Function at 0x41be4b
Capabilities:
Accept command line arguments
Delete file

Disassembly:
push 0x2d4
mov eax, 0x46e9b3
call fcn.0045f4d4
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c934
call fcn.004132cd
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x18]
or edi, 0xffffffff
add ecx, 0x7f8
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c94c
call fcn.004132cd
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x18]
add ecx, 0x834
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c978
call fcn.004132cd
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x18]
add ecx, 0x8e8
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c9a4
call fcn.004132cd
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x18]
add ecx, 0x870
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c9c0
call fcn.004132cd
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x18]
add ecx, 0x8ac
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c9d4
call fcn.004132cd
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0x18]
add ecx, 0x960
mov dword [ebp - 4], edi
call fcn.0041afe5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
mov ebx, 0x40c8c0
push ebx
call fcn.004132cd
mov dword [ebp - 4], 6
mov eax, dword [esi + 0x18]
add eax, 0x7f8
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 7
mov eax, dword [esi + 0x18]
add eax, 0x834
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409384
call fcn.004132cd
mov dword [ebp - 4], 8
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x18]
add eax, 0x870
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 0xa
mov eax, dword [esi + 0x18]
add eax, 0x8ac
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409384
call fcn.004132cd
mov dword [ebp - 4], 0xb
mov eax, dword [esi + 0x18]
add eax, 0x960
push eax
mov dword [ebp - 4], edi
call fcn.0041afa3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x2e0], eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x41c07c
sub eax, ecx
sar eax, 1
lea edi, [eax + 1]
mov dword [ebp - 0x2d4], eax
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x2dc], edi
neg ecx
or ecx, eax
push ecx
call fcn.0043e65e
xor edi, edi
pop ecx
mov dword [ebp - 0x2d8], eax
cmp eax, edi
je 0x41c0ea
mov ecx, dword [ebp - 0x2d4]
lea ecx, [ecx + ecx + 2]
push ecx
push edi
push eax
call fcn.00443420
push dword [ebp - 0x2e0]
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d8]
call fcn.0043e66e
add esp, 0x18
jmp 0x41c0f6
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2d8], eax
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d8]
call fcn.0043ecd9
push 0x40ca0c
push dword [ebp - 0x2d8]
call fcn.0043f33a
add esp, 0x10
mov dword [ebp - 0x2d4], eax
cmp eax, edi
je 0x41c2b1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0xc
mov eax, dword [esi + 0x18]
add eax, 0x7f8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
mov eax, dword [ebp - 0x2d4]
add eax, 4
cmp word [eax], 0x75
je 0x41c17b
push 0x40ca14
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
test eax, eax
je 0x41c1a9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0xd
mov eax, dword [esi + 0x18]
add eax, 0x834
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push 0x40a710
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c1ed
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40a710
call fcn.004132cd
mov dword [ebp - 4], 0xe
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push 0x40a718
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c231
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40a718
call fcn.004132cd
mov dword [ebp - 4], 0xf
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push 0x40ca1c
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c26d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x10
mov eax, dword [esi + 0x18]
add eax, 0x870
jmp 0x41c2a7
push 0x40ca38
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c2b1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x11
mov eax, dword [esi + 0x18]
add eax, 0x8ac
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push dword [0x47dc38]
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
cmp eax, edi
je 0x41c3d6
push dword [0x47dc38]
lea ecx, [ebp - 0x25c]
call fcn.004132cd
mov dword [ebp - 4], 0x12
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x2d4]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2d4], eax
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x25c]
call fcn.00411dad
mov eax, dword [ebp - 0x2d4]
movzx eax, word [eax]
push eax
call fcn.0043ef91
pop ecx
test eax, eax
jne 0x41c355
mov eax, dword [ebp - 0x2d4]
jmp 0x41c331
mov eax, dword [ebp - 0x2dc]
cmp word [eax], 0
je 0x41c355
mov eax, dword [ebp - 0x2d4]
inc edi
lea eax, [eax + edi*2]
mov dword [ebp - 0x2dc], eax
movzx eax, word [eax]
push eax
call fcn.0043ef91
pop ecx
test eax, eax
je 0x41c32b
xor ecx, ecx
push 2
lea eax, [edi + 1]
pop edx
mov dword [ebp - 0x2d0], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043e65e
lea ecx, [edi + edi + 2]
push ecx
push 0
push eax
mov dword [ebp - 0x2dc], eax
call fcn.00443420
push dword [ebp - 0x2d4]
push dword [ebp - 0x2d0]
push dword [ebp - 0x2dc]
call fcn.0043e66e
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push dword [ebp - 0x2dc]
call fcn.004132cd
mov dword [ebp - 4], 0x13
mov eax, dword [esi + 0x18]
add eax, 0x960
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push dword [ebp - 0x2dc]
call fcn.0043e6e2
pop ecx
xor edi, edi
push 0x40ca4c
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
mov ecx, eax
cmp ecx, edi
je 0x41c484
add ecx, 0xa
jmp 0x41c3ff
cmp ax, 0x20
jne 0x41c40d
inc ecx
inc ecx
movzx eax, word [ecx]
mov dword [ebp - 0x2d4], ecx
cmp ax, di
jne 0x41c3f7
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
jmp 0x41c422
mov ecx, dword [ebp - 0x2d4]
movzx eax, word [ecx]
test ax, ax
je 0x41c450
push eax
call fcn.0043ef79
pop ecx
test eax, eax
je 0x41c450
mov eax, dword [ebp - 0x2d4]
mov ax, word [eax]
add dword [ebp - 0x2d4], 2
mov word [ebp + edi*2 - 0x1c], ax
inc edi
cmp edi, 4
jb 0x41c41c
cmp edi, 4
jne 0x41c482
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132cd
mov dword [ebp - 4], 0x14
mov eax, dword [esi + 0x18]
add eax, 0x564
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
xor edi, edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40ca58
call fcn.004132cd
mov dword [ebp - 4], 0x15
mov ecx, dword [esi + 0x18]
add ecx, 0x924
or dword [ebp - 4], 0xffffffff
call fcn.0041afe5
push 0x40ca74
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
cmp eax, edi
je 0x41c4e6
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x16
jmp 0x41c4f3
push ebx
call fcn.004132cd
mov dword [ebp - 4], 0x17
mov eax, dword [esi + 0x18]
add eax, 0x924
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041afa3
push 0x40ca98
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d4], eax
call fcn.004132cd
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x2d4], edi
je 0x41c548
push 0x409cf4
lea ecx, [ebp - 0x2b0]
call fcn.00413ccf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40caa0
call fcn.004132cd
mov byte [ebp - 4], 0x19
mov ecx, dword [esi + 0x18]
add ecx, 0x744
mov byte [ebp - 4], 0x18
call fcn.0041afe5
sub esp, 0x1c
lea eax, [ebp - 0x2b0]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x1a
mov eax, dword [esi + 0x18]
add eax, 0x744
push eax
mov byte [ebp - 4], 0x18
call fcn.0041afa3
push 0x40cab8
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
cmp eax, edi
jne 0x41c5d4
push 0x40cac0
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
push ebx
lea ecx, [ebp - 0x294]
call fcn.004132cd
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x2d4], edi
je 0x41c601
push 0x409cf4
lea ecx, [ebp - 0x294]
call fcn.00413ccf
call fcn.0041ce24
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cac8
call fcn.004132cd
mov byte [ebp - 4], 0x1c
mov ecx, dword [esi + 0x18]
mov ebx, 0x780
add ecx, ebx
mov byte [ebp - 4], 0x1b
call fcn.0041afe5
sub esp, 0x1c
lea eax, [ebp - 0x294]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x1d
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x1b
call fcn.0041afa3
push 0x409384
lea ecx, [ebp - 0x278]
call fcn.004132cd
mov byte [ebp - 4], 0x1e
push 0x40cae0
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c83e
push 0x40cafc
push dword [ebp - 0x2e0]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c73b
add eax, 0x1e
push eax
lea ecx, [ebp - 0x278]
call fcn.00413ccf
push edi
push 0x40cb1c
lea ecx, [ebp - 0x278]
call fcn.00419b88
cmp eax, 0xffffffff
je 0x41c6fd
push eax
push edi
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x278]
call fcn.00419bb8
mov byte [ebp - 4], 0x1f
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x278]
call fcn.00411dfc
mov byte [ebp - 4], 0x1e
push edi
push 1
lea ecx, [ebp - 0x25c]
jmp 0x41c839
mov byte [ebp - 4], 0x1b
push edi
push 1
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push 1
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x2b0]
call fcn.00411dad
xor al, al
call fcn.0045f566
ret
push 0x40cb38
push dword [ebp - 0x2e0]
call fcn.0043f33a
pop ecx
pop ecx
cmp eax, edi
je 0x41c908
add eax, 0x2e
push eax
lea ecx, [ebp - 0x240]
call fcn.004132cd
mov byte [ebp - 4], 0x20
push edi
push 0x40cb68
lea ecx, [ebp - 0x240]
call fcn.00419b88
cmp eax, 0xffffffff
je 0x41c8c7
push eax
push edi
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00419bb8
mov byte [ebp - 4], 0x21
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.00411dfc
mov byte [ebp - 4], 0x20
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x25c]
call fcn.00411dad
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041cc8b
test al, al
jne 0x41c811
mov byte [ebp - 4], 0x1e
push edi
push ebx
lea ecx, [ebp - 0x240]
call fcn.00411dad
mov byte [ebp - 4], 0x1b
push edi
push ebx
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push ebx
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push ebx
jmp 0x41c728
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x41c826
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x1e
push edi
push ebx
lea ecx, [ebp - 0x240]
call fcn.00411dad
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cb94
call fcn.004132cd
mov byte [ebp - 4], 0x22
mov ecx, dword [esi + 0x18]
mov ebx, 0x4b0
add ecx, ebx
mov byte [ebp - 4], 0x1e
call fcn.0041afe5
sub esp, 0x1c
lea eax, [ebp - 0x278]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x23
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x1e
call fcn.0041afa3
push 0x40cbcc
push dword [ebp - 0x2d8]
call fcn.0043f33a
pop ecx
pop ecx
lea ecx, [ebp - 0x2cc]
mov ebx, eax
call fcn.00411d68
mov byte [ebp - 4], 0x24
cmp ebx, edi
je 0x41c9b7
add ebx, 4
jmp 0x41c94f
mov byte [ebp - 4], 0x1e
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x240]
call fcn.00411dad
mov byte [ebp - 4], 0x1b
push edi
push esi
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push esi
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push esi
jmp 0x41c728
xor bl, bl
mov byte [ebp - 4], 0x1b
push edi
push 1
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push 1
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x2b0]
call fcn.00411dad
mov al, bl
jmp 0x41c735
cmp ax, 0x20
jne 0x41c957
inc ebx
inc ebx
movzx eax, word [ebx]
cmp ax, di
jne 0x41c947
push 0x22
pop eax
mov dword [ebp - 0x2dc], 0x20
cmp word [ebx], ax
jne 0x41c971
inc ebx
mov dword [ebp - 0x2dc], eax
inc ebx
push dword [ebp - 0x2dc]
push ebx
call fcn.0043f8a1
pop ecx
pop ecx
mov dword [ebp - 0x2d0], eax
cmp eax, edi
je 0x41c98e
xor ecx, ecx
mov word [eax], cx
push ebx
lea ecx, [ebp - 0x2cc]
call fcn.00413ccf
mov eax, dword [ebp - 0x2d0]
cmp eax, edi
je 0x41caa1
mov cx, word [ebp - 0x2dc]
mov word [eax], cx
jmp 0x41caa1
lea ecx, [ebp - 0x240]
call fcn.00411d68
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x25c]
call fcn.00411d68
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x25c]
push eax
push 0x1e
pop eax
mov ecx, esi
call fcn.0041bb12
lea eax, [ebp - 0x240]
push eax
push 0x11
pop eax
mov ecx, esi
call fcn.0041bb12
push 0x409cac
lea ecx, [ebp - 0x240]
call fcn.00413343
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push edi
push eax
call fcn.00443420
mov eax, dword [ebp - 0x23c]
add esp, 0xc
cmp dword [ebp - 0x228], 8
jae 0x41ca3a
lea eax, [ebp - 0x23c]
cmp dword [ebp - 0x244], 8
mov ebx, dword [ebp - 0x258]
jae 0x41ca4f
lea ebx, [ebp - 0x258]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0041a876
lea ecx, [ebp - 0x2cc]
test eax, eax
je 0x41ca6f
lea eax, [ebp - 0x224]
push eax
jmp 0x41ca74
push 0x40cbdc
call fcn.00413ccf
mov byte [ebp - 4], 0x25
push 0
push 1
lea ecx, [ebp - 0x25c]
call fcn.00411dad
mov byte [ebp - 4], 0x24
push 0
push 1
lea ecx, [ebp - 0x240]
call fcn.00411dad
xor edi, edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cbf4
call fcn.004132cd
mov byte [ebp - 4], 0x27
mov ecx, dword [esi + 0x18]
mov ebx, 0x474
add ecx, ebx
mov byte [ebp - 4], 0x24
call fcn.0041afe5
sub esp, 0x1c
lea eax, [ebp - 0x2cc]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x28
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x24
call fcn.0041afa3
mov byte [ebp - 4], 0x1e
push edi
push 1
lea ecx, [ebp - 0x2cc]
call fcn.00411dad
mov bl, 1
jmp 0x41c90a