Function at 0x432ec0
Capabilities:
Delete file
Get file size
Get hostname
Get session user name
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe9d0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x28bc
call fcn.004b7ac0
mov eax, dword [0x52e144]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x26f0], ecx
jmp 0x432f0e
movzx eax, byte [0x53be21]
cmp eax, 1
jne 0x432f24
mov eax, 0x6b
jmp 0x4343c7
mov ecx, dword [ebp - 0x26f0]
cmp dword [ecx + 0x30], 0
je 0x432f3c
mov edx, dword [ebp - 0x26f0]
cmp dword [edx + 0x34], 0
jne 0x432f46
mov eax, 0x6c
jmp 0x4343c7
mov dword [ebp - 0x5a4], 0x134
mov byte [ebp - 0x338], 0
push 0x103
push 0
lea eax, [ebp - 0x337]
push eax
call fcn.004b6dc0
add esp, 0xc
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea ecx, [ebp - 0x11f]
push ecx
call fcn.004b6dc0
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x124], 0
mov byte [ebp - 0x7a8], 0
push 0x1ff
push 0
lea edx, [ebp - 0x7a7]
push edx
call fcn.004b6dc0
add esp, 0xc
mov byte [ebp - 0x230], 0
push 0x103
push 0
lea eax, [ebp - 0x22f]
push eax
call fcn.004b6dc0
add esp, 0xc
mov dword [ebp - 0x5a8], 0
cmp dword [ebp + 8], 0
jne 0x432fef
mov eax, 0x69
jmp 0x4343c7
movsx ecx, byte [ebp + 0x30]
test ecx, ecx
jne 0x433001
mov eax, 0x64
jmp 0x4343c7
push 8
push 0x517034
call fcn.00404690
add esp, 4
push eax
lea edx, [ebp + 0x30]
push edx
call fcn.00409910
add esp, 0xc
test eax, eax
je 0x43304e
movzx eax, byte [ebp + 0x408]
test eax, eax
jne 0x43304e
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp + 0x30]
push edx
mov ecx, dword [ebp - 0x26f0]
call fcn.004304b0
cmp eax, 1
jne 0x43304e
mov eax, 0x6a
jmp 0x4343c7
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x26f0]
call fcn.00430d50
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
je 0x433077
mov eax, dword [ebp - 0x5a4]
jmp 0x4343c7
lea ecx, [ebp - 0x5a0]
call fcn.0042f5b0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5a0], ecx
lea edx, [ebp + 0x30]
mov dword [ebp - 0x26f4], edx
lea eax, [ebp - 0x598]
mov dword [ebp - 0x26f8], eax
mov ecx, dword [ebp - 0x26f8]
mov dword [ebp - 0x26fc], ecx
mov edx, dword [ebp - 0x26f4]
mov al, byte [edx]
mov byte [ebp - 0x26fd], al
mov ecx, dword [ebp - 0x26f8]
mov dl, byte [ebp - 0x26fd]
mov byte [ecx], dl
mov eax, dword [ebp - 0x26f4]
add eax, 1
mov dword [ebp - 0x26f4], eax
mov ecx, dword [ebp - 0x26f8]
add ecx, 1
mov dword [ebp - 0x26f8], ecx
cmp byte [ebp - 0x26fd], 0
jne 0x4330ac
movzx edx, byte [ebp + 0x404]
cmp edx, 1
jne 0x433107
mov dword [ebp - 0x5a8], 0
jmp 0x43312d
sub esp, 0x268
mov ecx, 0x9a
lea esi, [ebp - 0x5a0]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x26f0]
call fcn.004325b0
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 1
jne 0x433280
mov eax, dword [ebp - 0x26f0]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x26f0]
movzx edx, word [ecx + 0x52]
push edx
mov eax, dword [ebp - 0x26f0]
movzx ecx, word [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x26f0]
movzx eax, word [edx + 0x4e]
push eax
mov ecx, dword [ebp - 0x26f0]
movzx edx, word [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x26f0]
movzx ecx, word [eax + 0x4a]
push ecx
mov edx, dword [ebp - 0x26f0]
movzx eax, word [edx + 0x46]
push eax
mov ecx, dword [ebp - 0x26f0]
movzx edx, word [ecx + 0x44]
push edx
push 0x51700c
call fcn.00404690
add esp, 4
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.004b79a8
add esp, 0x24
movsx ecx, byte [ebp + 0x50]
test ecx, ecx
je 0x4331d0
lea edx, [ebp + 0x50]
push edx
call fcn.00404300
add esp, 4
mov dword [ebp - 0x124], eax
jmp 0x43323f
mov byte [ebp - 0x8b8], 0
push 0x103
push 0
lea eax, [ebp - 0x8b7]
push eax
call fcn.004b6dc0
add esp, 0xc
mov dword [ebp - 0x7ac], 0
lea ecx, [ebp - 0x7ac]
push ecx
lea edx, [ebp - 0x8b8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsx eax, byte [ebp - 0x8b8]
test eax, eax
jne 0x43322a
lea ecx, [ebp - 0x7ac]
push ecx
lea edx, [ebp - 0x8b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x8b8]
push eax
call fcn.00404300
add esp, 4
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
push ecx
lea edx, [ebp - 0x338]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x516ff8
call fcn.00404690
add esp, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.004b79a8
add esp, 0x14
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp - 0x26f0]
call fcn.00430020
mov dword [ebp - 0x128], 0
push 0x516fe0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2704], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2708], eax
mov ecx, dword [ebp - 0x2708]
mov dword [ebp - 0x270c], ecx
mov edx, dword [ebp - 0x2704]
mov al, byte [edx]
mov byte [ebp - 0x270d], al
mov ecx, dword [ebp - 0x2708]
mov dl, byte [ebp - 0x270d]
mov byte [ecx], dl
mov eax, dword [ebp - 0x2704]
add eax, 1
mov dword [ebp - 0x2704], eax
mov ecx, dword [ebp - 0x2708]
add ecx, 1
mov dword [ebp - 0x2708], ecx
cmp byte [ebp - 0x270d], 0
jne 0x4332b5
mov dword [ebp - 4], 0
push 0x5169f0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2714], eax
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x2714]
push eax
mov ecx, dword [ebp - 0x26f0]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x26f0]
mov ecx, dword [eax + 0x20]
call ecx
mov dword [ebp - 0x2718], eax
mov edx, dword [ebp - 0x2718]
mov dword [ebp - 0x128], edx
cmp dword [ebp - 0x128], 0
jne 0x433371
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xca
jmp 0x4343c7
mov byte [ebp - 0x26d8], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x26d7]
push ecx
call fcn.004b6dc0
add esp, 0xc
mov byte [ebp - 0x1cb8], 0
push 0xfff
push 0
lea edx, [ebp - 0x1cb7]
push edx
call fcn.004b6dc0
add esp, 0xc
mov byte [ebp - 0xcb8], 0
push 0x3ff
push 0
lea eax, [ebp - 0xcb7]
push eax
call fcn.004b6dc0
add esp, 0xc
mov dword [ebp - 0x1cbc], 0
mov dword [ebp - 0x20d4], 0
mov dword [ebp - 0x1cc0], 0
mov dword [ebp - 0x26dc], 0
mov dword [ebp - 0x20d8], 0
mov dword [ebp - 0x20d0], 0
mov dword [ebp - 0x20cc], 0
mov dword [ebp - 0x1cc4], 0
mov byte [ebp - 0x22d8], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x22d7]
push ecx
call fcn.004b6dc0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x20c8], dx
push 0x3fe
push 0
lea eax, [ebp - 0x20c6]
push eax
call fcn.004b6dc0
add esp, 0xc
lea ecx, [ebp + 0x50]
mov dword [ebp - 0x271c], ecx
mov edx, dword [ebp - 0x271c]
add edx, 1
mov dword [ebp - 0x2720], edx
mov eax, dword [ebp - 0x271c]
mov cl, byte [eax]
mov byte [ebp - 0x2721], cl
add dword [ebp - 0x271c], 1
cmp byte [ebp - 0x2721], 0
jne 0x43346c
mov edx, dword [ebp - 0x271c]
sub edx, dword [ebp - 0x2720]
mov dword [ebp - 0x2728], edx
push 0x104
lea eax, [ebp - 0x20c8]
push eax
mov ecx, dword [ebp - 0x2728]
add ecx, 1
push ecx
lea edx, [ebp + 0x50]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0x200
lea eax, [ebp + 0x50]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x20c8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x516f88
call fcn.00404690
add esp, 4
mov dword [ebp - 0x272c], eax
mov edx, dword [ebp - 0x272c]
push edx
lea eax, [ebp - 0x26d8]
push eax
call fcn.004b79a8
add esp, 8
push 0x516f28
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2730], eax
lea ecx, [ebp + 0x30]
push ecx
mov edx, dword [ebp - 0x2730]
push edx
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b79a8
add esp, 0xc
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x2734], ecx
mov edx, dword [ebp - 0x2734]
mov dword [ebp - 0x2738], edx
mov eax, dword [ebp - 0x2734]
mov cl, byte [eax]
mov byte [ebp - 0x2739], cl
add dword [ebp - 0x2734], 1
cmp byte [ebp - 0x2739], 0
jne 0x433551
mov edx, dword [ebp - 0x2734]
sub edx, dword [ebp - 0x2738]
mov eax, dword [ebp - 0x2738]
mov dword [ebp - 0x2740], eax
mov dword [ebp - 0x2744], edx
lea ecx, [ebp - 0x1cb8]
add ecx, 0xffffffff
mov dword [ebp - 0x2748], ecx
mov edx, dword [ebp - 0x2748]
mov al, byte [edx + 1]
mov byte [ebp - 0x2749], al
add dword [ebp - 0x2748], 1
cmp byte [ebp - 0x2749], 0
jne 0x43359c
mov edi, dword [ebp - 0x2748]
mov esi, dword [ebp - 0x2740]
mov edx, dword [ebp - 0x2744]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x400
push 0
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x516ec8
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2750], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2750]
push edx
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b79a8
add esp, 0xc
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x2754], ecx
mov edx, dword [ebp - 0x2754]
mov dword [ebp - 0x2758], edx
mov eax, dword [ebp - 0x2754]
mov cl, byte [eax]
mov byte [ebp - 0x2759], cl
add dword [ebp - 0x2754], 1
cmp byte [ebp - 0x2759], 0
jne 0x433636
mov edx, dword [ebp - 0x2754]
sub edx, dword [ebp - 0x2758]
mov eax, dword [ebp - 0x2758]
mov dword [ebp - 0x2760], eax
mov dword [ebp - 0x2764], edx
lea ecx, [ebp - 0x1cb8]
add ecx, 0xffffffff
mov dword [ebp - 0x2768], ecx
mov edx, dword [ebp - 0x2768]
mov al, byte [edx + 1]
mov byte [ebp - 0x2769], al
add dword [ebp - 0x2768], 1
cmp byte [ebp - 0x2769], 0
jne 0x433681
mov edi, dword [ebp - 0x2768]
mov esi, dword [ebp - 0x2760]
mov edx, dword [ebp - 0x2764]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x50]
test eax, eax
je 0x4337b1
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516e60
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2770], eax
lea edx, [ebp + 0x50]
push edx
mov eax, dword [ebp - 0x2770]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x2774], edx
mov eax, dword [ebp - 0x2774]
mov dword [ebp - 0x2778], eax
mov ecx, dword [ebp - 0x2774]
mov dl, byte [ecx]
mov byte [ebp - 0x2779], dl
add dword [ebp - 0x2774], 1
cmp byte [ebp - 0x2779], 0
jne 0x433727
mov eax, dword [ebp - 0x2774]
sub eax, dword [ebp - 0x2778]
mov ecx, dword [ebp - 0x2778]
mov dword [ebp - 0x2780], ecx
mov dword [ebp - 0x2784], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x2788], edx
mov eax, dword [ebp - 0x2788]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2789], cl
add dword [ebp - 0x2788], 1
cmp byte [ebp - 0x2789], 0
jne 0x433772
mov edi, dword [ebp - 0x2788]
mov esi, dword [ebp - 0x2780]
mov edx, dword [ebp - 0x2784]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x250]
test eax, eax
je 0x4338a8
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516e00
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2790], eax
lea edx, [ebp + 0x250]
push edx
mov eax, dword [ebp - 0x2790]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x2794], edx
mov eax, dword [ebp - 0x2794]
mov dword [ebp - 0x2798], eax
mov ecx, dword [ebp - 0x2794]
mov dl, byte [ecx]
mov byte [ebp - 0x2799], dl
add dword [ebp - 0x2794], 1
cmp byte [ebp - 0x2799], 0
jne 0x43381e
mov eax, dword [ebp - 0x2794]
sub eax, dword [ebp - 0x2798]
mov ecx, dword [ebp - 0x2798]
mov dword [ebp - 0x27a0], ecx
mov dword [ebp - 0x27a4], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x27a8], edx
mov eax, dword [ebp - 0x27a8]
mov cl, byte [eax + 1]
mov byte [ebp - 0x27a9], cl
add dword [ebp - 0x27a8], 1
cmp byte [ebp - 0x27a9], 0
jne 0x433869
mov edi, dword [ebp - 0x27a8]
mov esi, dword [ebp - 0x27a0]
mov edx, dword [ebp - 0x27a4]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x2d0]
test eax, eax
je 0x43399f
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516da0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x27b0], eax
lea edx, [ebp + 0x2d0]
push edx
mov eax, dword [ebp - 0x27b0]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x27b4], edx
mov eax, dword [ebp - 0x27b4]
mov dword [ebp - 0x27b8], eax
mov ecx, dword [ebp - 0x27b4]
mov dl, byte [ecx]
mov byte [ebp - 0x27b9], dl
add dword [ebp - 0x27b4], 1
cmp byte [ebp - 0x27b9], 0
jne 0x433915
mov eax, dword [ebp - 0x27b4]
sub eax, dword [ebp - 0x27b8]
mov ecx, dword [ebp - 0x27b8]
mov dword [ebp - 0x27c0], ecx
mov dword [ebp - 0x27c4], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x27c8], edx
mov eax, dword [ebp - 0x27c8]
mov cl, byte [eax + 1]
mov byte [ebp - 0x27c9], cl
add dword [ebp - 0x27c8], 1
cmp byte [ebp - 0x27c9], 0
jne 0x433960
mov edi, dword [ebp - 0x27c8]
mov esi, dword [ebp - 0x27c0]
mov edx, dword [ebp - 0x27c4]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x381]
test eax, eax
je 0x433a96
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516d40
call fcn.00404690
add esp, 4
mov dword [ebp - 0x27d0], eax
lea edx, [ebp + 0x381]
push edx
mov eax, dword [ebp - 0x27d0]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x27d4], edx
mov eax, dword [ebp - 0x27d4]
mov dword [ebp - 0x27d8], eax
mov ecx, dword [ebp - 0x27d4]
mov dl, byte [ecx]
mov byte [ebp - 0x27d9], dl
add dword [ebp - 0x27d4], 1
cmp byte [ebp - 0x27d9], 0
jne 0x433a0c
mov eax, dword [ebp - 0x27d4]
sub eax, dword [ebp - 0x27d8]
mov ecx, dword [ebp - 0x27d8]
mov dword [ebp - 0x27e0], ecx
mov dword [ebp - 0x27e4], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x27e8], edx
mov eax, dword [ebp - 0x27e8]
mov cl, byte [eax + 1]
mov byte [ebp - 0x27e9], cl
add dword [ebp - 0x27e8], 1
cmp byte [ebp - 0x27e9], 0
jne 0x433a57
mov edi, dword [ebp - 0x27e8]
mov esi, dword [ebp - 0x27e0]
mov edx, dword [ebp - 0x27e4]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x350]
test eax, eax
je 0x433b8d
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516ce0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x27f0], eax
lea edx, [ebp + 0x350]
push edx
mov eax, dword [ebp - 0x27f0]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x27f4], edx
mov eax, dword [ebp - 0x27f4]
mov dword [ebp - 0x27f8], eax
mov ecx, dword [ebp - 0x27f4]
mov dl, byte [ecx]
mov byte [ebp - 0x27f9], dl
add dword [ebp - 0x27f4], 1
cmp byte [ebp - 0x27f9], 0
jne 0x433b03
mov eax, dword [ebp - 0x27f4]
sub eax, dword [ebp - 0x27f8]
mov ecx, dword [ebp - 0x27f8]
mov dword [ebp - 0x2800], ecx
mov dword [ebp - 0x2804], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x2808], edx
mov eax, dword [ebp - 0x2808]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2809], cl
add dword [ebp - 0x2808], 1
cmp byte [ebp - 0x2809], 0
jne 0x433b4e
mov edi, dword [ebp - 0x2808]
mov esi, dword [ebp - 0x2800]
mov edx, dword [ebp - 0x2804]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp + 0x3e1]
test eax, eax
je 0x433c84
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516c80
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2810], eax
lea edx, [ebp + 0x3e1]
push edx
mov eax, dword [ebp - 0x2810]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x2814], edx
mov eax, dword [ebp - 0x2814]
mov dword [ebp - 0x2818], eax
mov ecx, dword [ebp - 0x2814]
mov dl, byte [ecx]
mov byte [ebp - 0x2819], dl
add dword [ebp - 0x2814], 1
cmp byte [ebp - 0x2819], 0
jne 0x433bfa
mov eax, dword [ebp - 0x2814]
sub eax, dword [ebp - 0x2818]
mov ecx, dword [ebp - 0x2818]
mov dword [ebp - 0x2820], ecx
mov dword [ebp - 0x2824], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x2828], edx
mov eax, dword [ebp - 0x2828]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2829], cl
add dword [ebp - 0x2828], 1
cmp byte [ebp - 0x2829], 0
jne 0x433c45
mov edi, dword [ebp - 0x2828]
mov esi, dword [ebp - 0x2820]
mov edx, dword [ebp - 0x2824]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp + 0xc]
test eax, eax
je 0x433d74
push 0x400
push 0
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b6dc0
add esp, 0xc
push 0x516c20
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2830], eax
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x2830]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
call fcn.004b79a8
add esp, 0xc
lea edx, [ebp - 0xcb8]
mov dword [ebp - 0x2834], edx
mov eax, dword [ebp - 0x2834]
mov dword [ebp - 0x2838], eax
mov ecx, dword [ebp - 0x2834]
mov dl, byte [ecx]
mov byte [ebp - 0x2839], dl
add dword [ebp - 0x2834], 1
cmp byte [ebp - 0x2839], 0
jne 0x433cea
mov eax, dword [ebp - 0x2834]
sub eax, dword [ebp - 0x2838]
mov ecx, dword [ebp - 0x2838]
mov dword [ebp - 0x2840], ecx
mov dword [ebp - 0x2844], eax
lea edx, [ebp - 0x1cb8]
add edx, 0xffffffff
mov dword [ebp - 0x2848], edx
mov eax, dword [ebp - 0x2848]
mov cl, byte [eax + 1]
mov byte [ebp - 0x2849], cl
add dword [ebp - 0x2848], 1
cmp byte [ebp - 0x2849], 0
jne 0x433d35
mov edi, dword [ebp - 0x2848]
mov esi, dword [ebp - 0x2840]
mov edx, dword [ebp - 0x2844]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x2c], 0
je 0x433e63
push 0x400
push 0
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x516bc0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2850], eax
mov ecx, dword [ebp + 0x2c]
push ecx
mov edx, dword [ebp - 0x2850]
push edx
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b79a8
add esp, 0xc
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x2854], ecx
mov edx, dword [ebp - 0x2854]
mov dword [ebp - 0x2858], edx
mov eax, dword [ebp - 0x2854]
mov cl, byte [eax]
mov byte [ebp - 0x2859], cl
add dword [ebp - 0x2854], 1
cmp byte [ebp - 0x2859], 0
jne 0x433dd9
mov edx, dword [ebp - 0x2854]
sub edx, dword [ebp - 0x2858]
mov eax, dword [ebp - 0x2858]
mov dword [ebp - 0x2860], eax
mov dword [ebp - 0x2864], edx
lea ecx, [ebp - 0x1cb8]
add ecx, 0xffffffff
mov dword [ebp - 0x2868], ecx
mov edx, dword [ebp - 0x2868]
mov al, byte [edx + 1]
mov byte [ebp - 0x2869], al
add dword [ebp - 0x2868], 1
cmp byte [ebp - 0x2869], 0
jne 0x433e24
mov edi, dword [ebp - 0x2868]
mov esi, dword [ebp - 0x2860]
mov edx, dword [ebp - 0x2864]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x5a8], 1
jne 0x433f99
push 0x400
push 0
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x516b28
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2870], eax
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x2870]
push edx
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b79a8
add esp, 0xc
lea ecx, [ebp - 0xcb8]
mov dword [ebp - 0x2874], ecx
mov edx, dword [ebp - 0x2874]
mov dword [ebp - 0x2878], edx
mov eax, dword [ebp - 0x2874]
mov cl, byte [eax]
mov byte [ebp - 0x2879], cl
add dword [ebp - 0x2874], 1
cmp byte [ebp - 0x2879], 0
jne 0x433ece
mov edx, dword [ebp - 0x2874]
sub edx, dword [ebp - 0x2878]
mov eax, dword [ebp - 0x2878]
mov dword [ebp - 0x2880], eax
mov dword [ebp - 0x2884], edx
lea ecx, [ebp - 0x1cb8]
add ecx, 0xffffffff
mov dword [ebp - 0x2888], ecx
mov edx, dword [ebp - 0x2888]
mov al, byte [edx + 1]
mov byte [ebp - 0x2889], al
add dword [ebp - 0x2888], 1
cmp byte [ebp - 0x2889], 0
jne 0x433f19
mov edi, dword [ebp - 0x2888]
mov esi, dword [ebp - 0x2880]
mov edx, dword [ebp - 0x2884]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x400
push 0
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x516af0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2890], eax
mov ecx, dword [ebp - 0x2890]
push ecx
lea edx, [ebp - 0xcb8]
push edx
call fcn.004b79a8
add esp, 8
jmp 0x433fd8
push 0x400
push 0
lea eax, [ebp - 0xcb8]
push eax
call fcn.004b6dc0
add esp, 0xc
push 0x516ac0
call fcn.00404690
add esp, 4
mov dword [ebp - 0x2894], eax
mov ecx, dword [ebp - 0x2894]
push ecx
lea edx, [ebp - 0xcb8]
push edx
call fcn.004b79a8
add esp, 8
lea eax, [ebp - 0x1cb8]
mov dword [ebp - 0x2898], eax
mov ecx, dword [ebp - 0x2898]
add ecx, 1
mov dword [ebp - 0x289c], ecx
mov edx, dword [ebp - 0x2898]
mov al, byte [edx]
mov byte [ebp - 0x289d], al
add dword [ebp - 0x2898], 1
cmp byte [ebp - 0x289d], 0
jne 0x433ff3
mov ecx, dword [ebp - 0x2898]
sub ecx, dword [ebp - 0x289c]
mov dword [ebp - 0x28a4], ecx
mov edx, dword [ebp - 0x28a4]
mov dword [ebp - 0x1cbc], edx
lea eax, [ebp - 0xcb8]
mov dword [ebp - 0x28a8], eax
mov ecx, dword [ebp - 0x28a8]
add ecx, 1
mov dword [ebp - 0x28ac], ecx
mov edx, dword [ebp - 0x28a8]
mov al, byte [edx]
mov byte [ebp - 0x28ad], al
add dword [ebp - 0x28a8], 1
cmp byte [ebp - 0x28ad], 0
jne 0x43404a
mov ecx, dword [ebp - 0x28a8]
sub ecx, dword [ebp - 0x28ac]
mov dword [ebp - 0x28b4], ecx
mov edx, dword [ebp - 0x28b4]
mov dword [ebp - 0x20d4], edx
cmp dword [ebp - 0x5a8], 0
je 0x434196
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20d8], eax
cmp dword [ebp - 0x20d8], 0xffffffff
jne 0x4340ea
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x26f0]
mov eax, dword [edx + 0x1c]
call eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xcb
jmp 0x4343c7
push 0
mov edx, dword [ebp - 0x20d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1cc0], eax
cmp dword [ebp - 0x1cc0], 0xffffffff
jne 0x434112
mov dword [ebp - 0x1cc0], 0
cmp dword [ebp - 0x1cc0], 0x2ee000
jbe 0x434128
mov dword [ebp - 0x1cc0], 0
cmp dword [ebp - 0x1cc0], 0
je 0x434189
mov dword [ebp - 0x26e0], 0
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x20d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x26e0], eax
cmp dword [ebp - 0x26e0], 0
je 0x434189
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0x26e0]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1cc4], eax
mov edx, dword [ebp - 0x26e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1cbc]
add ecx, dword [ebp - 0x1cc0]
add ecx, dword [ebp - 0x20d4]
mov dword [ebp - 0x26dc], ecx
mov edx, dword [ebp - 0x26dc]
push edx
call fcn.004b7c73
add esp, 4
mov dword [ebp - 0x28b8], eax
mov eax, dword [ebp - 0x28b8]
mov dword [ebp - 0x26e4], eax
mov ecx, dword [ebp - 0x26e4]
mov dword [ebp - 0x20cc], ecx
mov edx, dword [ebp - 0x20cc]
mov dword [ebp - 0x20d0], edx
cmp dword [ebp - 0x20d0], 0
jne 0x4341fa
mov eax, 0xcc
jmp 0x4343c7
mov eax, dword [ebp - 0x1cbc]
push eax
lea ecx, [ebp - 0x1cb8]
push ecx
mov edx, dword [ebp - 0x20d0]
push edx
call fcn.004b6e40
add esp, 0xc
mov eax, dword [ebp - 0x20cc]
add eax, dword [ebp - 0x1cbc]
mov dword [ebp - 0x20cc], eax
cmp dword [ebp - 0x1cc4], 0
je 0x43426e
mov ecx, dword [ebp - 0x1cc0]
push ecx
mov edx, dword [ebp - 0x1cc4]
push edx
mov eax, dword [ebp - 0x20cc]
push eax
call fcn.004b6e40
add esp, 0xc
mov ecx, dword [ebp - 0x20cc]
add ecx, dword [ebp - 0x1cc0]
mov dword [ebp - 0x20cc], ecx
mov edx, dword [ebp - 0x1cc4]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x20d4]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
mov edx, dword [ebp - 0x20cc]
push edx
call fcn.004b6e40
add esp, 0xc
lea eax, [ebp - 0x26d8]
mov dword [ebp - 0x28bc], eax
mov ecx, dword [ebp - 0x28bc]
add ecx, 1
mov dword [ebp - 0x28c0], ecx
mov edx, dword [ebp - 0x28bc]
mov al, byte [edx]
mov byte [ebp - 0x28c1], al
add dword [ebp - 0x28bc], 1
cmp byte [ebp - 0x28c1], 0
jne 0x4342a6
mov ecx, dword [ebp - 0x28bc]
sub ecx, dword [ebp - 0x28c0]
mov dword [ebp - 0x28c8], ecx
mov edx, dword [ebp - 0x26dc]
push edx
mov eax, dword [ebp - 0x20d0]
push eax
mov ecx, dword [ebp - 0x28c8]
push ecx
lea edx, [ebp - 0x26d8]
push edx
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x26f0]
mov edx, dword [ecx + 0x24]
call edx
mov dword [ebp - 0x28cc], eax
cmp dword [ebp - 0x28cc], 0
je 0x43431d
mov dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x20d0], 0
je 0x434341
mov eax, dword [ebp - 0x20d0]
mov dword [ebp - 0x26e8], eax
mov ecx, dword [ebp - 0x26e8]
push ecx
call fcn.004b722a
add esp, 4
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x26f0]
mov ecx, dword [eax + 0x1c]
call ecx
jmp 0x434386
mov dword [ebp - 4], 0xffffffff
jmp 0x434397
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x26f0]
call fcn.0042f600
jmp 0x4343c1
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b6da3
mov esp, ebp
pop ebp
ret 0x404