Function at 0x10040381
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100611e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [esp + 0x44], edx
je 0x10040b64
xor ebx, ebx
mov dword [esp + 0xa8], 7
xor eax, eax
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], ax
mov dword [esp + 0x104], ebx
mov dword [esp + 0x1c], 0x252d
cmp dword [esp + 0x1c], 0x2760
jle 0x10040432
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0xc8]
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004040a
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push ebx
push 1
lea ecx, [esp + 0xd0]
call fcn.10005baf
inc edi
cmp edi, 0x7034
jl 0x100403ee
inc esi
cmp esi, 0x6ab4
jl 0x100403ec
cmp dword [esp + 0x1c], 0x2370
jge 0x10040447
push str.fzisaz_bpluveqo_sdn_vzbcelsf_fiw_pcoivvxup_xdmvalcn_vzkd_czjwfh_udv_hrksletg_jfnzbg
call fcn.10047752
pop ecx
push 0xfffffffffffffff8
pop esi
mov dword [esp + 0x104], ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0x3c], 0xc692
mov dword [esp + 0x18], esi
push 1
call fcn.100017ce
mov byte [esp + 0x104], 3
xor ecx, ecx
mov dword [esp + 0x2c], 0x2065c829
inc ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], 0x6ed9a830
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x38], ebx
jmp 0x100404a5
mov eax, dword [esp + 0x38]
mov dword [esp + eax*4 + 0x40], ecx
inc dword [esp + 0x38]
cmp dword [esp + 0x38], ecx
jl 0x10040499
push ebx
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x3c]
call fcn.10040c91
pop ecx
push 2
pop edi
cmp dword [esp + 0x3c], ebx
je 0x100405b4
mov dword [esp + 0x10], 8
xor edx, edx
mov dword [esp + 0x2c], 0xc47d1afd
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 0xc411
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x10], ebx
jmp 0x10040517
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xbc], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10040504
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x3c]
cmp eax, edx
mov eax, dword [esp + 0x58]
setge cl
mov dword [eax], ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setge dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x20], ebx
jne 0x1004056d
mov dword [esp + 0x2c], 0x627189e3
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x1c]
mov edx, 0x6f05c239
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x14]
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
jmp 0x100406a3
push edi
lea ecx, [esp + 0x74]
call fcn.100017ce
mov dword [esp + 0x3c], 0xa97cad95
mov dword [esp + 0x10], 0x9e9da123
mov dword [esp + 0x10], ebx
jmp 0x100405e7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0x89989a98
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100405d4
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, 4
mov esi, dword [esp + 0x70]
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
setl al
xor ecx, ecx
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x20]
setne cl
xor ebx, ebx
cmp eax, ecx
mov eax, dword [esp + 0x58]
setge bl
sub ebx, dword [eax]
mov eax, dword [esp + 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
test ebx, ebx
setg dl
xor ecx, ecx
imul edx, dword [esi + 4]
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0x8950
setg dl
xor ecx, ecx
add edx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x10]
neg ecx
sub ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x70]
call fcn.10001830
xor ebx, ebx
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x100406c4
push 0x677f
push 1
push ecx
push ecx
mov ecx, 0x4515
call fcn.1003faf5
add esp, 0x10
lea ecx, [esp + 0x58]
mov byte [esp + 0x104], bl
call fcn.10001830
push dword [esp + 0x44]
lea ecx, [esp + 0x98]
call fcn.10016fc1
mov dword [esp + 0x14], 0x799040c3
mov dword [esp + 0x10], 0xff93f8de
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x24], 0xffff
mov dword [esp + 0x14], ebx
jmp 0x1004071a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x30], 0xb064
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004070a
cmp dword [esp + 0x30], 0xe90a624c
mov eax, dword [esp + 0x34]
sbb ecx, ecx
inc ecx
neg eax
sbb eax, eax
inc eax
add eax, ecx
je 0x10040836
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
inc eax
lea ecx, [esp + 0x64]
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
push edi
call fcn.100017ce
mov dword [esp + 0x24], 0xd0c653dd
mov dword [esp + 0x10], ebx
jmp 0x1004078e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0xaffa898c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1004077b
cmp dword [esp + 0x34], ebx
jne 0x10040817
mov eax, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov ecx, 0x2f3f6085
setge dl
mov dword [esp + 0x14], edx
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
sub ecx, eax
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
setle dl
add ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esp + 0xac], edx
mov eax, dword [esp + 0x18]
lea ecx, [edx + 1]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x64]
setg dl
mov dword [eax], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x10040946
push 3
lea ecx, [esp + 0x80]
call fcn.100017ce
mov byte [esp + 0x104], 4
mov dword [esp + 0x20], 0xbdec7e1e
mov dword [esp + 0x14], ebx
jmp 0x1004086d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0xb54c5f6b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004085a
mov dword [esp + 0x14], 0xd
jmp 0x100408ed
push 1
push 0x2cf
push 0x4618
mov dl, 1
push 0x408d
push 0x664a
mov cl, dl
call fcn.1003fb4d
mov dword [esp + 0x24], 1
add esp, 0x14
cmp dword [esp + 0x10], ebx
jl 0x100408e9
push 0x2d42
push 1
push ecx
push 0x1b99
push 0x384
push ecx
mov ecx, 0x179e
call fcn.10040181
add esp, 0x18
push 0x7c2b
push ecx
push ebx
push ecx
mov ecx, 0x6f17
call fcn.100401e2
add esp, 0x10
dec dword [esp + 0x10]
jns 0x100408ae
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x18
jl 0x1004087e
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
je 0x10040922
cmp dword [esp + 0x18], ebx
jne 0x10040922
mov eax, ebx
jmp 0x10040925
xor eax, eax
inc eax
mov edx, dword [esp + 0x20]
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x104], bl
call fcn.10001830
mov dword [esp + 0x18], ebx
jmp 0x100409ac
push 3
lea ecx, [esp + 0x50]
call fcn.100017ce
lea eax, [esp + 0x4c]
mov byte [esp + 0x104], 5
push eax
lea eax, [esp + 0xc4]
push eax
push 1
call fcn.1003faa2
add esp, 0xc
mov dl, 1
push 0x20d3
push ecx
lea ecx, [esp + 0x54]
call fcn.10040c6d
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov byte [esp + 0x104], bl
lea ecx, [esp + 0x4c]
cmp dword [esp + eax*4 + 0x30], ebx
jne 0x100409b5
call fcn.10001830
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x10040951
jmp 0x100409ba
call fcn.10001830
mov eax, dword [0x1007f660]
test al, 1
jne 0x100409eb
or eax, 1
mov dword [0x1007f660], eax
push 0x1b98
mov byte [esp + 0x108], 6
call fcn.10016d29
pop ecx
mov word [0x10080a08], ax
mov byte [esp + 0x104], bl
mov esi, dword [esp + 0x44]
test esi, esi
je 0x10040a0e
push 0x10080a08
push ecx
push 1
push ecx
lea ecx, [esp + 0xa4]
call fcn.100401e2
add esp, 0x10
dec esi
jne 0x100409f3
push edi
lea ecx, [esp + 0x8c]
call fcn.100017ce
mov byte [esp + 0x104], 7
mov dword [esp + 0x1c], 0x928
cmp dword [esp + 0x1c], 0xa7b
jle 0x10040abe
mov esi, ebx
mov ebx, esi
mov dword [esp + 0x20], 0x7db3
xor edi, edi
mov eax, ebx
lea ecx, [esp + 0xe0]
xor eax, edi
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10040a64
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push 1
lea ecx, [esp + 0xe8]
call fcn.10005baf
inc edi
cmp edi, 0x44f5
jl 0x10040a47
dec ebx
dec dword [esp + 0x20]
jne 0x10040a45
inc esi
cmp esi, 0x5b0
jl 0x10040a3b
push 0x8b6
push 0x235f
push 0x1866
push 0x22ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
xor ebx, ebx
mov dword [esp + 0x48], 0xdf2f4a8b
cmp dword [esp + 0x1c], 0x7b3
jge 0x10040adb
push str.glwwnoff_oxe_krgbjwu_aervyig_cgcr_mtpoufzg_lcpmnl_xnd
call fcn.10047752
pop ecx
push ecx
lea eax, [esp + 0x8c]
mov dword [esp + 0x108], 7
push eax
push 1
push 0x32e
push 0x1d7c
lea edx, [esp + 0xd8]
call fcn.1004031b
add esp, 0x14
lea eax, [esp + 0x48]
mov edx, 0x5bc8
lea ecx, [esp + 0x88]
push eax
push ebx
push 0x2d51
call fcn.10040cec
add esp, 0xc
mov byte [esp + 0x104], bl
lea ecx, [esp + 0x88]
call fcn.10001830
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x94]
cmp ecx, eax
je 0x10040b53
push 0xffffffffffffffff
push ebx
push eax
call fcn.1000689c
push ebx
push 1
lea ecx, [esp + 0x9c]
call fcn.10005c7b
jmp 0x10040b6c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret