Function at 0x515ba8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x515e4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x515e30
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d070
test al, al
je 0x515c06
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0050314c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x18]
call fcn.0040588c
jne 0x515c06
mov bl, 1
test bl, bl
je 0x515df6
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
sub al, 1
jb 0x515c2c
je 0x515cf5
dec al
je 0x515d92
jmp 0x515e30
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0050314c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x18]
call fcn.0040588c
jne 0x515cd0
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
xor eax, eax
push ebp
push 0x515c87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040d094
test al, al
jne 0x515c7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040d0b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515c91
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x10]
call fcn.0040577c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.005155a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
call fcn.005156a0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x515e30
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x515e30
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x515e30
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x515bc8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0050314c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x18]
call fcn.0040588c
jne 0x515d6d
mov eax, dword [0x523ab8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.004054b8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d604
mov edx, dword [ebp - 0x18]
mov eax, dword [0x52373c]
call fcn.004054b8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040d4c4
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x523b6c]
call fcn.004054b8
mov eax, dword [0x523638]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x515e30
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x515e30
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x515e30
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x515bc8
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.00515a3c
test al, al
je 0x515dd9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004058f4
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
call fcn.005156a0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
jmp 0x515e30
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x515e30
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x515e30
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x515bc8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 2
jge 0x515e30
mov eax, dword [ebp - 4]
cmp byte [eax + 0x24], 0
jne 0x515e30
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
call fcn.00515828
mov eax, dword [ebp - 4]
inc dword [eax + 0x20]
jmp 0x515bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515e52
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00405488
ret