Function at 0x53c9c8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x53c9d0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53d227
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x582438]
cmp byte [eax], 0
jne case.default.0x53cb72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne case.default.0x53cb72
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 4
jae 0x53cb1e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0040d774
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d554
test al, al
je 0x53cafc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0047da48
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x18]
call fcn.00405a0c
jne 0x53cafc
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 1
jne 0x53caf8
mov eax, dword [0x582c8c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.00405638
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040db0c
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5826c4]
call fcn.00405638
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d9cc
mov edx, dword [ebp - 0x14]
mov eax, dword [0x582db0]
call fcn.00405638
mov eax, dword [0x5824dc]
mov byte [eax], 1
mov bl, 1
jmp 0x53cb3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d554
test al, al
je 0x53cb3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x53cb3c
mov bl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d554
test al, al
je 0x53cb3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0040d774
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test bl, bl
je 0x53d125
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
cmp eax, 6
ja case.default.0x53cb72
jmp dword [eax*4 + 0x53cb79]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040c590
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0047da48
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040c590
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.0040c79c
test eax, eax
jne 0x53cc39
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x24]
call fcn.004058fc
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c210
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp case.default.0x53cb72
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge case.default.0x53cb72
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne case.default.0x53cb72
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x53ca4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040c590
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0047da48
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040c590
mov eax, dword [ebp - 0x2c]
pop edx
call fcn.0040c79c
test eax, eax
jne 0x53cda3
mov dl, 1
mov eax, dword [0x41c3a4]
call fcn.00404674
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53cd08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00421900
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00421130
mov eax, dword [0x582f40]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.00482804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53cd32
mov eax, dword [ebp - 8]
call fcn.004046a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x34]
call fcn.004058fc
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c210
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x53cdc0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x53cdc0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x53cdc0
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x53ca4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040c590
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0047da48
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040c590
mov eax, dword [ebp - 0x3c]
pop edx
call fcn.0040c79c
test eax, eax
jne 0x53ce90
mov eax, dword [0x582c8c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.00405638
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040db0c
mov edx, dword [ebp - 0x44]
mov eax, dword [0x5826c4]
call fcn.00405638
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d9cc
mov edx, dword [ebp - 0x48]
mov eax, dword [0x582db0]
call fcn.00405638
mov eax, dword [0x5824dc]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x53cead
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x53cead
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x53cead
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x53ca4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c840
test al, al
je 0x53cf2c
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x53cf49
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x53cf49
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x53cf49
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x53ca4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x4c]
call fcn.004058fc
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c210
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x50]
call fcn.004058fc
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c210
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
mov eax, dword [0x582438]
cmp byte [eax], 0
jne 0x53d102
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.0053c840
test al, al
jne 0x53d0fb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0040d774
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp case.default.0x53cb72
mov eax, dword [0x582438]
cmp byte [eax], 0
jne case.default.0x53cb72
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge case.default.0x53cb72
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne case.default.0x53cb72
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 1
jne 0x53d199
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0040d774
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
call fcn.0053c470
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x53ca4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d22e
lea eax, [ebp - 0x50]
mov edx, 0x12
call fcn.00405608
ret