Function at 0x438620
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5365f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24], eax
cmp dword [eax], ebx
je 0x4386dc
add eax, 8
mov dword [ebp - 0x2c], eax
cmp dword [eax], ebx
je 0x4386dc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 7
lea edi, [ebp - 0x1c]
call fcn.00438a60
test eax, eax
jne 0x4386f2
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x4386a0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x4386b3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4386c6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4386dc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x14]
xor edi, edi
call fcn.004d1450
add esp, 4
test al, al
je 0x4389aa
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
call fcn.00438c10
test eax, eax
je 0x4389aa
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push edx
call fcn.00438c10
test eax, eax
je 0x4389aa
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jbe 0x4389aa
lea esi, [ebp - 0x20]
mov eax, 0x5056a8
lea ebx, [ebp - 0x14]
call fcn.004d1550
test al, al
je 0x4389a8
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
xor esi, esi
cmp eax, esi
jl 0x438953
cmp dword [ebp - 0x10], esi
je 0x438953
lea ebx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esi
call fcn.004d24e0
test al, al
je 0x43892a
mov ebx, dword [ebp - 0x18]
push str.CONFIGFOLDERPATH
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.CONFIGVERSION
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.AEADMINS
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.AETRUSTEDUSERS
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.LOGMODE
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.KBMOUSEMODE
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.APPLICATIONS
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.PUBLISHERS
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.POLICYINITIALIZER
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.DFCOMPATIBILITYMODE
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.SYSTEMPROCESSES
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
je 0x438921
push str.ALERTMODE
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
jne 0x4388b2
lea edi, [ebp - 0x14]
call fcn.00438020
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.00437de0
jmp 0x438921
push 0x512050
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
jne 0x4388d5
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
call fcn.00437a30
jmp 0x438921
push str.LICENSEINFO
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
jne 0x4388f4
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
call fcn.00438260
jmp 0x438921
push str.PROTECTION
push ebx
call fcn.004d5750
add esp, 8
test eax, eax
jne 0x438914
mov eax, dword [ebp - 0x24]
push eax
lea edi, [ebp - 0x10]
call fcn.00437720
jmp 0x438921
mov edx, dword [ebp - 0x24]
push ebx
lea ecx, [ebp - 0x10]
push ecx
call fcn.0042bc60
push ebx
call fcn.004d632b
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x43893c
mov dword [ebp - 0x10], esi
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
cmp eax, esi
jge 0x438775
mov ebx, dword [ebp - 0x24]
push ebx
lea edi, [ebp - 0x1c]
call fcn.0042c030
mov ecx, ebx
call fcn.0042aac0
test eax, eax
je 0x43897e
mov ecx, ebx
call fcn.0042a030
test eax, eax
je 0x43897e
mov esi, ebx
call fcn.0042cb10
xor esi, esi
lea ebx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00438ae0
cmp eax, esi
je 0x4389a3
mov esi, dword [ebp - 0x18]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x4389bc
mov dword [ebp - 0x10], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x4389ce
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4389e0
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4389f2
mov dword [ebp - 0x1c], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x438a05
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x438a18
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x438a2b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x438a41
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4