Function at 0x435a70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3800
call fcn.0052bf00
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor al, al
push edi
mov dword [ebp - 0x37f4], ecx
mov dword [ebp - 0x37fc], esi
mov dword [ebp - 0x37f8], ebx
mov byte [ebp - 0x37ed], al
test esi, esi
je 0x4361c5
cmp word [esi], 0
je 0x4361c5
test ebx, ebx
je 0x4361c5
mov eax, esi
call fcn.00437580
mov edi, eax
cmp edi, 0xb0
je 0x435b10
cmp edi, 0xc0
je 0x435b10
cmp edi, 0x4e8
je 0x435b10
cmp edi, 0x4ec
je 0x435b10
cmp edi, 0x4f0
je 0x435b10
cmp edi, 0xd18
je 0x435b10
cmp edi, 0xd40
je 0x435b10
cmp edi, 0xd4c
jne 0x4361df
mov eax, esi
mov esi, dword [ebp - 0x37f4]
call fcn.004494e0
test al, al
je 0x4361df
cmp edi, 0xb0
jne 0x435b9c
mov ecx, edi
lea eax, [ebp - 0x17c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435b35
mov edi, dword [ebp - 0x37f4]
mov esi, 0xb0
lea edx, [ebp - 0x17c]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0x15c]
mov edx, dword [ebp - 0x154]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x178]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x158]
mov dword [ebx + 0x34], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x150]
mov word [ebx + 0x20], ax
mov dword [ebx + 0x38], edx
rep movsd dword es:[edi], dword [esi]
jmp 0x436176
cmp edi, 0xc0
jne 0x435c3b
mov ecx, edi
lea eax, [ebp - 0xcc]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435bb0
mov edi, dword [ebp - 0x37f4]
mov esi, 0xc0
lea edx, [ebp - 0xcc]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0xac]
mov edx, dword [ebp - 0xa4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xa8]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x9c]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x98]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x90]
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], eax
rep movsd dword es:[edi], dword [esi]
jmp 0x436176
cmp edi, 0x4e8
jne 0x435d31
mov ecx, edi
lea eax, [ebp - 0x664]
nop
mov byte [eax], 0
inc eax
dec ecx
jne 0x435c50
mov edi, dword [ebp - 0x37f4]
mov esi, 0x4e8
lea edx, [ebp - 0x664]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov edx, dword [ebp - 0x640]
mov eax, dword [ebp - 0x63c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x660]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x644]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x638]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x634]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x630]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [ebp - 0x62c]
mov dword [ebx + 0x38], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x628]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], eax
test edi, edi
je 0x435cf1
lea ebx, [ebp - 0x5a4]
call fcn.004375f0
mov ebx, dword [ebp - 0x37f8]
lea ecx, [ebx + 0xd28]
test ecx, ecx
je 0x435d06
lea eax, [ebp - 0x18c]
call fcn.00437890
add ebx, 0xd48
je 0x436176
mov dl, byte [ebp - 0x17f]
mov al, byte [ebp - 0x180]
mov cl, byte [ebp - 0x17e]
mov byte [ebx + 1], dl
mov byte [ebx], al
mov byte [ebx + 2], cl
jmp 0x436176
cmp edi, 0x4ec
jne 0x435e22
mov ecx, edi
lea eax, [ebp - 0xb54]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435d45
mov edi, dword [ebp - 0x37f4]
mov esi, 0x4ec
lea edx, [ebp - 0xb54]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov eax, dword [ebp - 0xb30]
mov dx, word [ebp - 0xb34]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0xb50]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xb2c]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp - 0xb20]
mov dword [ebx + 0x34], ecx
mov word [ebx + 0x20], dx
mov edx, dword [ebp - 0xb28]
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0xb18]
mov dword [ebx + 0x2c], edx
mov edx, dword [ebp - 0xb1c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x38], edx
test edi, edi
je 0x435de6
lea ebx, [ebp - 0xa94]
call fcn.004376a0
mov ebx, dword [ebp - 0x37f8]
lea ecx, [ebx + 0xd28]
lea eax, [ebp - 0x67c]
call fcn.004378c0
add ebx, 0xd48
je 0x436176
mov al, byte [ebp - 0x66b]
mov cl, byte [ebp - 0x66c]
mov dl, byte [ebp - 0x66a]
mov byte [ebx + 1], al
mov byte [ebx], cl
mov byte [ebx + 2], dl
jmp 0x436176
cmp edi, 0x4f0
jne 0x435ef9
mov ecx, edi
lea eax, [ebp - 0x1044]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435e36
mov edi, dword [ebp - 0x37f4]
mov esi, 0x4f0
lea edx, [ebp - 0x1044]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0x1024]
mov edx, dword [ebp - 0x101c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1040]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1020]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x1014]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x1018]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x1010]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x100c]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x1008]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], eax
test edi, edi
je 0x435ed7
lea ebx, [ebp - 0xf84]
call fcn.004376a0
mov ebx, dword [ebp - 0x37f8]
lea ecx, [ebx + 0xd28]
lea eax, [ebp - 0xb6c]
call fcn.004378c0
mov ecx, dword [ebp - 0xb5c]
mov edx, dword [ebp - 0xb58]
jmp 0x43616a
cmp edi, 0xd18
jne 0x435fcd
mov ecx, edi
lea eax, [ebp - 0x37ec]
lea ecx, [ecx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435f10
mov edi, dword [ebp - 0x37f4]
mov esi, 0xd18
lea edx, [ebp - 0x37ec]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0x37cc]
mov edx, dword [ebp - 0x37c4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x37e8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x37c8]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x37bc]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x37c0]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x37b8]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x37b4]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x37b0]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], eax
test edi, edi
je 0x435fab
lea edx, [ebp - 0x372c]
call fcn.00437750
lea ecx, [ebx + 0xd28]
lea eax, [ebp - 0x2aec]
call fcn.004378c0
mov ecx, dword [ebp - 0x2adc]
mov edx, dword [ebp - 0x2ad8]
jmp 0x43616a
cmp edi, 0xd40
jne 0x43609c
mov ecx, edi
lea eax, [ebp - 0x1d84]
mov byte [eax], 0
inc eax
dec ecx
jne 0x435fe1
mov edi, dword [ebp - 0x37f4]
mov esi, 0xd40
lea edx, [ebp - 0x1d84]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0x1d64]
mov edx, dword [ebp - 0x1d5c]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1d80]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1d60]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x1d54]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x1d58]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x1d50]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x1d4c]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x1d48]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov ecx, 0x31a
lea esi, [ebp - 0x1cc4]
mov dword [ebx + 0x38], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xd28]
lea eax, [ebp - 0x105c]
mov dword [ebx + 0x34], edx
call fcn.004378c0
mov ecx, dword [ebp - 0x104c]
mov edx, dword [ebp - 0x1048]
jmp 0x43616a
cmp edi, 0xd4c
jne 0x43617d
mov ecx, edi
lea eax, [ebp - 0x2ad4]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4360b0
mov edi, dword [ebp - 0x37f4]
mov esi, 0xd4c
lea edx, [ebp - 0x2ad4]
call fcn.00449560
cmp eax, esi
jne 0x43617d
mov ax, word [ebp - 0x2ab4]
mov edx, dword [ebp - 0x2aac]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x2ad0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x2ab0]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x2aa4]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x2aa8]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x2aa0]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x2a9c]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x3c]
mov ecx, 0x21
lea esi, [ebp - 0x2a98]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0xc0]
mov ecx, 0x31a
lea esi, [ebp - 0x2a14]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xd28]
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], eax
test ecx, ecx
je 0x43615e
lea eax, [ebp - 0x1dac]
call fcn.00437900
mov ecx, dword [ebp - 0x1d90]
mov edx, dword [ebp - 0x1d8c]
mov dword [ebx + 0xd4c], edx
mov dword [ebx + 0xd48], ecx
mov byte [ebp - 0x37ed], 1
mov esi, dword [ebp - 0x37f4]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x436199
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov bl, byte [ebp - 0x37ed]
test bl, bl
je 0x4361b0
mov eax, dword [ebp - 0x37fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x37ed]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4