Function at 0x40e3f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [ebp + 0xc], 0
setne byte [ebp - 0x2e]
sete byte [ebp - 0x2f]
cmp dword [0x4311ec], 0
jne 0x40e41b
cmp dword [0x431160], 0
je 0x40eada
cmp dword [ebp + 8], 0
jne 0x40ea8d
mov eax, dword [0x431288]
test eax, eax
je 0x40e434
dec eax
mov dword [0x431288], eax
mov eax, dword [0x4311ec]
xor ebx, ebx
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], 0
je 0x40e4f7
mov edi, dword [ebp - 0x2c]
mov dl, byte [edi + 0x30]
mov ecx, edx
and edx, 1
or ebx, edx
mov edx, dword [edi + 0x2c]
and ecx, 1
test edx, edx
jns 0x40e47a
xor edx, edx
mov dword [ebp - 0x28], 0x7f
mov ebx, edi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x2c], eax
jmp 0x40e779
test byte [0x43154c], 4
je 0x40e4e9
mov esi, 0x42b6b8
test cl, cl
je 0x40e491
mov esi, str.__remote_
mov dword [esp + 8], edx
mov dword [esp + 4], 0x42b91d
mov dword [esp], 0x431220
call fcn.0040c722
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x431220
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Live_child__p___s__PID__s__s_n
mov dword [esp + 4], eax
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x2c], ecx
jmp 0x40e440
test ebx, ebx
je 0x40e535
xor eax, eax
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0041efa1
mov ecx, 1
test eax, eax
jg 0x40e6a7
je 0x40e535
mov dword [esp], str.remote_status
jmp 0x40e693
xor edi, edi
cmp dword [0x4311f0], 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
jne 0x40e5fc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor esi, esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x4311f0
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
jne 0x40e5c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
mov ebx, eax
call fcn.0041eef4
mov dword [esp], 2
mov esi, eax
call dword [0x428f30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Determine_main_thread_ID__Error__ld:__s__n
mov dword [esp], eax
call fcn.0040c6d1
jmp 0x40e5fc
test byte [0x43154c], 2
je 0x40e5fc
mov eax, dword [0x4311f0]
mov dword [esp], str.Main_thread_handle___p_n
mov dword [esp + 4], eax
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041e9ba
mov ebx, eax
test eax, eax
je 0x40e684
mov dword [esp], eax
call fcn.0041dfae
mov dword [esp], ebx
mov esi, eax
call fcn.0041dfc3
lea edx, [eax - 1]
mov dword [ebp - 0x28], eax
cmp edx, 0x270e
ja 0x40e66a
test esi, esi
je 0x40e66a
mov dword [esp], eax
call fcn.0041eef4
mov edi, dword [ebp - 0x28]
mov dword [esp], 2
mov esi, eax
call dword [0x428f30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], str.make__e_d_:__s_n
mov dword [esp], eax
call fcn.0040c6d1
mov dword [esp], ebx
call fcn.0041df9c
mov dword [ebp - 0x24], eax
mov dword [esp], ebx
call fcn.0041e9e2
xor ecx, ecx
mov dword [ebp - 0x20], ecx
jmp 0x40e6a3
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jne 0x40e698
mov dword [esp], str.WaitForMultipleObjects
call fcn.00412556
cmp eax, 0x102
je 0x40eada
mov eax, ebx
xor ecx, ecx
inc dword [0x428e24]
test ecx, ecx
jne 0x40e6d0
cmp dword [0x431160], eax
jne 0x40e6d0
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00408d66
jmp 0x40eada
mov ebx, dword [0x4311ec]
test ebx, ebx
je 0x40e405
cmp dword [ebx + 0x2c], eax
jne 0x40e6f2
mov dl, byte [ebx + 0x30]
mov esi, edx
and edx, 1
and esi, 1
cmp edx, ecx
je 0x40e6fa
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebx + 0x14]
jmp 0x40e6d6
test byte [0x43154c], 4
je 0x40e76a
mov ecx, esi
mov edi, 0x42b6b8
test cl, cl
je 0x40e713
mov edi, str.__remote_
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42b91d
mov dword [esp], 0x431220
call fcn.0040c722
mov edx, dword [ebp - 0x24]
or edx, dword [ebp - 0x28]
mov eax, str.Reaping_losing_child__p_PID__s__s_n
jne 0x40e73d
mov eax, str.Reaping_winning_child__p_PID__s__s_n
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x431220
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
mov eax, dword [0x4311e4]
test eax, eax
je 0x40e779
dec eax
mov dword [0x4311e4], eax
cmp dword [ebp - 0x24], 0
mov esi, 2
jne 0x40e7a4
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x40e7a4
cmp esi, 1
jne 0x40e79f
cmp dword [0x431538], 0
je 0x40e79f
test byte [ebx + 0x30], 0x10
jne 0x40e7a4
mov esi, 2
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40e841
test byte [0x43154c], 4
je 0x40e7dd
mov dword [esp + 4], eax
mov dword [esp], str.Cleaning_up_temp_batch_file__s_n
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_remove
test eax, eax
je 0x40e831
test byte [0x43154c], 4
je 0x40e831
call edi
mov eax, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], str.Cleaning_up_temp_batch_file__s_failed___d__n
mov dword [esp + 4], eax
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call fcn.004258bc
xor eax, eax
mov dword [ebx + 0x1c], eax
mov al, byte [ebx + 0x30]
test al, 4
je 0x40e850
xor edi, edi
mov dword [0x431290], edi
mov ecx, eax
shr cl, 6
mov byte [ebp - 0x2d], cl
and byte [ebp - 0x2d], 1
test esi, esi
je 0x40e915
test al, 2
jne 0x40e8fa
mov edi, dword [0x431540]
test edi, edi
jne 0x40e8fa
cmp esi, 2
jne 0x40e8a0
cmp byte [ebp - 0x2d], 0
jne 0x40e8a0
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [ebp - 0x28]
call fcn.0040c743
jmp 0x40e8a7
mov cl, 2
cmp esi, 2
jne 0x40e8a9
mov cl, 3
mov edx, dword [ebx + 0x18]
mov al, byte [edx + 0x50]
and eax, 0xfffffffc
or eax, ecx
mov byte [edx + 0x50], al
mov eax, dword [0x4288dc]
cmp eax, 0xffffffff
jne 0x40e8e4
mov dword [esp], str..DELETE_ON_ERROR
call fcn.00404cde
test eax, eax
je 0x40e8dc
mov al, byte [eax + 0x51]
shr al, 4
mov edi, eax
and edi, 1
mov dword [0x4288dc], edi
mov eax, edi
or eax, dword [ebp - 0x24]
je 0x40e992
mov dword [esp], ebx
call fcn.00402bf7
jmp 0x40e992
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [ebp - 0x28]
call fcn.0040c743
mov eax, ebx
call fcn.0040c684
test eax, eax
je 0x40e989
mov eax, dword [0x431020]
test eax, eax
je 0x40e932
mov eax, dword [ebx + 0x18]
or byte [eax + 0x50], 3
jmp 0x40e979
cmp dword [0x4314c8], 1
jne 0x40e946
lea eax, [ebx + 8]
mov dword [esp], eax
call fcn.0041225d
xor edx, edx
mov dword [esp], edx
call fcn.0041ef9a
mov edx, eax
mov al, byte [ebx + 0x30]
and edx, 1
and eax, 0xfffffffe
or eax, edx
mov byte [ebx + 0x30], al
mov eax, ebx
call fcn.0040df9b
mov eax, dword [ebx + 0x18]
mov dl, byte [eax + 0x50]
and edx, 0xc
cmp dl, 8
je 0x40e405
test byte [eax + 0x50], 3
je 0x40e990
mov dword [esp], ebx
call fcn.00402bf7
jmp 0x40e990
mov eax, dword [ebx + 0x18]
and byte [eax + 0x50], 0xfc
xor esi, esi
lea eax, [ebx + 8]
mov dword [esp], eax
call fcn.0041225d
mov eax, dword [0x431020]
test eax, eax
jne 0x40e9b1
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call fcn.00417434
mov eax, dword [ebx + 0x2c]
test eax, eax
jle 0x40ea1a
test byte [0x43154c], 4
je 0x40ea1a
mov edi, 0x42b6b8
test byte [ebx + 0x30], 1
je 0x40e9d1
mov edi, str.__remote_
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42b91d
mov dword [esp], 0x431220
call fcn.0040c722
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x431220
mov dword [esp + 4], ebx
mov dword [esp], str.Removing_child__p_PID__s_s_from_chain._n
call fcn.0040c6f2
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
mov edx, dword [0x4311e8]
test edx, edx
je 0x40ea35
mov al, byte [ebx + 0x30]
shr al, 5
and eax, 1
sub edx, eax
mov dword [0x4311e8], edx
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebx + 0x14]
jne 0x40ea45
mov dword [0x4311ec], eax
jmp 0x40ea4b
mov edi, dword [ebp - 0x2c]
mov dword [edi + 0x14], eax
mov eax, ebx
call fcn.0040dbe7
test esi, esi
setne al
test byte [ebp - 0x2f], al
je 0x40ea83
cmp byte [ebp - 0x2d], 0
jne 0x40ea83
mov eax, dword [0x43152c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x40ea83
mov eax, dword [0x431020]
test eax, eax
jne 0x40e405
mov dword [esp], esi
call fcn.00410614
xor eax, eax
mov dword [ebp + 8], eax
jmp 0x40e405
cmp byte [ebp - 0x2e], 0
je 0x40e425
mov dword [esp], 1
call dword [0x428f30]
mov dword [esp], eax
call fcn.00425884
cmp dword [0x431284], 0
jne 0x40eacb
xor ecx, ecx
mov dword [esp + 8], str._Waiting_for_unfinished_jobs....
mov dword [esp + 4], ecx
mov dword [esp], ecx
call fcn.0041215f
mov dword [0x431284], 1
jmp 0x40e425
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret