Function at 0x41bb78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
mov eax, dword [0x48d2b0]
cmp byte [eax], 0
je 0x41bbc1
cmp bl, 0xff
je 0x41bbc1
cmp bl, 0xfe
je 0x41bbc1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, ebx
call fcn.0041b7b4
mov byte [ebp - 9], al
jmp 0x41bec8
test bl, bl
jge 0x41bda2
movsx eax, bl
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x48d8cc]
cmp word [edx + eax*2 + 0x218], 0
je 0x41bec8
mov eax, dword [ebp - 8]
dec eax
mov ecx, 0x7f
cdq
idiv ecx
inc eax
mov word [ebp - 0x1e], ax
mov ax, word [ebp - 0x1e]
test ax, ax
jbe 0x41bd97
mov word [ebp - 0x22], ax
mov si, 1
movsx eax, bl
push eax
push 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowWord
cmp si, word [ebp - 0x1e]
jae 0x41bc2e
mov edi, 0x7f
jmp 0x41bc3d
mov eax, dword [ebp - 8]
dec eax
mov ecx, 0x7f
cdq
idiv ecx
mov edi, edx
inc edi
push edi
push 2
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowWord
movzx eax, si
dec eax
mov edx, eax
shl eax, 7
sub eax, edx
add eax, dword [ebp - 4]
push eax
mov eax, dword [0x48d568]
movzx eax, word [eax]
push eax
mov eax, dword [0x48d2b0]
movzx eax, byte [eax]
mov edx, eax
shl eax, 3
sub eax, edx
add eax, 0x401
push eax
mov eax, dword [0x48d884]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x41bd62
mov edx, dword [0x48d2b0]
cmp byte [edx], 0
jne 0x41bcdb
movsx edx, bl
mov ecx, dword [0x48d9a0]
movzx edx, word [ecx + edx*2 + 0x4c]
imul edx, edi
push edx
movsx edx, bl
mov ecx, dword [0x48d9a0]
movzx edx, word [ecx + edx*2 + 0x4c]
movzx ecx, si
dec ecx
mov edi, ecx
shl ecx, 7
sub ecx, edi
imul edx, ecx
add edx, dword [ebp + 0xc]
xchg edx, eax
pop ecx
call fcn.00405a94
mov byte [ebp - 0x20], 1
jmp 0x41bd66
push 0
mov eax, dword [0x48d7f0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll__lopen
mov dword [ebp - 0x1c], eax
movsx eax, bl
mov edx, dword [0x48d9a0]
movzx eax, word [edx + eax*2 + 0x4c]
imul edi
push eax
movsx eax, bl
mov edx, dword [0x48d9a0]
movzx eax, word [edx + eax*2 + 0x4c]
movzx edx, si
dec edx
mov ecx, edx
shl edx, 7
sub edx, ecx
imul edx
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll__lread
mov edx, dword [0x48d498]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x48d7f0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
movsx eax, bl
mov edx, dword [0x48d9a0]
movzx eax, word [edx + eax*2 + 0x4c]
imul edi
mov edx, dword [0x48d498]
cmp eax, dword [edx]
sete byte [ebp - 0x20]
jmp 0x41bd66
mov byte [ebp - 0x20], 0
mov eax, dword [0x48d2b0]
cmp byte [eax], 0
jne 0x41bd86
push 0
push 0
push 0x402
mov eax, dword [0x48d884]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebp - 0x20], 0
je 0x41bd97
inc esi
dec word [ebp - 0x22]
jne 0x41bc0e
mov al, byte [ebp - 0x20]
mov byte [ebp - 9], al
jmp 0x41bec8
movsx edi, bl
mov eax, dword [0x48d340]
cmp byte [eax + edi - 1], 4
jne 0x41bdef
lea edx, [ebp - 0x1f]
mov eax, ebx
call fcn.0041a178
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x48d9a0]
movzx eax, word [eax + edi*2 + 0x4c]
imul dword [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x1f]
mov edx, dword [0x48d77c]
mov eax, dword [edx + eax*4 - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00419c2c
mov byte [ebp - 9], al
jmp 0x41bec8
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x48c2d0
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x41bec8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x13], eax
mov ax, word [ebp - 8]
mov word [ebp - 0xf], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd], eax
mov eax, dword [0x48d340]
cmp byte [eax + edi - 1], 3
jge 0x41be79
dec ebx
movsx eax, bl
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xffff
lea eax, [ebp - 0x13]
mov dword [ebp - 0x40], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 2
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x41be6e
test byte [ebp - 0x28], 1
je 0x41be72
xor eax, eax
jmp 0x41be74
mov al, 1
mov byte [ebp - 9], al
jmp 0x41bec2
mov dword [ebp - 0x34], 0x7305
lea eax, [ebp - 0x13]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 6
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x41beb9
test byte [ebp - 0x28], 1
je 0x41bebd
xor eax, eax
jmp 0x41bebf
mov al, 1
mov byte [ebp - 9], al
push esi
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8