Function at 0x4020f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425d28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x318
mov eax, dword [str.c:_test.sys]
mov edx, dword [0x43017c]
push ebx
mov ebx, ecx
mov ecx, dword [0x430178]
push esi
push edi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x118]
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x430458]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
mov al, byte [ebx + 0x84]
mov dword [ebp - 4], 0
test al, 0x20
lea edx, [ebp - 0x324]
je 0x40219c
mov edi, str.ePass.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x224]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ITOKEN.SYS
jmp 0x4021c9
mov edi, str.ePass98.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x224]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ITOKEN98.SYS
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
cmp eax, 4
rep movsb byte es:[edi], byte [esi]
ja case.default.0x4021f2
jmp dword [eax*4 + 0x402760]
mov edi, 0x65
cmp edi, 0x67
je 0x40223e
push edi
mov ecx, ebx
call fcn.0041ebc7
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ecx
mov ecx, esi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea ecx, [ebp - 0x14]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [edi + edx*8]
push eax
call fcn.0041eec5
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.0041ec86
inc edi
cmp edi, 0x6c
jbe 0x4021fe
mov eax, dword [ebx + 0x94]
test eax, eax
je 0x402290
push 0x65
mov ecx, ebx
call fcn.0041ebc7
mov edi, dword [ebp + 0xc]
mov esi, eax
push edi
mov ecx, esi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea ecx, [ebp - 0x14]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [edx*8 + 0xbe2]
push eax
call fcn.0041eec5
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.0041ec86
jmp 0x402293
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x84]
test al, 0x10
je 0x4022a4
push 0xbb8
jmp 0x4022c3
test al, 0x40
je 0x4022af
push 0xbb9
jmp 0x4022c3
test al, 0x80
je 0x4022ba
push 0xbba
jmp 0x4022c3
test al, 0x20
je 0x4022cb
push 0xbbb
lea ecx, [ebp - 0x14]
call fcn.0041eec5
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4022df
push 0xbd6
lea ecx, [ebp - 0x14]
call fcn.0041eec5
push 0x6a
mov ecx, ebx
call fcn.0041ebc7
mov edx, dword [ebp - 0x14]
mov ecx, eax
push edx
call fcn.0041ec86
mov ecx, dword [ebx + 0x84]
lea eax, [ebp - 0x1f0]
push eax
push ecx
mov ecx, ebx
call fcn.00402920
mov esi, eax
mov eax, dword [ebx + 0x8c]
lea ecx, [ebp - 0x14]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esi + edx*8 + 0xbbc]
push eax
call fcn.0041eec5
lea ecx, [ebp - 0x1f0]
test ecx, ecx
je 0x402386
test esi, esi
je 0x402386
mov edx, dword [0x430458]
mov dword [ebp + 8], edx
lea eax, [ebp - 0x1f0]
mov byte [ebp - 4], 1
push eax
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [ebp + 8]
lea edx, [ecx*8 + 0xbdd]
push edx
push eax
call fcn.00419d0a
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041ab15
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.0041a7ec
push 0x6b
mov ecx, ebx
call fcn.0041ebc7
mov edx, dword [ebp - 0x14]
mov ecx, eax
push edx
call fcn.0041ec86
push 0x3f4
mov ecx, ebx
call fcn.0041ebc7
push edi
mov ecx, eax
call fcn.0041ed87
push 0xbd3
mov ecx, ebx
call fcn.0041ebc7
mov esi, eax
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax*8 + 0xbd3]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041eec5
mov edx, dword [ebp - 0x14]
mov ecx, esi
push edx
call fcn.0041ec86
push edi
mov ecx, esi
call fcn.0041ed87
push 0xbd2
mov ecx, ebx
call fcn.0041ebc7
mov esi, eax
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x324]
push eax
push ecx
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
call fcn.00402e00
add esp, 8
jmp 0x40243c
test eax, eax
mov dword [ebp - 4], 0
je 0x402475
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.004048f0
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0041a925
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0041a7ec
jmp 0x402482
push 0xbde
lea ecx, [ebp - 0x14]
call fcn.0041eec5
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x14]
mov ecx, esi
push edx
call fcn.0041ec86
push edi
mov ecx, esi
call fcn.0041ed87
push 0xbd5
mov ecx, ebx
call fcn.0041ebc7
mov esi, eax
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax*8 + 0xbd5]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041eec5
mov edx, dword [ebp - 0x14]
mov ecx, esi
push edx
call fcn.0041ec86
push edi
mov ecx, esi
call fcn.0041ed87
push 0x66
mov ecx, ebx
call fcn.0041ebc7
jmp case.default.0x4021f2
push 0x3e9
mov ecx, ebx
call fcn.0041ebc7
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0041ed87
mov esi, 0x6d
push esi
mov ecx, ebx
call fcn.0041ebc7
mov edx, dword [ebp + 0xc]
mov edi, eax
push edx
mov ecx, edi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041eec5
mov edx, dword [ebp - 0x14]
mov ecx, edi
push edx
call fcn.0041ec86
inc esi
cmp esi, 0x73
jbe 0x40250c
test byte [ebx + 0x84], 0x10
je case.default.0x4021f2
push 0x6e
mov ecx, ebx
call fcn.0041ebc7
mov edx, dword [ebx + 0x84]
mov dword [ebx + 0x60], 0
or dh, 1
mov dword [ebx + 0x84], edx
jmp 0x4025ea
push 0x3ed
mov ecx, ebx
call fcn.0041ebc7
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0041ed87
mov esi, 0x74
push esi
mov ecx, ebx
call fcn.0041ebc7
mov edx, dword [ebp + 0xc]
mov edi, eax
push edx
mov ecx, edi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041eec5
mov edx, dword [ebp - 0x14]
mov ecx, edi
push edx
call fcn.0041ec86
inc esi
cmp esi, 0x75
jbe 0x402597
test byte [ebx + 0x84], 0xa0
je 0x4025f3
push 0x74
mov ecx, ebx
call fcn.0041ebc7
push 0
mov ecx, eax
call fcn.0041edc9
push 0
mov ecx, ebx
call fcn.0041e29d
jmp case.default.0x4021f2
mov esi, 0x76
push esi
mov ecx, ebx
call fcn.0041ebc7
mov edi, eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [esi + ecx*8]
lea ecx, [ebp - 0x14]
push edx
call fcn.0041eec5
mov eax, dword [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0041ec86
inc esi
cmp esi, 0x7c
jbe 0x402606
mov esi, 0x72
push esi
mov ecx, ebx
call fcn.0041ebc7
mov ecx, dword [ebp + 0xc]
mov edi, eax
push ecx
mov ecx, edi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea ecx, [ebp - 0x14]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esi + edx*8]
push eax
call fcn.0041eec5
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, edi
call fcn.0041ec86
inc esi
cmp esi, 0x73
jbe 0x40264c
push 0x7b
mov ecx, ebx
call fcn.0041ebc7
mov esi, eax
mov ecx, esi
call fcn.0041edf0
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
jmp case.default.0x4021f2
push 0x3ed
mov ecx, ebx
call fcn.0041ebc7
mov esi, dword [ebp + 0xc]
mov ecx, eax
push esi
call fcn.0041ed87
push 0x75
mov ecx, ebx
call fcn.0041ebc7
push esi
mov ecx, eax
call fcn.0041ed87
push 0x7d
mov ecx, ebx
call fcn.0041ebc7
mov edi, eax
push esi
mov ecx, edi
call fcn.0041ed87
mov eax, dword [ebx + 0x8c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [ecx*8 + 0x7d]
lea ecx, [ebp - 0x14]
push edx
call fcn.0041eec5
mov eax, dword [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0041ec86
push 0x74
mov ecx, ebx
call fcn.0041ebc7
push 0
mov ecx, eax
call fcn.0041edc9
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0041a7ec
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8