Function at 0x40a600
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x4a02f0]
xor eax, esp
mov dword [esp + 0x138], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x56e380]
push 1
xor esi, esi
mov dword [0x56e330], ecx
push 0x49a994
lea ecx, [esp + 0x114]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x128], 0xf
mov dword [esp + 0x124], esi
mov byte [esp + 0x114], 0
call fcn.00402dd0
mov edx, dword [edi + 0x14]
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0xe0]
lea ebx, [esi + 1]
mov dword [esp + 0x1c], edx
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], esi
mov byte [esp + 0xe0], 0
call fcn.004031f0
lea esi, [esp + 0xd4]
call fcn.00411e10
lea ecx, [esp + 0x18]
lea eax, [edi + 0x10]
push ecx
mov edi, esi
call fcn.00410e40
mov edx, dword [esp + 0x10]
cmp dword [eax], edx
setne byte [esp + 0xf]
cmp dword [esp + 0xe8], 0x10
jb 0x40a6e5
mov eax, dword [esp + 0xd4]
push eax
call fcn.0046d64b
add esp, 4
cmp byte [esp + 0xf], 0
jne 0x40a7ab
push 7
mov edi, 0xf
xor esi, esi
push str.vmodule
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], esi
mov byte [esp + 0xf8], 0
call fcn.00402dd0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x14]
push 0xffffffffffffffff
push esi
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0xe0]
lea ebx, [edi - 0xc]
mov dword [esp + 0x1c], edx
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], esi
mov byte [esp + 0xe0], 0
call fcn.004031f0
lea esi, [esp + 0xd4]
call fcn.00411e10
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
mov edi, esi
add eax, 0x10
call fcn.00410e40
mov edx, dword [esp + 0x10]
cmp dword [eax], edx
setne byte [esp + 0xf]
cmp dword [esp + 0xe8], 0x10
jb 0x40a79f
mov eax, dword [esp + 0xd4]
push eax
call fcn.0046d64b
add esp, 4
cmp byte [esp + 0xf], 0
mov byte [esp + 0xf], 0
je 0x40a7b0
mov byte [esp + 0xf], 1
test bl, 2
je 0x40a7f3
and ebx, 0xfffffffd
cmp dword [esp + 0x104], 0x10
jb 0x40a7d2
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.0046d64b
add esp, 4
mov edi, 0xf
mov dword [esp + 0x104], edi
mov dword [esp + 0x100], 0
mov byte [esp + 0xf0], 0
jmp 0x40a7f8
mov edi, 0xf
test bl, 1
je 0x40a81a
and ebx, 0xfffffffe
cmp dword [esp + 0x120], 0x10
jb 0x40a81a
mov edx, dword [esp + 0x10c]
push edx
call fcn.0046d64b
add esp, 4
cmp byte [esp + 0xf], 0
je 0x40a9df
cmp dword [0x56e338], 0
je 0x40a833
call fcn.0040a060
test bl, 4
je 0x40a844
lea ecx, [esp + 0x20]
and ebx, 0xfffffffb
call fcn.0040ae20
mov eax, dword [0x56e334]
push 0x14
mov dword [0x56e338], eax
call fcn.0046e1e3
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x40a906
push 7
push str.vmodule
lea ecx, [esp + 0x114]
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], eax
mov byte [esp + 0x114], al
call fcn.00402dd0
push 1
push 0x49a994
lea ecx, [esp + 0xf8]
or ebx, 8
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], 0
mov byte [esp + 0xf8], 0
call fcn.00402dd0
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov ecx, edi
or ebx, 0x70
call fcn.00410640
lea ecx, [esp + 0xf0]
push ecx
lea edx, [esp + 0xd8]
push edx
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00410640
mov edx, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0041bde0
mov edi, 0xf
mov dword [0x56e334], eax
mov esi, 0x10
test bl, 0x40
je 0x40a94b
and ebx, 0xffffffbf
cmp dword [esp + 0xe8], esi
jb 0x40a931
mov eax, dword [esp + 0xd4]
push eax
call fcn.0046d64b
add esp, 4
mov dword [esp + 0xe8], edi
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
test bl, 0x20
je 0x40a986
and ebx, 0xffffffdf
cmp dword [esp + 0x13c], esi
jb 0x40a96c
mov ecx, dword [esp + 0x128]
push ecx
call fcn.0046d64b
add esp, 4
mov dword [esp + 0x13c], edi
mov dword [esp + 0x138], 0
mov byte [esp + 0x128], 0
test bl, 0x10
je 0x40a9c1
and ebx, 0xffffffef
cmp dword [esp + 0x104], esi
jb 0x40a9a7
mov edx, dword [esp + 0xf0]
push edx
call fcn.0046d64b
add esp, 4
mov dword [esp + 0x104], edi
mov dword [esp + 0x100], 0
mov byte [esp + 0xf0], 0
test bl, 8
je 0x40a9df
cmp dword [esp + 0x120], esi
jb 0x40a9df
mov eax, dword [esp + 0x10c]
push eax
call fcn.0046d64b
add esp, 4
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x1c]
push ecx
mov edx, edi
call fcn.0040a3c0
xor esi, esi
add esp, 4
cmp dword [0x56e360], esi
jne 0x40aa0c
mov edx, dword [0x56e364]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40aa18
mov eax, dword [0x56e35c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x56e344]
cmp eax, esi
je 0x40aa2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x56e344], esi
mov eax, dword [ebp + 0xc]
mov dword [0x4a2e94], eax
cmp eax, esi
je 0x40ab07
cmp eax, 2
je 0x40ab07
mov ecx, dword [0x56e340]
cmp ecx, esi
jne 0x40aa76
push 0x1c
call fcn.0046e1e3
add esp, 4
xor ecx, ecx
cmp eax, esi
je 0x40aa70
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], esi
mov word [eax], cx
mov ecx, eax
mov dword [0x56e340], ecx
mov eax, edi
lea esi, [eax + 2]
jmp 0x40aa80
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40aa80
sub eax, esi
sar eax, 1
push eax
push edi
call fcn.00402ed0
cmp dword [ebp + 0x14], 0
jne 0x40aab0
mov eax, dword [0x56e340]
cmp dword [eax + 0x14], 8
jb 0x40aaa9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040a540
cmp dword [0x56e360], 0
mov bl, al
jne 0x40aae4
mov edx, dword [0x56e364]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0046e0cd
mov esp, ebp
pop ebp
ret
mov eax, dword [0x56e35c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0046e0cd
mov esp, ebp
pop ebp
ret
cmp dword [0x56e360], esi
jne 0x40ab33
mov ecx, dword [0x56e364]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0046e0cd
mov esp, ebp
pop ebp
ret
mov edx, dword [0x56e35c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0046e0cd
mov esp, ebp
pop ebp
ret