Function at 0x41c0dd
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x88
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocString
push dword [ebp + 0x70]
mov dword [ebp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c115
xor eax, eax
jmp 0x41c437
mov eax, dword [0x453170]
push esi
push ebx
push edi
mov dword [ebp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push ebx
lea eax, [ebp + 0x18]
push eax
push esi
lea eax, [esi + 1]
push eax
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0x18], ebx
call fcn.00401e78
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp + 0x4c]
call fcn.00401ead
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 0x4c]
cmp dword [esi - 8], ebx
je 0x41c19b
lea ecx, [ebp - 0x20]
call fcn.004050be
push 0xfde9
push dword [esi - 8]
lea ecx, [ebp - 0x20]
push esi
call fcn.0040397a
cmp dword [ebp + 4], ebx
lea ecx, [ebp - 0x20]
jne 0x41c18f
call fcn.00404c24
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0x58], edi
jne 0x41c1a3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4474c4
call fcn.00404b4d
lea ecx, [esi - 0xc]
jmp 0x41c427
push str.FileTypeAsso
lea esi, [edi + 0x14]
push esi
call fcn.00404658
test al, al
je 0x41c43e
push 0xffffffffffffffff
push 0
mov ecx, 0x453420
call fcn.00417e72
push 0xffffffffffffffff
push 0
mov ecx, 0x4537c8
call fcn.004023fe
mov eax, dword [ebp + 0x78]
push 0x4407e0
mov ecx, edi
mov dword [eax], 0xd
call fcn.00404c7a
test eax, eax
mov ebx, 0x447c00
je 0x41c326
mov ecx, eax
call fcn.00404c24
mov esi, eax
jmp 0x41c31e
mov eax, dword [0x453170]
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], eax
push ebx
lea eax, [ebp + 0x60]
push eax
mov ecx, esi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
add esp, 0xc
push eax
lea ecx, [ebp + 0x40]
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c24c
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c25f
call fcn.004013ad
push 0x4407dc
lea eax, [ebp + 0x50]
push eax
mov ecx, esi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.0040276d
add esp, 0xc
push eax
lea ecx, [ebp + 0x44]
call fcn.00401b73
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c29c
call fcn.004013ad
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c2af
call fcn.004013ad
push str.icon
lea eax, [ebp + 0x5c]
push eax
mov ecx, esi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0040276d
add esp, 0xc
push eax
lea ecx, [ebp + 0x48]
call fcn.00401b73
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c2ec
call fcn.004013ad
mov ecx, dword [ebp + 0x5c]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c2ff
call fcn.004013ad
lea eax, [ebp + 0x40]
push eax
mov ecx, 0x453420
call fcn.0041a4f0
mov ecx, esi
call fcn.00404c4f
lea ecx, [ebp + 0x40]
mov esi, eax
call fcn.0041d68a
test esi, esi
jne 0x41c205
push str.unreg
mov ecx, edi
call fcn.00404c7a
test eax, eax
je 0x41c39e
mov ecx, eax
call fcn.00404c24
mov esi, eax
jmp 0x41c39a
push ebx
lea eax, [ebp + 0x64]
push eax
mov ecx, esi
call fcn.00404d78
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp + 0x54]
push eax
call fcn.0040276d
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
add esp, 0xc
cmp ecx, dword [0x453174]
je 0x41c370
call fcn.004013ad
lea eax, [ebp + 0x54]
push eax
mov ecx, 0x4537c8
call fcn.00408d5a
mov ecx, esi
call fcn.00404c4f
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
mov esi, eax
je 0x41c39a
call fcn.004013ad
test esi, esi
jne 0x41c341
mov esi, 0x453444
mov ecx, esi
call fcn.00401b49
push str.ttpModule
mov ecx, edi
call fcn.00404c7a
test eax, eax
je 0x41c409
push str.file
lea ecx, [ebp + 0x60]
push ecx
mov ecx, eax
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
mov ecx, esi
add esp, 0xc
push eax
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c3f6
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c409
call fcn.004013ad
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4474c4
call fcn.00404b4d
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c434
call fcn.004013ad
xor eax, eax
pop esi
pop edi
pop ebx
add ebp, 0x68
leave
ret
push str.AdProcessInfo
push esi
call fcn.00404658
test al, al
je 0x41c53a
mov eax, dword [ebp + 0x78]
mov dword [eax], 0xa
push str.type
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e8ed
mov esi, dword [ebp + 0x74]
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi], eax
cmp ecx, dword [0x453174]
je 0x41c48a
call fcn.004013ad
push str.elapse
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e8ed
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 4], eax
cmp ecx, dword [0x453174]
je 0x41c4b8
call fcn.004013ad
push 0x44079c
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e8ed
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0x14], eax
cmp ecx, dword [0x453174]
je 0x41c4e6
call fcn.004013ad
push 0x440798
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e8ed
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0x18], eax
cmp ecx, dword [0x453174]
je 0x41c514
call fcn.004013ad
push 0x44811c
lea eax, [ebp + 0x60]
push eax
mov ecx, edi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
lea ecx, [esi + 0x1c]
jmp 0x41c3da
push str.RecomUpdate
push esi
call fcn.00404658
test al, al
je 0x41c7d4
push str.title
lea eax, [ebp + 0x60]
push eax
mov ecx, edi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
mov esi, dword [ebp + 0x74]
add esp, 0xc
push eax
lea ecx, [esi + 0x20]
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c58d
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c5a0
call fcn.004013ad
push str.message
lea eax, [ebp + 0x60]
push eax
mov ecx, edi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
add esp, 0xc
push eax
lea ecx, [esi + 0x24]
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c5dd
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c5f0
call fcn.004013ad
push str.cfgmsg
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0x10], eax
cmp ecx, dword [0x453174]
je 0x41c61e
call fcn.004013ad
push str.wparam
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 8], eax
cmp ecx, dword [0x453174]
je 0x41c64c
call fcn.004013ad
push str.lparam
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0xc], eax
cmp ecx, dword [0x453174]
je 0x41c67a
call fcn.004013ad
push 0x44079c
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0x14], eax
cmp ecx, dword [0x453174]
je 0x41c6a8
call fcn.004013ad
push 0x440798
lea eax, [ebp + 0x64]
push eax
mov ecx, edi
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
mov dword [esi + 0x18], eax
cmp ecx, dword [0x453174]
je 0x41c6d6
call fcn.004013ad
mov ebx, 0x45343c
mov ecx, ebx
call fcn.00401b49
mov edi, 0x453440
mov ecx, edi
call fcn.00401b49
mov ecx, dword [ebp + 0x58]
push str.version
lea eax, [ebp + 0x60]
push eax
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
add esp, 0xc
push eax
mov ecx, edi
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c72b
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c73e
call fcn.004013ad
mov ecx, dword [ebp + 0x58]
push str.bduss
lea eax, [ebp + 0x60]
push eax
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.0040276d
add esp, 0xc
push eax
mov ecx, ebx
call fcn.00401b73
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c77b
call fcn.004013ad
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c78e
call fcn.004013ad
mov ecx, dword [ebp + 0x58]
push 0x440760
push str.bhtml
lea eax, [ebp + 0x64]
push eax
call fcn.00404d78
push eax
call fcn.00404658
mov ecx, dword [ebp + 0x64]
neg al
sbb eax, eax
neg eax
add ecx, 0xfffffff4
mov dword [esi + 0x28], eax
cmp ecx, dword [0x453174]
je 0x41c7c6
call fcn.004013ad
mov eax, dword [ebp + 0x78]
mov dword [eax], 0xc
jmp 0x41c409
push str.setuppackinfo
push esi
call fcn.00404658
test al, al
je 0x41c409
mov eax, dword [ebp + 0x78]
and dword [ebp + 0x54], 0
mov ecx, edi
mov dword [eax], 0xe
call fcn.00404c24
mov ebx, eax
test ebx, ebx
je 0x41cb5a
and dword [ebp + 0x58], 0
mov esi, dword [ebp + 0x7c]
lea eax, [ebx + 0x14]
push eax
lea ecx, [ebp + 0x50]
call fcn.00401e1e
push str.proxy
push dword [ebp + 0x50]
call fcn.0042e3e3
test eax, eax
pop ecx
pop ecx
jne 0x41c984
push str.type
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
mov dword [esi + 4], eax
cmp ecx, dword [0x453174]
je 0x41c85d
call fcn.004013ad
push str.port
lea eax, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.00404d78
push dword [eax]
call fcn.0042e975
pop ecx
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
mov dword [esi + 0xc], eax
cmp ecx, dword [0x453174]
je 0x41c88b
call fcn.004013ad
push 0x440734
lea eax, [ebp + 0x3c]
push eax
mov ecx, ebx
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.0040276d
add esp, 0xc
push dword [eax]
mov ecx, esi
call fcn.00413143
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c8c8
call fcn.004013ad
mov ecx, dword [ebp + 0x3c]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c8db
call fcn.004013ad
push str.usename
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.0040276d
add esp, 0xc
push dword [eax]
mov ecx, esi
call fcn.00413159
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c918
call fcn.004013ad
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c92b
call fcn.004013ad
push str.password
lea eax, [ebp + 0x38]
push eax
mov ecx, ebx
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0040276d
add esp, 0xc
push dword [eax]
mov ecx, esi
call fcn.0041316f
mov ecx, dword [ebp + 0x20]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c968
call fcn.004013ad
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cb36
call fcn.004013ad
jmp 0x41cb36
push str.pack
push dword [ebp + 0x50]
call fcn.0042e3e3
test eax, eax
pop ecx
pop ecx
jne 0x41cb36
mov esi, dword [ebp + 0x58]
push 0x440714
lea eax, [ebp + 0x34]
push eax
mov ecx, ebx
lea esi, [esi + 0x45344c]
call fcn.00404d78
push eax
lea ecx, [esi + 4]
call fcn.004045b5
mov ecx, dword [ebp + 0x34]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c9d0
call fcn.004013ad
push str.size
lea eax, [ebp + 0x2c]
push eax
mov ecx, ebx
call fcn.00404d78
push eax
mov ecx, esi
call fcn.004045b5
mov ecx, dword [ebp + 0x2c]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41c9fb
call fcn.004013ad
push str.name
lea eax, [ebp + 0x24]
push eax
mov ecx, ebx
call fcn.00404d78
push eax
lea ecx, [esi - 4]
call fcn.004045b5
mov ecx, dword [ebp + 0x24]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41ca27
call fcn.004013ad
mov ecx, ebx
call fcn.00404c24
jmp 0x41cb22
lea eax, [edi + 0x14]
push eax
lea ecx, [ebp + 0x64]
call fcn.00401e1e
push str.source
push dword [ebp + 0x64]
call fcn.0042e3e3
test eax, eax
pop ecx
pop ecx
jne 0x41cb08
push 0x4c
call fcn.0042cb56
mov esi, eax
test esi, esi
pop ecx
je 0x41ca9e
or dword [ebp + 0x5c], 3
push 0x44811c
lea eax, [ebp + 0x14]
push eax
mov ecx, edi
call fcn.00404d78
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0040276d
mov eax, dword [eax]
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push 1
push ecx
push eax
mov ecx, esi
call fcn.0042890c
mov esi, eax
jmp 0x41caa0
xor esi, esi
test byte [ebp + 0x5c], 2
je 0x41cabd
mov ecx, dword [ebp + 0x1c]
and dword [ebp + 0x5c], 0xfffffffd
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cabd
call fcn.004013ad
test byte [ebp + 0x5c], 1
je 0x41cada
mov ecx, dword [ebp + 0x14]
and dword [ebp + 0x5c], 0xfffffffe
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cada
call fcn.004013ad
push esi
lea ecx, [ebp + 0x60]
call fcn.0040e9a5
mov ecx, dword [ebp + 0x58]
lea eax, [ebp + 0x60]
push eax
lea ecx, [ecx + 0x453454]
call fcn.0040ea0b
mov eax, dword [ebp + 0x60]
test eax, eax
je 0x41cb02
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cb1b
call fcn.004013ad
mov ecx, edi
call fcn.00404c4f
mov edi, eax
test edi, edi
jne 0x41ca33
inc dword [ebp + 0x54]
add dword [ebp + 0x58], 0x1c
mov esi, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cb49
call fcn.004013ad
mov ecx, ebx
call fcn.00404c4f
mov ebx, eax
test ebx, ebx
jne 0x41c80c
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4474c4
call fcn.00404b4d
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x41cb85
call fcn.004013ad
mov eax, dword [ebp + 0x54]
jmp 0x41c436