Function at 0x412bd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fd7b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x5a8f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0x118], esp
mov byte [ecx], bl
lea edi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x412c20
sub eax, edi
push eax
push esi
call fcn.00404410
call fcn.004066a0
add esp, 0x20
cmp eax, ebx
jne 0x412c83
push 1
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0x118], esp
mov byte [ecx], bl
lea edi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x412c60
sub eax, edi
push eax
push esi
call fcn.00404410
call fcn.004066a0
add esp, 0x20
cmp eax, ebx
jne 0x412c83
xor eax, eax
jmp 0x412e65
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x118], eax
cmp edi, ebx
je 0x412ceb
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
jne 0x412ce5
mov dword [ebp - 0x118], ebx
jmp 0x412d5b
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
cmp eax, ebx
je 0x412d5b
push 0x5826f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x11c], eax
cmp eax, ebx
je 0x412d32
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call edi
mov ecx, dword [ebp - 0x11c]
push str.Wow64RevertWow64FsRedirection
push ecx
mov dword [ebp - 0x12c], eax
call edi
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x120], ebx
jne 0x412d5b
mov eax, dword [ebp - 0x12c]
cmp eax, ebx
je 0x412d5b
lea edx, [ebp - 0x124]
push edx
call eax
test eax, eax
je 0x412d5b
mov dword [ebp - 0x120], 1
xor eax, eax
push 0x103
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x114], bl
call fcn.005282b0
push esi
lea edx, [ebp - 0x114]
mov ecx, 0x14
push 0x104
push edx
mov word [ebp - 0x13c], cx
call fcn.00525ef3
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412dd0
sub eax, edx
mov byte [ebp + eax - 0x114], bl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412de5
sub eax, edx
mov byte [ebp + eax - 0x113], bl
lea ecx, [ebp - 0x14c]
lea eax, [ebp - 0x114]
push ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x148], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
neg esi
sbb esi, esi
cmp dword [ebp - 0x118], ebx
je 0x412e51
cmp dword [ebp - 0x120], ebx
je 0x412e51
mov eax, dword [ebp - 0x128]
cmp eax, ebx
je 0x412e51
mov edx, dword [ebp - 0x124]
push edx
call eax
test eax, eax
je 0x412e51
mov dword [ebp - 0x120], ebx
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x412e62
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00523079
mov esp, ebp
pop ebp
ret