Function at 0x4067e0
Capabilities:
Delete file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x445776
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
mov eax, dword [0x45bb34]
push edi
mov edi, ecx
mov dword [esp + 0x208], eax
mov eax, dword [edi + 0xf74]
test eax, eax
mov dword [esp + 8], edi
je 0x406834
push eax
call fcn.00404d80
test al, al
je 0x406834
mov eax, dword [edi + 0xf74]
push eax
mov ecx, edi
call fcn.00404ea0
test al, al
jne 0x40683b
xor al, al
jmp 0x407288
mov ecx, dword [edi + 0xf8c]
mov edx, dword [edi + 0xf98]
mov eax, dword [edi + 0xf80]
push ebx
lea ebx, [edx + ecx]
push esi
add ebx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 0
lea eax, [edi + 0xf58]
mov esi, 0x40
push ebp
lea esp, [esp]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x406883
cmp dword [eax], 0
jne 0x406883
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x406891
mov edx, dword [eax + 0xc]
mov ebp, dword [eax - 0x10]
mov ecx, dword [eax]
add ebp, edx
add ebp, ecx
add ebx, ebp
sub eax, 0x2c
dec esi
jne 0x406870
mov eax, dword [edi + 0xf7c]
mov esi, dword [eax]
cmp esi, eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
je 0x40695e
fild dword [esp + 0x24]
mov ecx, ebx
test ecx, ecx
jge 0x4068bf
fadd dword [0x448378]
mov ebp, dword [esp + 0x1c]
fstp dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
jmp 0x4068d0
test ebp, ebp
mov dword [esp + 0x10], ebp
fild dword [esp + 0x10]
jge 0x4068e2
fadd dword [0x448378]
fdiv dword [esp + 0x18]
mov edi, dword [ebx + 0x70]
inc ebp
test edi, edi
fmul dword [0x448374]
je 0x406913
lea edx, [esp + 0x20]
push edx
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x406915
fstp st(0)
cmp dword [esi + 0x40], 0x10
lea edi, [esi + 0x2c]
jb 0x406922
mov eax, dword [edi]
jmp 0x406924
mov eax, edi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x40], 0x10
jb 0x406938
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x28]
call fcn.00403b00
mov eax, dword [ebx + 0xf7c]
mov esi, dword [esp + 0x28]
cmp esi, eax
jne 0x4068d0
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xf88]
mov esi, dword [eax]
cmp esi, eax
je 0x406a66
mov ecx, dword [esp + 0x24]
fild dword [esp + 0x24]
test ecx, ecx
jge 0x406984
fadd dword [0x448378]
mov ebx, dword [esp + 0x14]
fstp dword [esp + 0x18]
lea esp, [esp]
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test eax, eax
jge 0x4069a2
fadd dword [0x448378]
fdiv dword [esp + 0x18]
mov edi, dword [ebx + 0x70]
inc eax
test edi, edi
mov dword [esp + 0x1c], eax
fmul dword [0x448374]
je 0x4069d7
lea edx, [esp + 0x20]
push edx
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x4069d9
fstp st(0)
mov eax, dword [esi + 0x40]
cmp eax, 0x10
lea edi, [esi + 0x28]
lea ebp, [edi + 4]
jb 0x4069ec
mov eax, dword [ebp]
jmp 0x4069ee
mov eax, ebp
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [edi + 0x18], 0x10
jb 0x406a03
mov ebp, dword [ebp]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov ecx, ebx
call fcn.00406090
mov al, byte [esi + 0x61]
test al, al
jne 0x406a5a
mov eax, dword [esi + 8]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406a3d
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406a5a
mov edi, edi
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x406a30
jmp 0x406a5a
mov eax, dword [esi + 4]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406a58
cmp esi, dword [eax + 8]
jne 0x406a58
mov esi, eax
mov eax, dword [eax + 4]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x406a47
mov esi, eax
cmp esi, dword [ebx + 0xf88]
jne 0x406990
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xf94]
mov esi, dword [eax]
cmp esi, eax
je 0x406b4a
mov ecx, dword [esp + 0x24]
fild dword [esp + 0x24]
test ecx, ecx
jge 0x406a8c
fadd dword [0x448378]
mov ebp, dword [esp + 0x1c]
fstp dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
jmp 0x406aa0
test ebp, ebp
mov dword [esp + 0x10], ebp
fild dword [esp + 0x10]
jge 0x406ab2
fadd dword [0x448378]
fdiv dword [esp + 0x18]
mov edi, dword [ebx + 0x70]
inc ebp
test edi, edi
fmul dword [0x448374]
je 0x406ae3
lea edx, [esp + 0x20]
push edx
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x406ae5
fstp st(0)
lea eax, [esi + 0x28]
push eax
mov ecx, ebx
call fcn.00406090
mov al, byte [esi + 0x61]
test al, al
jne 0x406b3a
mov eax, dword [esi + 8]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406b1d
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406b3a
lea esp, [esp]
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x406b10
jmp 0x406b3a
mov eax, dword [esi + 4]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x406b38
cmp esi, dword [eax + 8]
jne 0x406b38
mov esi, eax
mov eax, dword [eax + 4]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x406b27
mov esi, eax
cmp esi, dword [ebx + 0xf94]
jne 0x406aa0
mov dword [esp + 0x1c], ebp
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x14]
mov edi, 0x3f
mov dword [esp + 0x28], edi
lea ecx, [ecx]
mov ecx, edi
imul ecx, ecx, 0x2c
lea ebx, [ecx + eax]
mov ecx, dword [ebx + 0x49c]
test ecx, ecx
mov dword [esp + 0x2c], ebx
jne 0x406b8e
mov ecx, dword [ebx + 0x484]
test ecx, ecx
jne 0x406b8e
mov ecx, dword [ebx + 0x490]
test ecx, ecx
je 0x407278
mov eax, dword [eax + 0x70]
test eax, eax
je 0x406bae
lea edx, [esp + 0x20]
push edx
push 0xa
push 2
push 0
push 0
push 0x5400
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push edi
push str.data_d.dat
lea eax, [esp + 0xc4]
push 0x40
push eax
call fcn.0042adae
push edi
push str.data_d.dat.bak
lea ecx, [esp + 0x94]
push 0x40
push ecx
call fcn.0042adae
add esp, 0x20
push 0x80
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x7c]
push eax
call esi
push 1
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xc4]
push edx
call fcn.00409fa0
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [esp + 0x18], edi
je 0x4072aa
mov esi, dword [ebx + 0x49c]
mov eax, dword [ebx + 0x474]
mov edx, dword [ebx + 0x490]
mov ecx, dword [ebx + 0x484]
sub eax, esi
add eax, edx
add eax, ecx
push 2
add eax, eax
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.0040b5e0
add esp, 0x10
test eax, eax
mov dword [esp + 0x34], eax
je 0x4072aa
lea eax, [esp + 0xfc]
push eax
push 0x448360
push edi
mov esi, 1
call fcn.0040b450
add esp, 0xc
test eax, eax
mov dword [esp + 0x30], eax
je 0x406fa8
test esi, esi
je 0x406fa4
mov edi, str._list_
lea esi, [esp + 0xfc]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x406f7f
mov edi, str._sign_
lea esi, [esp + 0xfc]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x406f7f
mov edi, str._attr_
lea esi, [esp + 0xfc]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x406f7f
xor edi, edi
lea eax, [esp + 0xfc]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], edi
mov byte [esp + 0x40], 0
lea edx, [eax + 1]
jmp 0x406d00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406d00
sub eax, edx
push eax
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0x44]
call fcn.00403f90
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x3c]
add esi, 0x494
push ecx
mov ecx, esi
mov dword [esp + 0x224], edi
call fcn.00405610
mov ebp, dword [esi + 4]
cmp eax, ebp
mov dword [esp + 0x38], eax
je 0x406da4
mov ecx, dword [eax + 0x24]
mov ebx, dword [eax + 0x20]
mov esi, 0x10
cmp ecx, esi
jb 0x406d57
mov eax, dword [eax + 0x10]
jmp 0x406d5a
add eax, 0x10
mov ecx, dword [esp + 0x50]
cmp ecx, ecx
mov edx, ecx
jae 0x406d64
cmp edx, edi
je 0x406d8f
cmp edx, ebx
mov ecx, edx
jb 0x406d70
mov ecx, ebx
cmp dword [esp + 0x54], esi
mov esi, dword [esp + 0x40]
jae 0x406d7e
lea esi, [esp + 0x40]
mov edi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x406d8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406d9c
cmp edx, ebx
jb 0x406da4
xor eax, eax
cmp edx, ebx
setne al
test eax, eax
jl 0x406da4
lea eax, [esp + 0x38]
jmp 0x406dac
mov dword [esp + 0x78], ebp
lea eax, [esp + 0x78]
mov edx, dword [eax]
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x10], edx
mov dword [esp + 0x220], 0xffffffff
jb 0x406dd1
mov eax, dword [esp + 0x40]
push eax
call fcn.0043c53e
add esp, 4
mov eax, 0xf
xor ecx, ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0xfc]
mov dword [esp + 0x50], ecx
mov byte [esp + 0x40], cl
mov dword [esp + 0x6c], ecx
mov byte [esp + 0x5c], cl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406e00
sub eax, edx
push eax
lea ecx, [esp + 0x100]
push ecx
lea ecx, [esp + 0x60]
call fcn.00403f90
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x58]
add esi, 0x488
push edx
mov ecx, esi
mov dword [esp + 0x224], 1
call fcn.00405610
mov ebp, dword [esi + 4]
cmp eax, ebp
mov dword [esp + 0x38], eax
je 0x406ea3
cmp dword [eax + 0x24], 0x10
mov ebx, dword [eax + 0x20]
jb 0x406e55
mov eax, dword [eax + 0x10]
jmp 0x406e58
add eax, 0x10
mov ecx, dword [esp + 0x6c]
cmp ecx, ecx
mov edx, ecx
jae 0x406e62
test edx, edx
je 0x406e8e
cmp edx, ebx
mov ecx, edx
jb 0x406e6e
mov ecx, ebx
cmp dword [esp + 0x70], 0x10
mov esi, dword [esp + 0x5c]
jae 0x406e7d
lea esi, [esp + 0x5c]
mov edi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x406e8a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406e9b
cmp edx, ebx
jb 0x406ea3
xor eax, eax
cmp edx, ebx
setne al
test eax, eax
jl 0x406ea3
lea eax, [esp + 0x38]
jmp 0x406eab
mov dword [esp + 0x74], ebp
lea eax, [esp + 0x74]
mov esi, dword [eax]
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x220], 0xffffffff
jb 0x406ecc
mov eax, dword [esp + 0x5c]
push eax
call fcn.0043c53e
add esp, 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [eax + 0x498]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
jne 0x406f7f
cmp esi, dword [eax + 0x48c]
jne 0x406f7f
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test eax, eax
jge 0x406f13
fadd dword [0x448378]
mov edx, dword [esp + 0x24]
fild dword [esp + 0x24]
test edx, edx
jge 0x406f25
fadd dword [0x448378]
fdivp st(1)
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x70]
inc eax
test esi, esi
mov dword [esp + 0x1c], eax
fmul dword [0x448374]
je 0x406f5c
lea eax, [esp + 0x20]
push eax
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x406f5e
fstp st(0)
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x100]
push edx
push eax
mov ecx, edi
call fcn.00405db0
test al, al
je 0x4072aa
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xfc]
push ecx
push edx
call fcn.0040b540
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x34]
add esp, 8
movzx esi, al
jmp 0x406c85
mov eax, dword [esp + 0x30]
push eax
call fcn.0040b590
push edi
call fcn.0040a570
mov eax, dword [ebx + 0x48c]
mov ebp, dword [eax]
add esp, 8
cmp ebp, eax
mov dword [esp + 0x30], eax
je 0x407107
mov eax, dword [esp + 0x24]
fild dword [esp + 0x24]
test eax, eax
jge 0x406fdd
fadd dword [0x448378]
fstp dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test eax, eax
jge 0x406ff3
fadd dword [0x448378]
fdiv dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0x70]
inc eax
test esi, esi
mov dword [esp + 0x1c], eax
fmul dword [0x448374]
je 0x40702c
lea edx, [esp + 0x20]
push edx
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x40702e
fstp st(0)
mov edx, dword [ebp + 0x3c]
mov eax, edx
cmp eax, edx
jae 0x407037
test edx, edx
je 0x407086
cmp edx, 9
mov ecx, edx
jb 0x407047
mov ecx, 9
cmp dword [ebp + 0x40], 0x10
jb 0x407052
mov esi, dword [ebp + 0x2c]
jmp 0x407055
lea esi, [ebp + 0x2c]
mov edi, str._version_
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x407065
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407086
cmp edx, 9
jb 0x407086
cmp edx, 9
setne al
test eax, eax
jne 0x407086
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x407086
mov dword [esp + 0x30], ebp
jmp 0x4070b2
cmp dword [ebp + 0x40], 0x10
jb 0x407091
mov eax, dword [ebp + 0x2c]
jmp 0x407094
lea eax, [ebp + 0x2c]
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xf74]
push eax
push edx
call fcn.00405db0
test al, al
je 0x4072aa
mov al, byte [ebp + 0x61]
test al, al
jne 0x4070fb
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4070de
mov ebp, eax
mov eax, dword [ebp]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4070fb
nop
mov ebp, eax
mov eax, dword [ebp]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x4070d0
jmp 0x4070fb
mov eax, dword [ebp + 4]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4070f9
cmp ebp, dword [eax + 8]
jne 0x4070f9
mov ebp, eax
mov eax, dword [eax + 4]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x4070e8
mov ebp, eax
cmp ebp, dword [ebx + 0x48c]
jne 0x406fe1
mov eax, dword [ebx + 0x480]
mov esi, dword [eax]
cmp esi, eax
je 0x407203
mov eax, dword [esp + 0x24]
fild dword [esp + 0x24]
test eax, eax
jge 0x407129
fadd dword [0x448378]
fstp dword [esp + 0x18]
lea ecx, [ecx]
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test eax, eax
jge 0x407142
fadd dword [0x448378]
fdiv dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov edi, dword [ebp + 0x70]
inc eax
test edi, edi
mov dword [esp + 0x1c], eax
fmul dword [0x448374]
je 0x40717b
lea ecx, [esp + 0x20]
push ecx
push 0xa
push 2
push 0
call fcn.00429ff0
push eax
push 0x5400
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
jmp 0x40717d
fstp st(0)
cmp dword [esi + 0x40], 0x10
jb 0x407188
mov eax, dword [esi + 0x2c]
jmp 0x40718b
lea eax, [esi + 0x2c]
mov edx, dword [esp + 0x34]
push edx
push eax
mov eax, dword [ebp + 0xf74]
push eax
mov ecx, ebp
call fcn.00405db0
test al, al
je 0x4072aa
mov al, byte [esi + 0x61]
test al, al
jne 0x4071f3
mov eax, dword [esi + 8]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4071d0
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4071f3
mov esi, eax
mov eax, dword [esi]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x4071c3
jmp 0x4071f3
mov eax, dword [esi + 4]
mov cl, byte [eax + 0x61]
test cl, cl
jne 0x4071f1
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x4071f1
mov esi, eax
mov eax, dword [eax + 4]
mov cl, byte [eax + 0x61]
test cl, cl
je 0x4071e0
mov esi, eax
mov ecx, dword [esp + 0x2c]
cmp esi, dword [ecx + 0x480]
jne 0x407130
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp eax, dword [edx + 0x48c]
je 0x40723b
cmp dword [eax + 0x40], 0x10
jb 0x40721e
mov eax, dword [eax + 0x2c]
jmp 0x407221
add eax, 0x2c
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xf74]
push eax
push edx
call fcn.00405db0
test al, al
je 0x4072aa
mov eax, dword [esp + 0x34]
push eax
call fcn.0040a570
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
lea ecx, [esp + 0xbc]
push ecx
call esi
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x80]
push eax
call fcn.0042b3f3
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x30]
add esp, 8
dec edi
mov dword [esp + 0x28], edi
jns 0x406b60
mov al, 1
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x208]
pop edi
call fcn.004296f9
add esp, 0x214
ret
xor al, al
jmp 0x407285