Function at 0x4037b0
Capabilities:
Delete file
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x49fe27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x4a65d4]
mov dl, byte [0x4a65da]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
mov cx, word [0x4a65d8]
push esi
test ebx, ebx
push edi
mov dword [esp + 0x14], eax
mov word [esp + 0x18], cx
mov byte [esp + 0x1a], dl
je 0x40396a
mov ecx, 0x40
xor eax, eax
mov edi, 0x4b7c6c
push 0x114
rep stosd dword es:[edi], eax
mov ecx, 0x1e
mov edi, 0x513a88
rep stosd dword es:[edi], eax
mov ecx, 0x1e
mov edi, 0x513b00
rep stosd dword es:[edi], eax
mov ecx, 0x1e
mov edi, 0x513b78
rep stosd dword es:[edi], eax
mov ecx, 0x1e
mov edi, 0x513bf0
rep stosd dword es:[edi], eax
mov ecx, 0x1e
mov edi, 0x513a10
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4b7c6c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov dword [esp + 0x38], esi
call fcn.00491cd3
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x24], esi
je 0x403893
lea ecx, [esp + 0x14]
push ecx
push ebx
mov ecx, eax
call fcn.00490ba0
mov ebx, eax
jmp 0x403895
xor ebx, ebx
mov ecx, ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.00490c00
mov edi, eax
test edi, edi
je 0x40395e
cmp esi, 4
ja case.default.0x4038b7
jmp dword [esi*4 + 0x4042a4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x513a88
jmp 0x403938
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x513b00
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40393f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x513b78
jmp 0x403938
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x513bf0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40393f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x513a10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00490c00
mov esi, dword [esp + 0x34]
mov edi, eax
inc esi
test edi, edi
mov dword [esp + 0x34], esi
jne 0x4038ae
test ebx, ebx
je 0x40396a
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ecx, 0x1e
xor eax, eax
mov edi, 0x4fb974
push 0x4fb974
rep stosd dword es:[edi], eax
mov edi, 0x513a88
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4fb974
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00492371
add esp, 4
mov ecx, 2
mov edi, 0x4a65c8
mov esi, 0x4fb974
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4039e1
mov dl, byte [0x4a65c4]
mov ecx, 0x1e
mov edi, 0x513a88
rep stosd dword es:[edi], eax
mov ecx, dword [0x4a65c0]
mov byte [0x513a8c], dl
mov dword [0x513a88], ecx
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [ebp + 0x4dda4]
mov dword [ebp + 0x4ef0c], eax
mov dword [esp + 0x14], 1
call fcn.00491a40
mov eax, dword [ebp + 0x4ef0c]
mov edx, dword [ebp + 0x4dd34]
xor esi, esi
push eax
lea ecx, [ebp + 0x5a70]
mov dword [ebp + 0x4c698], esi
mov dword [ebp + 0x4dd40], edx
call fcn.00491880
mov ebx, dword [sym.imp.kernel32.dll_CreateFileA]
push esi
push esi
push 3
push esi
push esi
and eax, 0xff
push connect
push 0x4a65a8
mov dword [ebp + 0x4ddb0], eax
mov dword [ebp + 0x4ddb4], eax
mov dword [ebp + 0x4ddb8], eax
mov dword [ebp + 0x4e4f8], esi
mov byte [ebp + 0x4ea5a], 0
mov byte [ebp + 0x4ea59], 0
mov byte [ebp + 0x4ea58], 0
call ebx
cmp eax, 0xffffffff
je 0x403aad
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call edi
push esi
push esi
push 3
push esi
push esi
push connect
push 0x4a6594
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x403aad
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0x2cf1f4
push esi
je 0x403acd
call edi
mov ecx, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a658c
push 0x4a655c
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
call edi
mov ecx, ebp
call fcn.0043edf0
test eax, eax
jne 0x403afa
mov edx, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a6554
push 0x4a655c
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
lea edx, [ebp + 0x4ea5c]
xor eax, eax
mov ecx, edx
mov edi, 0x4a6544
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
mov dword [ebp + 0x4e600], 0xb20
call fcn.004403c0
test eax, eax
jne 0x403b64
mov ecx, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a650c
push ecx
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
mov ecx, ebp
call fcn.004150e0
test eax, eax
jne 0x403b8f
mov edx, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a64dc
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
mov ecx, ebp
call fcn.00415650
test eax, eax
jne 0x403bba
mov eax, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a64ac
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
mov edx, dword [ebp + 0x4ef0c]
lea ecx, [ebp + 0x6004]
push edx
call fcn.004010f0
test eax, eax
je 0x403be9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea ecx, [ebp + 0x36050]
call fcn.0048f480
test eax, eax
jne 0x403c09
mov eax, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a6488
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
push 0
push 0
push 3
push 0
push 0
push connect
push 0x4a6470
call ebx
mov esi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push 0x54
push 8
mov dword [ebp + 0x4ef10], eax
call esi
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
push eax
call edi
mov dword [esp + 0x2c], eax
test eax, eax
mov dword [esp + 0x24], 1
je 0x403c6a
push 0
push 0
lea ecx, [ebp + 0x6004]
push 0x4a6464
push ecx
mov ecx, dword [ebp + 0x4ef10]
push ecx
mov ecx, eax
call fcn.00488d30
jmp 0x403c6c
xor eax, eax
mov edx, dword [ebp + 0x4ef10]
mov dword [ebp + 0x36144], eax
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0
push 0
push 3
push 0
push 0
push connect
push 0x4a644c
call ebx
push 0x54
push 8
mov dword [ebp + 0x4ef10], eax
call esi
push eax
call edi
mov dword [esp + 0x2c], eax
xor ebx, ebx
mov dword [esp + 0x24], 2
cmp eax, ebx
je 0x403cd4
push ebx
push ebx
lea ecx, [ebp + 0x6004]
push 0x4a6440
push ecx
mov ecx, dword [ebp + 0x4ef10]
push ecx
mov ecx, eax
call fcn.00488d30
jmp 0x403cd6
xor eax, eax
mov edx, dword [ebp + 0x4ef10]
mov dword [ebp + 0x360e4], eax
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x934464
push 8
mov word [ebp + 8], bx
mov word [ebp + 0xa], bx
call esi
push eax
call edi
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov dword [esp + 0x24], 3
je 0x403d17
push ebp
mov ecx, eax
call fcn.004814a0
jmp 0x403d19
xor eax, eax
mov dword [ebp + 0x4a258], eax
lea ecx, [ebp + 0x4e918]
xor eax, eax
xor edx, edx
mov dword [ecx], eax
lea esi, [ebp + 0x36074]
mov dword [esp + 0x24], 0xffffffff
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp + 0x4e832]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [ebp + 0x4e83e]
mov al, 0x64
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov byte [ebp + 0x4ebeb], al
mov byte [ebp + 0x4ebec], al
mov byte [ebp + 0x4ea54], cl
mov byte [ebp + 0x4ebe9], cl
mov byte [ebp + 0x4ebea], cl
lea eax, [ebp + 0x4e740]
lea ecx, [ebp + 0x4e720]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e700]
push ecx
push edx
push 0x504646
push eax
mov ecx, esi
mov word [ebp + 0x4e668], 2
mov byte [ebp + 0x4eb25], 0x1d
mov byte [ebp + 0x4eb24], 0x1e
mov byte [ebp + 0x4ebe8], 4
call fcn.0048fdd0
lea ecx, [ebp + 0x4e742]
lea edx, [ebp + 0x4e722]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e702]
push edx
push eax
push 0x504646
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e744]
lea eax, [ebp + 0x4e724]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e704]
push eax
push ecx
push 0x504646
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e746]
lea ecx, [ebp + 0x4e726]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e706]
push ecx
push edx
push 0x466446
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e748]
lea edx, [ebp + 0x4e728]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e708]
push edx
push eax
push 0xa5a82
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e74a]
lea eax, [ebp + 0x4e72a]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e70a]
push eax
push ecx
push 0x6f352a
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e74c]
lea ecx, [ebp + 0x4e72c]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e70c]
push ecx
push edx
push 0x919191
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e74e]
lea edx, [ebp + 0x4e72e]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e70e]
push edx
push eax
push 0x786478
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e750]
lea eax, [ebp + 0x4e730]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e710]
push eax
push ecx
push 0xa0a4b
push edx
mov ecx, esi
call fcn.0048fdd0
lea edi, [ebp + 0x4e6f2]
lea ebx, [ebp + 0x4e6d2]
lea eax, [ebp + 0x4e6b2]
push edi
push ebx
push eax
mov al, byte [ebp + 0x36046]
push 0x1e6887
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6de]
lea edx, [ebp + 0x4e6be]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e69e]
push edx
push eax
push 0x646464
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e6e0]
lea eax, [ebp + 0x4e6c0]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e6a0]
push eax
push ecx
push 0x602828
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e6e2]
push eax
mov al, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e6c2]
lea edx, [ebp + 0x4e6a2]
push ecx
push edx
push 0x3e4f4f
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6e4]
lea edx, [ebp + 0x4e6c4]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e6a4]
push edx
push eax
push 0x1e6887
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e6e6]
lea eax, [ebp + 0x4e6c6]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e6a6]
push eax
push ecx
push 0x127f
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e6e8]
lea ecx, [ebp + 0x4e6c8]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e6a8]
push ecx
push edx
push 0xa3c0a
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6ea]
lea edx, [ebp + 0x4e6ca]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e6aa]
push edx
push eax
push 0x282828
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e6ec]
lea eax, [ebp + 0x4e6cc]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e6ac]
push eax
push ecx
push 0x504f2f
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e6ee]
lea ecx, [ebp + 0x4e6ce]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e6ae]
push ecx
push edx
push 0x5a347f
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6f0]
lea edx, [ebp + 0x4e6d0]
push ecx
lea eax, [ebp + 0x4e6b0]
push edx
push eax
mov cl, byte [ebp + 0x36046]
push 0x5a3c5a
push ecx
mov ecx, esi
call fcn.0048fdd0
mov dl, byte [ebp + 0x36046]
push edi
lea eax, [ebp + 0x4e6b2]
push ebx
push eax
push 0x3c2300
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e6f4]
lea ecx, [ebp + 0x4e6d4]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e6b4]
push ecx
push edx
push 0x465a69
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6f6]
lea edx, [ebp + 0x4e6d6]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e6b6]
push edx
push eax
push 0x355b5e
push ecx
mov ecx, esi
call fcn.0048fdd0
lea edx, [ebp + 0x4e6f8]
lea eax, [ebp + 0x4e6d8]
push edx
mov dl, byte [ebp + 0x36046]
lea ecx, [ebp + 0x4e6b8]
push eax
push ecx
push 0x85555
push edx
mov ecx, esi
call fcn.0048fdd0
lea eax, [ebp + 0x4e6fa]
lea ecx, [ebp + 0x4e6da]
push eax
mov al, byte [ebp + 0x36046]
lea edx, [ebp + 0x4e6ba]
push ecx
push edx
push 0xa0a4b
push eax
mov ecx, esi
call fcn.0048fdd0
lea ecx, [ebp + 0x4e6fc]
lea edx, [ebp + 0x4e6dc]
push ecx
mov cl, byte [ebp + 0x36046]
lea eax, [ebp + 0x4e6bc]
push edx
push eax
push 0x303030
push ecx
mov ecx, esi
call fcn.0048fdd0
push 0x7d4
call fcn.00491cd3
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov dword [esp + 0x24], 4
je 0x4041c5
mov ecx, eax
call fcn.0048f690
jmp 0x4041c7
xor eax, eax
push 0x23
push 0x4a6428
push 0x4a6410
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
mov dword [ebp + 0x4c698], eax
call fcn.0048ff10
test eax, eax
jne 0x40420c
mov edx, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a63e4
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
mov ecx, dword [ebp + 0x4c698]
push 0x4a6428
call fcn.0048f6f0
mov edi, dword [sym.imp.kernel32.dll_DeleteFileA]
push 0x4a6428
call edi
push 0x23
push 0x4a63d0
push 0x4a63bc
mov ecx, esi
call fcn.0048ff10
test eax, eax
jne 0x40425d
mov eax, dword [ebp + 0x4ef0c]
push 0x30
push 0x4a653c
push 0x4a6390
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
xor eax, eax
jmp 0x40428f
push 0x4a63d0
lea ecx, [ebp + 0x4dd2c]
call fcn.0048edb0
push 0x4a63d0
call edi
mov ecx, ebp
call fcn.00433840
mov ecx, 8
xor eax, eax
lea edi, [ebp + 0x4ebc7]
rep stosd dword es:[edi], eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc