Function at 0x40d950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [0x42a36c]
test ecx, ecx
jne 0x40d970
mov eax, dword [0x42a290]
test eax, eax
je 0x40dc2f
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40d984
mov eax, dword [0x42a390]
test eax, eax
je 0x40dc2f
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
setne al
xor edx, edx
cmp dword [ebp + 8], 0
setne dl
test eax, edx
jne 0x40dc37
mov eax, dword [0x42a390]
test eax, eax
je 0x40d9ae
dec eax
mov dword [0x42a390], eax
xor esi, esi
test ecx, ecx
mov ebx, ecx
je 0x40dba0
lea esi, [esi]
movzx eax, byte [ebx + 0x20]
and eax, 1
or esi, eax
test byte [0x42a408], 4
je 0x40da14
test eax, eax
mov edx, str.__remote_
jne 0x40d9e0
mov edx, 0x426060
mov dword [esp + 0x10], edx
mov eax, dword [ebx + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp], 0x4264c0
mov dword [esp + 8], eax
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40d9c0
test esi, esi
je 0x40dba0
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [esp + 8], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call fcn.00418ec0
test eax, eax
mov edx, eax
jle 0x40db90
mov edi, 1
mov dword [ebp - 0x1c], 0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x40da65
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40da6c
mov dword [ebp - 0x1c], 1
mov ecx, dword [0x42a36c]
xor esi, esi
test ecx, ecx
mov ebx, ecx
jne 0x40da8c
jmp 0x40d963
mov esi, ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x40d95f
movzx eax, byte [ebx + 0x20]
and eax, 1
cmp eax, edi
jne 0x40da80
cmp dword [ebx + 0x18], edx
jne 0x40da80
test ebx, ebx
je 0x40d95f
test byte [0x42a408], 4
je 0x40daf4
test byte [ebx + 0x20], 1
mov eax, str.__remote_
je 0x40de63
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], ebx
test edx, edx
mov dword [esp + 8], eax
mov eax, str.Reaping_losing_child_0x_08lx_PID__ld__s_n
jne 0x40dadc
mov eax, str.Reaping_winning_child_0x_08lx_PID__ld__s_n
mov dword [esp], eax
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40db22
test byte [0x42a408], 4
jne 0x40decf
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebx + 0x1c], 0
movzx edx, byte [ebx + 0x20]
test dl, 4
je 0x40db32
xor eax, eax
mov dword [0x42a380], eax
mov al, dl
mov edi, 1
shr al, 4
and edi, eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dd71
test dl, 2
jne 0x40dd66
mov eax, dword [0x42a3fc]
test eax, eax
jne 0x40dd66
test edi, edi
je 0x40df26
mov eax, dword [ebx + 4]
mov word [eax + 0x4c], 2
mov eax, dword [0x4237d4]
cmp eax, 0xffffffff
je 0x40df5b
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x40dd99
test eax, eax
jmp 0x40dd97
jl 0x40dea6
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x18], 0
mov ecx, dword [0x42af40]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x40dc6a
call fcn.004204e0
test eax, eax
mov esi, eax
je 0x40dc05
mov dword [esp], eax
call fcn.0041fb50
mov dword [esp], esi
mov ebx, eax
call fcn.0041fb70
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x40dce6
mov dword [esp], esi
call fcn.0041fb30
mov dword [ebp - 0x14], eax
mov dword [esp], esi
call fcn.00420510
mov dword [ebp - 0x10], 0
cmp esi, dword [0x42a290]
mov edx, esi
jne 0x40da50
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40dc24
cmp dword [ebp - 0x18], 0x7f
je 0x40df4b
mov esi, 1
mov dword [0x42af30], esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
mov eax, dword [0x42a3c0]
test eax, eax
je 0x40dd17
mov ecx, dword [0x42a36c]
mov esi, 1
mov dword [0x42a3c0], esi
jmp 0x40d99f
call sub.KERNEL32.dll_GetCurrentThread
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 8], eax
mov edx, 2
xor ecx, ecx
mov dword [esp + 0x18], edx
xor esi, esi
mov edx, 0x42af40
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x40dd31
test byte [0x42a408], 2
je 0x40dbc3
mov dword [esp], str.Main_thread_handle__0x_08lx_n
mov eax, dword [0x42af40]
mov dword [esp + 4], eax
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
jmp 0x40dbc3
mov dword [esp], eax
call fcn.00421040
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, str.make__e_d_:__s
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x40dbeb
mov dword [esp], 0
mov eax, str._Waiting_for_unfinished_jobs....
mov dword [esp + 4], eax
call fcn.00411a10
jmp 0x40dc54
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
mov ebx, eax
call fcn.00421040
mov dword [esp + 0xc], eax
mov eax, str.Determine_main_thread_ID__Error__ld:__s__n
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x40dbc3
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40def7
mov eax, ebx
call fcn.0040c050
test eax, eax
je 0x40dda3
mov eax, dword [0x42a010]
test eax, eax
je 0x40de6d
mov edx, dword [ebx + 4]
mov word [edx + 0x4c], 2
cmp word [edx + 0x4c], 0
je 0x40ddac
mov dword [esp], ebx
call fcn.00402b20
jmp 0x40ddac
mov eax, dword [ebx + 4]
mov word [eax + 0x4c], 0
mov eax, dword [0x42a010]
test eax, eax
je 0x40deb2
test byte [0x42a408], 4
je 0x40ddfd
test byte [ebx + 0x20], 1
mov eax, str.__remote_
jne 0x40ddd2
mov eax, 0x426060
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], ebx
mov dword [esp], str.Removing_child_0x_08lx_PID__ld_s_from_chain._n
mov dword [esp + 8], eax
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
mov eax, dword [0x42a368]
test eax, eax
je 0x40de0c
dec eax
mov dword [0x42a368], eax
test esi, esi
je 0x40dec2
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, ebx
call fcn.0040c0d0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
sete al
xor edx, edx
cmp dword [ebp - 0x1c], 0
setne dl
test eax, edx
je 0x40de57
test edi, edi
jne 0x40de57
mov edx, dword [0x42b030]
test edx, edx
jne 0x40de57
mov eax, dword [0x42a010]
test eax, eax
jne 0x40de57
mov dword [esp], 2
call fcn.0040f530
mov dword [ebp + 8], 0
jmp 0x40d959
mov eax, 0x426060
jmp 0x40dabc
mov dword [esp], 0
call fcn.00418ea0
mov dl, al
and dl, 1
movzx eax, byte [ebx + 0x20]
and al, 0xfe
or al, dl
mov byte [ebx + 0x20], al
mov eax, ebx
call fcn.0040d1e0
mov edx, dword [ebx + 4]
movzx eax, byte [edx + 0x50]
and al, 3
cmp al, 2
jne 0x40dd92
jmp 0x40d959
mov dword [esp], str.remote_status
call fcn.00411c50
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.00417290
jmp 0x40ddb9
mov ecx, dword [ebx]
mov dword [0x42a36c], ecx
jmp 0x40de18
mov dword [esp + 4], eax
mov dword [esp], str.Cleaning_up_temp_batch_file__s_n
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.00422040
mov eax, dword [ebx + 0x1c]
jmp 0x40db08
mov eax, 1
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [ecx]
call fcn.0040bf90
mov dword [ebp - 0x1c], 0
jmp 0x40dd71
xor eax, eax
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [ecx]
call fcn.0040bf90
jmp 0x40db67
mov edi, 0xffffffff
mov dword [0x42af30], edi
jmp 0x40dc2f
mov dword [esp], str..DELETE_ON_ERROR
call fcn.00405180
xor edx, edx
test eax, eax
je 0x40df78
test byte [eax + 0x50], 0x80
je 0x40df78
mov edx, 1
mov dword [0x4237d4], edx
mov eax, edx
jmp 0x40db7e