]
mov eax, dword [ebp - 0x138]
call eax
add esp, 0x10
cmp dword [ebp - 0x12c], 0
jne 0x41ae60
sub esp, 0xc
push dword [ebp - 0x134]
call fcn.004035ad
add esp, 0xc
test eax, eax
mov edi, eax
jle 0x41a9e7
push eax
push dword [ebx + 0x5a4]
push dword [ebx + 8]
push edi
call fcn.00403625
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
jmp 0x41a9e7
cmp edx, 0x20706323
jne 0x41ae7b
add eax, 4
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x18]
cmp byte [eax], 0x20
jg 0x41ade5
inc eax
jmp 0x41ae52
push ecx
push ecx
push dword [ebp - 0x134]
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop eax
jmp 0x41a9dd
cmp edx, 0x20766d23
jne 0x41a9f2
mov dword [ebp - 0x12c], 1
jmp 0x41ae4f
push ecx
push 2
push 0
push eax
mov dword [0x466080], eax
call fcn.0040364b
pop edi
jmp 0x41acb2
mov byte [eax], 0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebx + 0xc]
push dword [ebx + 0x20]
push str.From__s__redirect_from__s__For
push esi
call edi
mov dword [ebp - 0x130], eax
mov eax, dword [ebx + 0x1c]
mov byte [eax], 0x20
pop eax
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x20]
pop edx
lea eax, [esi + eax + 5]
push eax
push dword [ebx + 8]
call fcn.004034b5
add esp, 0x10
test eax, eax
jne 0x41a9e7
push eax
push eax
mov eax, dword [ebx]
push dword [ebx + 0xc]
add eax, 7
push eax
call fcn.004034b5
add esp, 0x10
test eax, eax
jne 0x41a9e7
lea eax, [ebx + 0x5b0]
sub esp, 0xc
push eax
call fcn.00417ea5
lea edx, [ebx + 0x12c]
push eax
push dword [0x42a670]
push 0x440f53
mov dword [ebp - 0x13c], edx
push edx
call edi
mov edx, dword [ebp - 0x13c]
add esp, 0x14
push edx
call fcn.004035ad
add esp, 0xc
test eax, eax
mov edi, eax
jle 0x41a9e7
push eax
push dword [ebp - 0x130]
push esi
push edi
call fcn.00403625
lea ecx, [ebp - 0xbc]
push eax
push dword [ebx + 0x18]
push esi
call fcn.00406054
push eax
push esi
call fcn.00428f74
add esp, 0xc
push eax
push esi
push edi
call fcn.00403625
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0xd
mov eax, dword [ebx + 0x5a4]
add eax, 2
push eax
mov eax, dword [ebx + 8]
sub eax, 2
push eax
push edi
call fcn.00403625
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0
jmp 0x41ae3f
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4