Function at 0x41c164
Capabilities:
Delete file
Get file size
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 0x2c]
push ebx
mov ebx, ecx
sub esp, 0x134
mov dword [ecx + 0x5ac], 0
push 0
push esi
call fcn.0040357d
mov dword [ebp - 0x12c], 0
pop edi
pop edx
test eax, eax
jle 0x41cb64
mov edi, eax
push eax
push esi
push str.Forward_file__s
push dword [0x46446c]
call fcn.0040423a
add esp, 0xc
lea edx, [ebp - 0xec]
push 0x30
push 0x438e80
push edx
call fcn.0042d568
add esp, 0xc
lea eax, [ebp - 0xbc]
push 0xa4
push 0
push eax
call fcn.0042d588
mov eax, dword [ebx + 0x5a4]
mov ecx, 0x400
add esp, 0xc
lea edx, [ebp - 0xec]
mov dword [ebp - 0x54], 0
add eax, 0x3ff
mov dword [ebp - 0x58], edx
cdq
mov dword [ebp - 0x1c], 0
idiv ecx
lea edx, [ebp - 0x124]
push eax
push 0x447c18
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x124]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xe8], edx
pop edx
pop ecx
push 0x447c1b
push eax
mov dword [ebp - 0xd8], eax
call fcn.004034b9
add esp, 0x10
mov dword [ebp - 0xc8], eax
test eax, eax
jne 0x41c262
mov dword [ebp - 0xdc], 0
jmp 0x41c26b
add eax, 3
mov dword [ebp - 0xc8], eax
push eax
mov dword [ebp - 0x118], 0x30
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 0xc
mov edx, eax
lea eax, [eax + 0x2bc]
push eax
mov dword [ebp - 0x12c], edx
push 8
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 0x18], eax
add esp, 0x14
test eax, eax
je 0x41cb4d
push edx
mov edx, dword [ebp - 0x12c]
mov dword [ebx + 0x28], eax
push edx
push eax
push edi
call fcn.00403603
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 0x12c]
push dword [ebx + 0x5a8]
push dword [ebp + 8]
lea eax, [eax + edx + 8]
push dword [ebx + 0x24]
push str._.500s_s_8.8X.msg
push eax
mov dword [ebp - 0xd0], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x12c], 0
add esp, 0x20
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41cb33
cmp byte [eax], 0
je 0x41cb33
push ecx
push ecx
push 0xa
push dword [ebx + 0x18]
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x14], eax
test eax, eax
je 0x41c36a
cmp word [eax - 2], 0x5c20
jne 0x41c356
cmp word [eax - 3], 0x5c20
jne 0x41c356
cmp byte [eax - 1], 0xd
jne 0x41c356
cmp byte [eax - 2], 0x5c
jne 0x41c34b
mov byte [eax - 2], 0x20
mov eax, dword [ebx + 0x14]
mov word [eax - 1], 0x2020
jmp 0x41c315
lea edx, [eax + 1]
mov dword [ebx + 0x14], edx
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
sub eax, 2
mov dword [ebx + 0x1c], eax
jmp 0x41c380
mov edi, dword [ebx + 0x18]
sub esp, 0xc
push edi
call fcn.0042d5c4
add esp, 0x10
lea eax, [edi + eax - 1]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x18]
jbe 0x41c3cd
push edx
push edx
movsx eax, byte [eax]
push eax
push str.__t_r_n
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41c3cd
mov eax, dword [ebx + 0x1c]
lea edx, [eax - 1]
mov dword [ebx + 0x1c], edx
mov byte [eax], 0
jmp 0x41c380
push edi
push edi
push eax
push str.__t_r_n
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41c3d7
mov eax, dword [ebx + 0x18]
lea edx, [eax + 1]
mov dword [ebx + 0x18], edx
mov byte [eax], 0
mov eax, dword [ebx + 0x18]
movsx eax, byte [eax]
test al, al
jne 0x41c3ad
mov eax, dword [ebx + 0x18]
mov edx, dword [eax]
cmp edx, 0x20706323
je 0x41c5b3
ja 0x41c407
cmp edx, 0x6d7223
je 0x41c592
cmp edx, 0x20666923
jne 0x41c633
add eax, 4
jmp 0x41c473
cmp edx, 0x20766d23
jne 0x41c633
mov dword [ebp - 0x12c], 1
jmp 0x41c5b3
push edx
push edx
push 0x29
push eax
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x20], eax
test eax, eax
je 0x41c48f
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebx + 0x1c]
add eax, 9
push eax
push dword [ebx + 8]
call fcn.004034dd
mov edx, dword [ebx + 0x1c]
add esp, 0xc
mov edi, eax
mov eax, dword [ebx + 0x20]
sub eax, edx
inc eax
push eax
push 0x20
push edx
call fcn.0042d588
mov edx, dword [ebx + 0x1c]
add esp, 0x10
mov al, 0x30
cmp edi, 1
sbb al, 0xff
mov byte [edx], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x1c], eax
push ecx
push ecx
push str._in_text_
push dword [ebx + 0x1c]
call fcn.004034dd
add esp, 0x10
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x41c422
mov eax, dword [ebx + 0x18]
push ecx
push dword [ebx + 0x5ac]
add eax, 4
push 0x447c41
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop edi
push dword [ebx + 0x1c]
call fcn.00406414
mov eax, dword [ebx + 0x14]
push str.endif
push 0x447c4b
inc eax
push str.endif
push eax
call fcn.00406485
add esp, 0x20
mov dword [ebx + 0x1c], eax
test eax, eax
jne 0x41c4f5
push dword [ebx + 0x14]
push dword [ebx + 0x24]
push str.Error_in__.255s_forward:_endif_not_found_r_n:_s
push dword [0x46446c]
call fcn.0040423a
jmp 0x41c54f
mov byte [eax], 0
mov eax, dword [ebx + 0x14]
push str.endif
inc eax
push 0x447c4b
push 0x447c7e
push eax
call fcn.00406485
lea ecx, [ebp - 0xbc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0x1c]
mov byte [eax], 0x23
mov eax, dword [ebx + 0x18]
add eax, 4
mov dword [esp], eax
call fcn.00405d62
add esp, 0xc
test eax, eax
mov eax, dword [ebx + 0x20]
je 0x41c557
test eax, eax
je 0x41cb28
push edx
mov edx, dword [ebx + 0x1c]
sub edx, eax
push edx
push 0x20
push eax
call fcn.0042d588
add esp, 0x10
jmp 0x41cb28
mov edx, dword [ebx + 0x1c]
mov dword [ebx + 0x14], edx
test eax, eax
je 0x41cb28
mov dx, word [eax + 3]
cmp dx, 0x6573
jne 0x41c578
mov dword [ebx + 0x14], eax
jmp 0x41cb28
cmp dx, 0x6669
jne 0x41cb28
lea edx, [eax + 2]
mov dword [ebx + 0x14], edx
mov byte [eax + 2], 0x23
jmp 0x41cb28
sub esp, 0xc
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x12c], 1
add esp, 0xc
jmp 0x41cb28
add eax, 4
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x18]
cmp byte [eax], 0x20
jg 0x41c5c4
inc eax
jmp 0x41c5b6
lea edi, [ebx + 0x22c]
push dword [ebx + 0x5a8]
push eax
push str._.500s_8.8X.msg
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp - 0x12c], 0
jne 0x41c61d
sub esp, 0xc
push edi
call fcn.004035b1
mov edi, eax
add esp, 0xc
test eax, eax
jle 0x41cb28
push eax
push dword [ebx + 0x5a4]
push dword [ebx + 8]
push edi
call fcn.00403629
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41cb25
push ecx
push ecx
push edi
push dword [ebp - 0xd0]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop eax
jmp 0x41cb28
cmp byte [eax], 0x23
je 0x41cb28
push ecx
push ecx
lea ecx, [ebp - 0xbc]
push eax
push esi
call fcn.00406154
mov eax, dword [ebx + 0x18]
pop edi
pop edx
cmp byte [eax], 0x21
jne 0x41c9f2
test byte [0x46d979], 8
jne 0x41c66e
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
jne 0x41cb28
push edx
push edx
push 0x24
push eax
call fcn.00404c10
lea ecx, [ebx + 0x2d]
add esp, 0x10
mov dword [ebp - 0x130], ecx
test eax, eax
jne 0x41c6aa
push eax
push eax
mov eax, dword [ebx + 0x18]
push dword [ebx + 0x5a8]
inc eax
push dword [ebp + 8]
push dword [ebx + 0x24]
push eax
push str._.512s__s_s_8.8X.msg
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [ebp - 0x10c]
push edi
push 0x3c
push esi
push eax
call fcn.0041c111
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x3e
push esi
push eax
call fcn.0041c111
mov eax, dword [ebp - 0x104]
add esp, 0x10
test eax, eax
je 0x41c772
mov byte [eax], 0
mov eax, dword [ebp - 0x104]
xor edi, edi
cmp byte [eax - 1], 0x3e
jne 0x41c6f7
mov byte [eax - 1], 0
mov edi, 1
lea edx, [ebp - 0xfc]
push ecx
push 0x3e
push esi
push edx
call fcn.0041c111
mov eax, edi
add esp, 0x10
lea edx, [ebp - 0xfc]
not eax
add eax, dword [ebp - 0x104]
cmp byte [eax], 0x32
jne 0x41c749
mov byte [eax], 0
lea eax, [ebp - 0x104]
mov ecx, dword [eax]
xchg dword [edx], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
add edi, edi
test eax, eax
je 0x41c788
cmp byte [eax - 1], 0x3e
jne 0x41c788
mov byte [eax - 1], 0
or edi, 1
jmp 0x41c788
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41c788
cmp byte [eax - 1], 0x3e
jne 0x41c788
mov byte [eax - 1], 0
mov eax, dword [ebp - 0xfc]
or edi, 2
cmp byte [eax - 2], 0x32
jne 0x41c788
mov byte [eax - 2], 0
jmp 0x41c788
mov dword [ebp - 0xfc], 0
xor edi, edi
mov dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x41c795
mov byte [eax], 0
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x41c7a2
mov byte [eax], 0
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x41c7af
mov byte [eax], 0
cmp dword [ebp - 0x10c], 0
mov dword [0x46e1c0], 0x44
mov dword [0x46e1ec], 0x181
mov word [0x46e1f0], 0
je 0x41c7e7
cmp dword [ebp - 0x104], 0
je 0x41c7e7
cmp dword [ebp - 0xfc], 0
jne 0x41c806
push eax
push eax
push 2
push 0x447ca9
call fcn.0040357d
mov dword [0x46e1f8], eax
mov dword [0x46e1fc], eax
mov dword [0x46e200], eax
pop eax
pop edx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x41c82f
mov byte [eax], 0
mov eax, dword [ebp - 0x10c]
push ecx
inc eax
push ecx
push 0
push eax
call fcn.0040357d
pop edx
pop ecx
test eax, eax
jle 0x41c82f
mov dword [0x46e1f8], eax
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x41c87c
test edi, 1
jne 0x41c85a
mov eax, dword [ebp - 0x104]
sub esp, 0xc
inc eax
push eax
call fcn.004035b1
add esp, 0xc
test eax, eax
jg 0x41c86b
jmp 0x41c87c
inc eax
push edx
push edx
push 1
push eax
call fcn.0040357d
pop ecx
pop edx
test eax, eax
jle 0x41c841
push edx
push 2
push 0
push eax
mov dword [0x46e1fc], eax
call fcn.0040364f
pop ecx
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x41c8f9
mov byte [eax], 0
push eax
push eax
mov eax, dword [ebp - 0xfc]
inc eax
push eax
mov eax, dword [ebp - 0x104]
inc eax
push eax
call fcn.0040341a
add esp, 0x10
test eax, eax
je 0x41c8ef
and edi, 2
jne 0x41c8c5
mov eax, dword [ebp - 0xfc]
sub esp, 0xc
inc eax
push eax
call fcn.004035b1
add esp, 0xc
test eax, eax
jg 0x41c8dc
jmp 0x41c8f9
push eax
push eax
mov eax, dword [ebp - 0xfc]
push 1
inc eax
push eax
call fcn.0040357d
pop edx
pop ecx
test eax, eax
jle 0x41c8ac
push edi
push 2
push 0
push eax
mov dword [0x46e200], eax
call fcn.0040364f
pop eax
jmp 0x41c8f9
mov eax, dword [0x46e1fc]
mov dword [0x46e200], eax
push ecx
push dword [ebp - 0x130]
push str.Run:__s
push dword [0x46446c]
call fcn.0040423a
lea eax, [ebx + 0x5c0]
mov dword [esp], eax
push 0x46e1c0
push dword [ebx + 0x24]
push 0
push dword [ebp - 0x130]
call fcn.00407970
add esp, 0x20
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41c9b2
push eax
push eax
mov eax, dword [0x42e488]
shl eax, 0xa
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebx + 0x5ac]
push eax
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebx + 0x5ac], 0x103
pop eax
pop edx
jne 0x41c99c
push dword [0x42e488]
push esi
push str.Mail_script:_executable__s_still_active_more_then__u_seconds_and_will_be_hard_terminated_by_server.
push dword [0x46446c]
call fcn.0040423a
pop eax
pop edx
push 0
push dword [ebx + 0x5c0]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ecx
pop eax
sub esp, 0xc
push dword [ebx + 0x5c4]
call edi
push dword [ebx + 0x5c0]
call edi
add esp, 0xc
sub esp, 0xc
push dword [0x46e1fc]
call edi
mov eax, dword [0x46e1f8]
add esp, 0xc
cmp dword [0x46e1fc], eax
je 0x41c9d6
sub esp, 0xc
push eax
call edi
add esp, 0xc
mov eax, dword [0x46e200]
cmp dword [0x46e1fc], eax
je 0x41cb28
sub esp, 0xc
push eax
call edi
jmp 0x41cb25
push eax
push eax
push 0x40
push esi
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x41cb28
mov eax, dword [ebx]
push edi
push edi
add eax, 5
push 0x20
mov dword [ebx + 0x20], eax
push eax
call fcn.004033de
add esp, 0x10
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x41cb28
mov byte [eax], 0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebx + 0xc]
push dword [ebx + 0x20]
push str.From__s__redirect_from__s__For
push esi
call edi
mov dword [ebp - 0x130], eax
mov eax, dword [ebx + 0x1c]
mov byte [eax], 0x20
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x20]
pop edx
lea eax, [esi + eax + 5]
pop ecx
push eax
push dword [ebx + 8]
call fcn.004034b9
add esp, 0x10
test eax, eax
jne 0x41cb28
push eax
push eax
mov eax, dword [ebx]
push dword [ebx + 0xc]
add eax, 7
push eax
call fcn.004034b9
add esp, 0x10
test eax, eax
jne 0x41cb28
sub esp, 0xc
lea eax, [ebx + 0x5b0]
push eax
call fcn.004196f7
lea edx, [ebx + 0x12c]
push eax
push dword [0x42e670]
push 0x447d3b
push edx
mov dword [ebp - 0x134], edx
call edi
mov edx, dword [ebp - 0x134]
add esp, 0x14
push edx
call fcn.004035b1
mov edi, eax
add esp, 0xc
test eax, eax
jle 0x41cb28
push eax
push dword [ebp - 0x130]
push esi
push edi
call fcn.00403629
lea ecx, [ebp - 0xbc]
push eax
push dword [ebx + 0x18]
push esi
call fcn.00406154
push eax
push esi
call fcn.0042d5c4
add esp, 0xc
push eax
push esi
push edi
call fcn.00403629
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0xd
mov eax, dword [ebx + 0x5a4]
add eax, 2
push eax
mov eax, dword [ebx + 8]
sub eax, 2
push eax
push edi
call fcn.00403629
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 8]
mov byte [eax - 2], 0
add esp, 0xc
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
jmp 0x41c301
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41cb64
push edx
push eax
push 0
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ecx
jmp 0x41cb64
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x12c], 0
add esp, 0xc
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4