Function at 0x40b48c
Capabilities:
Delete file

Disassembly:
push 0xc8
mov eax, 0x41d1cb
call fcn.0041bcbb
mov edi, ecx
lea ebx, [edi + 0x20]
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0xd0], ebx
jb 0x40b4b6
mov eax, dword [ebx]
jmp 0x40b4b8
mov eax, ebx
xor ecx, ecx
push ecx
push ecx
push 2
push ecx
push ecx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x5c], eax
cmp eax, 0xffffffff
jne 0x40b6fa
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0xd4], 0x2e
jmp 0x40b4f4
mov ebx, dword [ebp - 0xd0]
push 0xffffffffffffffff
mov esi, ebx
call fcn.0040bb03
inc eax
push eax
push ebx
lea esi, [ebp - 0x50]
call fcn.0040bb6e
and dword [ebp - 4], 0
mov esi, ebx
call fcn.0040bb03
push eax
push 0
push ebx
lea esi, [ebp - 0xc0]
call fcn.0040bb6e
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x40]
cmp eax, 1
jb 0x40b588
dec eax
cmp eax, 0xffffffff
jbe 0x40b539
or ecx, 0xffffffff
jmp 0x40b53b
mov ecx, eax
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x40b547
lea eax, [ebp - 0x50]
lea esi, [eax + ecx*2]
cmp word [esi], 0x2e
jne 0x40b561
lea ecx, [ebp - 0xd4]
mov eax, esi
call fcn.00406ca3
test eax, eax
je 0x40b576
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x40b56d
lea eax, [ebp - 0x50]
cmp esi, eax
je 0x40b588
sub esi, 2
jmp 0x40b54a
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x40b582
lea eax, [ebp - 0x50]
sub esi, eax
sar esi, 1
jmp 0x40b58b
or esi, 0xffffffff
push esi
push 0
lea eax, [ebp - 0x50]
push eax
lea esi, [ebp - 0x88]
call fcn.0040bb6e
push 0xffffffffffffffff
mov byte [ebp - 4], 2
push dword [ebp - 0x78]
lea eax, [ebp - 0x50]
push eax
lea esi, [ebp - 0xa4]
call fcn.0040bb6e
mov byte [ebp - 4], 3
cmp dword [ebp - 0x90], 8
mov edx, dword [ebp - 0xa4]
jae 0x40b5ca
mov edx, esi
cmp dword [ebp - 0x74], 8
mov ecx, dword [ebp - 0x88]
jae 0x40b5dc
lea ecx, [ebp - 0x88]
cmp dword [ebp - 0xac], 8
mov eax, dword [ebp - 0xc0]
jae 0x40b5f1
lea eax, [ebp - 0xc0]
push edx
push dword [ebp - 0xcc]
lea ebx, [ebp - 0x6c]
push ecx
push eax
push str._s_s___d__s
call fcn.00406419
add esp, 0x14
inc dword [ebp - 0xcc]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
jae 0x40b61f
mov eax, ebx
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x5c], eax
cmp eax, 0xffffffff
jne 0x40b68f
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x6c]
call fcn.00401953
push ebx
lea esi, [ebp - 0xa4]
call fcn.00401953
push ebx
lea esi, [ebp - 0x88]
call fcn.00401953
push ebx
lea esi, [ebp - 0xc0]
call fcn.00401953
or dword [ebp - 4], 0xffffffff
push ebx
lea esi, [ebp - 0x50]
call fcn.00401953
cmp dword [ebp - 0xcc], 0x64
mov edi, dword [ebp - 0xc8]
jl 0x40b4ee
jmp 0x40b6fa
mov ecx, dword [ebp - 0xd0]
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x6c]
call fcn.004019ff
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
jae 0x40b6ac
lea eax, [ebp - 0x6c]
push eax
push esi
mov eax, edi
call fcn.0040b7f2
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x6c]
call fcn.00401953
push ebx
lea esi, [ebp - 0xa4]
call fcn.00401953
push ebx
lea esi, [ebp - 0x88]
call fcn.00401953
push ebx
lea esi, [ebp - 0xc0]
call fcn.00401953
or dword [ebp - 4], 0xffffffff
push ebx
lea esi, [ebp - 0x50]
call fcn.00401953
mov edi, dword [ebp - 0xc8]
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x40b7e1
cmp eax, 0xffffffff
je 0x40b7e1
lea esi, [edi + 0x60]
mov eax, esi
call fcn.004043e0
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x40b723
mov eax, dword [eax]
push eax
push edi
call fcn.0040baa9
push dword [edi + 0x5c]
mov byte [ebp - 0xc1], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x5c], 0xffffffff
xor eax, eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
mov ecx, esi
lea ebx, [ebp - 0x44]
call fcn.004044c0
xor ebx, ebx
xor esi, esi
xor edi, edi
movzx eax, byte [ebp + esi - 0x44]
push eax
push str._02x
lea eax, [ebp + edi - 0x34]
push 3
push eax
call fcn.0041135b
add esp, 0x10
add edi, eax
inc esi
cmp esi, 0x10
jl 0x40b76a
cmp byte [ebp - 0xc1], bl
je 0x40b7bc
mov esi, dword [ebp - 0xc8]
lea eax, [esi + 0x3c]
cmp dword [eax + 0x14], 0x10
jb 0x40b7a5
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.004112f6
pop ecx
pop ecx
test eax, eax
jne 0x40b7bc
push ebx
push 3
mov eax, esi
jmp 0x40b7e7
mov eax, dword [ebp - 0xc8]
push ebx
push 1
call fcn.0040b7f2
mov eax, dword [ebp - 0xd0]
cmp dword [eax + 0x14], 8
jb 0x40b7d8
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40b7ec
push 0
push 1
mov eax, edi
call fcn.0040b7f2
call fcn.0041bd05
ret