Function at 0x41c074
Capabilities:
Delete file
Get file size
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 0x2c]
push ebx
mov ebx, ecx
sub esp, 0x134
mov dword [ecx + 0x5ac], 0
push 0
push esi
call fcn.0040357d
mov dword [ebp - 0x12c], 0
pop edi
pop edx
test eax, eax
jle 0x41ca74
mov edi, eax
push eax
push esi
push str.Forward_file__s
push dword [0x46346c]
call fcn.0040423a
add esp, 0xc
lea edx, [ebp - 0xec]
push 0x30
push 0x438d40
push edx
call fcn.0042d1ac
add esp, 0xc
lea eax, [ebp - 0xbc]
push 0xa4
push 0
push eax
call fcn.0042d1cc
mov eax, dword [ebx + 0x5a4]
mov ecx, 0x400
add esp, 0xc
lea edx, [ebp - 0xec]
mov dword [ebp - 0x54], 0
add eax, 0x3ff
mov dword [ebp - 0x58], edx
cdq
mov dword [ebp - 0x1c], 0
idiv ecx
lea edx, [ebp - 0x124]
push eax
push 0x446bd8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x124]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xe8], edx
pop edx
pop ecx
push 0x446bdb
push eax
mov dword [ebp - 0xd8], eax
call fcn.004034b9
add esp, 0x10
mov dword [ebp - 0xc8], eax
test eax, eax
jne 0x41c172
mov dword [ebp - 0xdc], 0
jmp 0x41c17b
add eax, 3
mov dword [ebp - 0xc8], eax
push eax
mov dword [ebp - 0x118], 0x30
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 0xc
mov edx, eax
lea eax, [eax + 0x2bc]
push eax
mov dword [ebp - 0x12c], edx
push 8
push dword [0x451048]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 0x18], eax
add esp, 0x14
test eax, eax
je 0x41ca5d
push edx
mov edx, dword [ebp - 0x12c]
mov dword [ebx + 0x28], eax
push edx
push eax
push edi
call fcn.00403603
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 0x12c]
push dword [ebx + 0x5a8]
push dword [ebp + 8]
lea eax, [eax + edx + 8]
push dword [ebx + 0x24]
push str._.500s_s_8.8X.msg
push eax
mov dword [ebp - 0xd0], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x12c], 0
add esp, 0x20
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41ca43
cmp byte [eax], 0
je 0x41ca43
push ecx
push ecx
push 0xa
push dword [ebx + 0x18]
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x14], eax
test eax, eax
je 0x41c27a
cmp word [eax - 2], 0x5c20
jne 0x41c266
cmp word [eax - 3], 0x5c20
jne 0x41c266
cmp byte [eax - 1], 0xd
jne 0x41c266
cmp byte [eax - 2], 0x5c
jne 0x41c25b
mov byte [eax - 2], 0x20
mov eax, dword [ebx + 0x14]
mov word [eax - 1], 0x2020
jmp 0x41c225
lea edx, [eax + 1]
mov dword [ebx + 0x14], edx
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
sub eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x41c290
mov edi, dword [ebx + 0x18]
sub esp, 0xc
push edi
call fcn.0042d208
add esp, 0x10
lea eax, [edi + eax - 1]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x18]
jbe 0x41c2dd
push edx
push edx
movsx eax, byte [eax]
push eax
push str.__t_r_n
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41c2dd
mov eax, dword [ebx + 0x1c]
lea edx, [eax - 1]
mov dword [ebx + 0x1c], edx
mov byte [eax], 0
jmp 0x41c290
push edi
push edi
push eax
push str.__t_r_n
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41c2e7
mov eax, dword [ebx + 0x18]
lea edx, [eax + 1]
mov dword [ebx + 0x18], edx
mov byte [eax], 0
mov eax, dword [ebx + 0x18]
movsx eax, byte [eax]
test al, al
jne 0x41c2bd
mov eax, dword [ebx + 0x18]
mov edx, dword [eax]
cmp edx, 0x20706323
je 0x41c4c3
ja 0x41c317
cmp edx, 0x6d7223
je 0x41c4a2
cmp edx, 0x20666923
jne 0x41c543
add eax, 4
jmp 0x41c383
cmp edx, 0x20766d23
jne 0x41c543
mov dword [ebp - 0x12c], 1
jmp 0x41c4c3
push edx
push edx
push 0x29
push eax
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x20], eax
test eax, eax
je 0x41c39f
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebx + 0x1c]
add eax, 9
push eax
push dword [ebx + 8]
call fcn.004034dd
mov edx, dword [ebx + 0x1c]
add esp, 0xc
mov edi, eax
mov eax, dword [ebx + 0x20]
sub eax, edx
inc eax
push eax
push 0x20
push edx
call fcn.0042d1cc
mov edx, dword [ebx + 0x1c]
add esp, 0x10
mov al, 0x30
cmp edi, 1
sbb al, 0xff
mov byte [edx], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x1c], eax
push ecx
push ecx
push str._in_text_
push dword [ebx + 0x1c]
call fcn.004034dd
add esp, 0x10
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x41c332
mov eax, dword [ebx + 0x18]
push ecx
push dword [ebx + 0x5ac]
add eax, 4
push 0x446c01
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop edi
push dword [ebx + 0x1c]
call fcn.00406414
mov eax, dword [ebx + 0x14]
push str.endif
push 0x446c0b
inc eax
push str.endif
push eax
call fcn.00406485
add esp, 0x20
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x41c405
push dword [ebx + 0x14]
push dword [ebx + 0x24]
push str.Error_in__.255s_forward:_endif_not_found_r_n:_s
push dword [0x46346c]
call fcn.0040423a
jmp 0x41c45f
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
push str.endif
inc eax
push 0x446c0b
push 0x446c3e
push eax
call fcn.00406485
lea ecx, [ebp - 0xbc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov byte [eax], 0x23
mov eax, dword [ebx + 0x18]
add eax, 4
mov dword [esp], eax
call fcn.00405d62
add esp, 0xc
test eax, eax
mov eax, dword [ebx + 0x20]
je 0x41c467
test eax, eax
je 0x41ca38
push edx
mov edx, dword [ebx + 0x1c]
sub edx, eax
push edx
push 0x20
push eax
call fcn.0042d1cc
add esp, 0x10
jmp 0x41ca38
mov edx, dword [ebx + 0x1c]
mov dword [ebx + 0x14], edx
test eax, eax
je 0x41ca38
mov dx, word [eax + 3]
cmp dx, 0x6573
jne 0x41c488
mov dword [ebx + 0x14], eax
jmp 0x41ca38
cmp dx, 0x6669
jne 0x41ca38
lea edx, [eax + 2]
mov dword [ebx + 0x14], edx
mov byte [eax + 2], 0x23
jmp 0x41ca38
sub esp, 0xc
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x12c], 1
add esp, 0xc
jmp 0x41ca38
add eax, 4
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x18]
cmp byte [eax], 0x20
jg 0x41c4d4
inc eax
jmp 0x41c4c6
lea edi, [ebx + 0x22c]
push dword [ebx + 0x5a8]
push eax
push str._.500s_8.8X.msg
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp - 0x12c], 0
jne 0x41c52d
sub esp, 0xc
push edi
call fcn.004035b1
mov edi, eax
add esp, 0xc
test eax, eax
jle 0x41ca38
push eax
push dword [ebx + 0x5a4]
push dword [ebx + 8]
push edi
call fcn.00403629
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41ca35
push ecx
push ecx
push edi
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop eax
jmp 0x41ca38
cmp byte [eax], 0x23
je 0x41ca38
push ecx
push ecx
lea ecx, [ebp - 0xbc]
push eax
push esi
call fcn.00406154
mov eax, dword [ebx + 0x18]
pop edi
pop edx
cmp byte [eax], 0x21
jne 0x41c902
test byte [0x46c979], 8
jne 0x41c57e
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
jne 0x41ca38
push edx
push edx
push 0x24
push eax
call fcn.00404c10
lea ecx, [ebx + 0x2d]
add esp, 0x10
mov dword [ebp - 0x130], ecx
test eax, eax
jne 0x41c5ba
push eax
push eax
mov eax, dword [ebx + 0x18]
push dword [ebx + 0x5a8]
inc eax
push dword [ebp + 8]
push dword [ebx + 0x24]
push eax
push str._.512s__s_s_8.8X.msg
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [ebp - 0x10c]
push edi
push 0x3c
push esi
push eax
call fcn.0041c021
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x3e
push esi
push eax
call fcn.0041c021
mov eax, dword [ebp - 0x104]
add esp, 0x10
test eax, eax
je 0x41c682
mov byte [eax], 0
mov eax, dword [ebp - 0x104]
xor edi, edi
cmp byte [eax - 1], 0x3e
jne 0x41c607
mov byte [eax - 1], 0
mov edi, 1
lea edx, [ebp - 0xfc]
push ecx
push 0x3e
push esi
push edx
call fcn.0041c021
mov eax, edi
add esp, 0x10
lea edx, [ebp - 0xfc]
not eax
add eax, dword [ebp - 0x104]
cmp byte [eax], 0x32
jne 0x41c659
mov byte [eax], 0
lea eax, [ebp - 0x104]
mov ecx, dword [eax]
xchg dword [edx], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
add edi, edi
test eax, eax
je 0x41c698
cmp byte [eax - 1], 0x3e
jne 0x41c698
mov byte [eax - 1], 0
or edi, 1
jmp 0x41c698
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41c698
cmp byte [eax - 1], 0x3e
jne 0x41c698
mov byte [eax - 1], 0
mov eax, dword [ebp - 0xfc]
or edi, 2
cmp byte [eax - 2], 0x32
jne 0x41c698
mov byte [eax - 2], 0
jmp 0x41c698
mov dword [ebp - 0xfc], 0
xor edi, edi
mov dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x41c6a5
mov byte [eax], 0
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x41c6b2
mov byte [eax], 0
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x41c6bf
mov byte [eax], 0
cmp dword [ebp - 0x10c], 0
mov dword [0x46d1c0], 0x44
mov dword [0x46d1ec], 0x181
mov word [0x46d1f0], 0
je 0x41c6f7
cmp dword [ebp - 0x104], 0
je 0x41c6f7
cmp dword [ebp - 0xfc], 0
jne 0x41c716
push eax
push eax
push 2
push 0x446c69
call fcn.0040357d
mov dword [0x46d1f8], eax
mov dword [0x46d1fc], eax
mov dword [0x46d200], eax
pop eax
pop edx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x41c73f
mov byte [eax], 0
mov eax, dword [ebp - 0x10c]
push ecx
inc eax
push ecx
push 0
push eax
call fcn.0040357d
pop edx
pop ecx
test eax, eax
jle 0x41c73f
mov dword [0x46d1f8], eax
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x41c78c
test edi, 1
jne 0x41c76a
mov eax, dword [ebp - 0x104]
sub esp, 0xc
inc eax
push eax
call fcn.004035b1
add esp, 0xc
test eax, eax
jg 0x41c77b
jmp 0x41c78c
inc eax
push edx
push edx
push 1
push eax
call fcn.0040357d
pop ecx
pop edx
test eax, eax
jle 0x41c751
push edx
push 2
push 0
push eax
mov dword [0x46d1fc], eax
call fcn.0040364f
pop ecx
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41c809
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebp - 0xfc]
inc eax
push eax
mov eax, dword [ebp - 0x104]
inc eax
push eax
call fcn.0040341a
add esp, 0x10
test eax, eax
je 0x41c7ff
and edi, 2
jne 0x41c7d5
mov eax, dword [ebp - 0xfc]
sub esp, 0xc
inc eax
push eax
call fcn.004035b1
add esp, 0xc
test eax, eax
jg 0x41c7ec
jmp 0x41c809
push eax
push eax
mov eax, dword [ebp - 0xfc]
push 1
inc eax
push eax
call fcn.0040357d
pop edx
pop ecx
test eax, eax
jle 0x41c7bc
push edi
push 2
push 0
push eax
mov dword [0x46d200], eax
call fcn.0040364f
pop eax
jmp 0x41c809
mov eax, dword [0x46d1fc]
mov dword [0x46d200], eax
push ecx
push dword [ebp - 0x130]
push str.Run:__s
push dword [0x46346c]
call fcn.0040423a
lea eax, [ebx + 0x5c0]
mov dword [esp], eax
push 0x46d1c0
push dword [ebx + 0x24]
push 0
push dword [ebp - 0x130]
call fcn.00407970
add esp, 0x20
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41c8c2
push eax
push eax
mov eax, dword [0x42e488]
shl eax, 0xa
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebx + 0x5ac]
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebx + 0x5ac], 0x103
pop eax
pop edx
jne 0x41c8ac
push dword [0x42e488]
push esi
push str.Mail_script:_executable__s_still_active_more_then__u_seconds_and_will_be_hard_terminated_by_server.
push dword [0x46346c]
call fcn.0040423a
pop eax
pop edx
push 0
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ecx
pop eax
sub esp, 0xc
push dword [ebx + 0x5c4]
call edi
push dword [ebx + 0x5c0]
call edi
add esp, 0xc
sub esp, 0xc
push dword [0x46d1fc]
call edi
mov eax, dword [0x46d1f8]
add esp, 0xc
cmp dword [0x46d1fc], eax
je 0x41c8e6
sub esp, 0xc
push eax
call edi
add esp, 0xc
mov eax, dword [0x46d200]
cmp dword [0x46d1fc], eax
je 0x41ca38
sub esp, 0xc
push eax
call edi
jmp 0x41ca35
push eax
push eax
push 0x40
push esi
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41ca38
mov eax, dword [ebx]
push edi
push edi
add eax, 5
push 0x20
mov dword [ebx + 0x20], eax
push eax
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x41ca38
mov byte [eax], 0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebx + 0xc]
push dword [ebx + 0x20]
push str.From__s__redirect_from__s__For
push esi
call edi
mov dword [ebp - 0x130], eax
mov eax, dword [ebx + 0x1c]
mov byte [eax], 0x20
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x20]
pop edx
lea eax, [esi + eax + 5]
pop ecx
push eax
push dword [ebx + 8]
call fcn.004034b9
add esp, 0x10
test eax, eax
jne 0x41ca38
push eax
push eax
mov eax, dword [ebx]
push dword [ebx + 0xc]
add eax, 7
push eax
call fcn.004034b9
add esp, 0x10
test eax, eax
jne 0x41ca38
sub esp, 0xc
lea eax, [ebx + 0x5b0]
push eax
call fcn.00419663
lea edx, [ebx + 0x12c]
push eax
push dword [0x42e670]
push 0x446cfb
push edx
mov dword [ebp - 0x134], edx
call edi
mov edx, dword [ebp - 0x134]
add esp, 0x14
push edx
call fcn.004035b1
mov edi, eax
add esp, 0xc
test eax, eax
jle 0x41ca38
push eax
push dword [ebp - 0x130]
push esi
push edi
call fcn.00403629
lea ecx, [ebp - 0xbc]
push eax
push dword [ebx + 0x18]
push esi
call fcn.00406154
push eax
push esi
call fcn.0042d208
add esp, 0xc
push eax
push esi
push edi
call fcn.00403629
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0xd
mov eax, dword [ebx + 0x5a4]
add eax, 2
push eax
mov eax, dword [ebx + 8]
sub eax, 2
push eax
push edi
call fcn.00403629
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0
add esp, 0xc
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
jmp 0x41c211
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41ca74
push edx
push eax
push 0
push dword [0x451048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ecx
jmp 0x41ca74
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x12c], 0
add esp, 0xc
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4