Function at 0x467308
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, eax
mov eax, dword [0x4bee68]
cmp byte [eax], 4
jae 0x467331
mov ax, 0x312
call fcn.004aa600
mov edx, 4
call fcn.004b12a8
mov byte [esi + 0x435], 0
mov dl, 0x19
mov ax, 0x16
call fcn.0048841c
test eax, eax
je 0x467b77
xor eax, eax
mov dword [esi + 0x12c], eax
mov dword [esi + 0x130], eax
mov eax, esi
call fcn.0044f5d0
test al, al
je 0x467b77
mov ax, 0x2bc
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4be538]
call fcn.004b81b0
cmp dword [esi + 0x84], 0
jne 0x4673ad
push 0x467b84
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_lstrcatA
push 0x467b88
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4be538]
mov dl, 0x3a
call fcn.004aec2c
call fcn.004ae0a4
mov al, 1
call fcn.00421294
test al, al
je 0x467b77
mov eax, dword [0x4be538]
call fcn.004b1914
test al, al
je 0x4673fb
mov eax, dword [0x4be538]
xor edx, edx
call fcn.004b0584
test al, al
je 0x4673c9
mov al, byte [esi + 0x442]
test al, al
jle 0x46742e
cmp al, 0x1a
jg 0x46742e
movsx eax, al
add eax, 0x40
mov edx, dword [0x4be538]
cmp al, byte [edx]
jne 0x46742e
mov ax, 0x2fe
call fcn.004aa600
mov edx, 3
call fcn.004b12a8
jmp 0x4673c9
mov ebx, dword [esi + 0x84]
test ebx, ebx
je 0x46745d
mov dx, word [ebx + 2]
mov ax, 2
call fcn.004066c4
call fcn.00480908
test al, al
je 0x46745d
xor eax, eax
call fcn.00480b08
test al, al
je 0x467b77
push 0x2000
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x46748b
push 0
push 0x2000
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x467b77
mov eax, dword [0x4be538]
call fcn.004adcb4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0xffffffff
jne 0x4674ba
push ebx
call sub.kernel32.dll_GlobalFree
mov edx, dword [0x4be538]
mov ax, 3
call fcn.004acdac
jmp 0x467b77
mov eax, dword [0x4becfc]
mov byte [eax], 1
mov dl, 7
mov ax, 0x28
call fcn.0048841c
test eax, eax
je 0x467b77
push 0
push 0x4001
mov eax, dword [0x4beed4]
push dword [eax + 4]
push dword [eax]
call fcn.004aa5c8
fistp qword [esp + 0x28]
wait
mov eax, dword [0x4bea04]
mov byte [eax], 7
mov eax, dword [0x4be784]
mov al, byte [eax + 0x189d]
mov edx, dword [0x4be750]
mov edx, dword [edx]
mov byte [edx + 0x136], al
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x3c], 1
mov ax, 0x2f9
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
push esi
mov esi, 0x467b90
lea edi, [esp + 0x45]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4be784]
cmp byte [eax + 0x1943], 0
je 0x4675a0
push esi
lea esi, [esp + 0x45]
lea edi, [esp + 0x68]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x4bed1c]
mov cl, 0x20
call fcn.004036bc
push esi
lea esi, [esp + 0x68]
lea edi, [esp + 0x45]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4be784]
cmp byte [eax + 0x1944], 0
je 0x4675e1
push esi
lea esi, [esp + 0x45]
lea edi, [esp + 0x68]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x4be534]
mov cl, 0x20
call fcn.004036bc
push esi
lea esi, [esp + 0x68]
lea edi, [esp + 0x45]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4be784]
cmp byte [eax + 0x1945], 0
je 0x467622
push esi
lea esi, [esp + 0x45]
lea edi, [esp + 0x68]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x4be658]
mov cl, 0x20
call fcn.004036bc
push esi
lea esi, [esp + 0x68]
lea edi, [esp + 0x45]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x4be784]
cmp byte [eax + 0x18c1], 0
je 0x467646
mov eax, dword [esi + 0x14c]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x150]
mov dword [esp + 0x24], eax
jmp 0x467657
mov eax, dword [esi + 0xc]
fild qword [eax + 0x10]
fsub dword [0x467bb0]
fistp qword [esp + 0x20]
wait
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
test al, al
jne 0x467672
push ebx
call sub.kernel32.dll_GlobalFree
jmp 0x467b77
mov eax, dword [esi + 0xc]
call fcn.0041e660
mov byte [esp + 0x40], al
cmp byte [esp + 0x40], 0
jne 0x4676c4
fild qword [esp]
fcomp dword [0x467bb4]
fnstsw ax
sahf
jne 0x4676c4
mov ax, 0x139
call fcn.004aa600
push eax
mov ax, 0x3f
call fcn.004aa600
mov ecx, 4
pop edx
call fcn.004b12b8
mov eax, dword [esi + 0xc]
fild qword [eax + 0x10]
fsub dword [0x467bb0]
fistp qword [esi + 0x12c]
wait
cmp byte [esp + 0x40], 1
jne 0x467a3c
mov eax, dword [esi + 0x12c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x130]
mov dword [esp + 0x14], eax
fild qword [esp]
fcomp dword [0x467bb4]
fnstsw ax
sahf
jbe 0x467714
mov eax, dword [0x4bedb0]
mov byte [eax], 0xd
mov eax, dword [0x4bedb0]
mov byte [eax + 1], 0xa
push 2
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push 0
push 0x2000
fild qword [esp + 0x28]
fild qword [esp + 0x18]
fsubp st(1)
fadd dword [0x467bb0]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004aa590
call fcn.004028e8
mov edi, eax
test edi, edi
je 0x467a4e
push edi
lea edx, [esp + 0x14]
mov eax, dword [esi + 0xc]
mov ecx, ebx
mov ebp, dword [eax + 0x1a0]
call dword [ebp + 0x18]
mov dword [esp + 0x38], eax
cmp edi, dword [esp + 0x38]
jg 0x467a4e
or ebp, 0xffffffff
mov edx, dword [esp + 0x38]
mov eax, 0x2000
call fcn.004aa570
mov dword [esp + 0x34], eax
mov edi, dword [esp + 0x34]
dec edi
test edi, edi
jl 0x46782b
inc edi
xor eax, eax
mov edx, dword [0x4be784]
cmp byte [edx + 0x1946], 0
jne 0x4677c1
lea edx, [eax + ebx]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x41], edx
jb 0x467823
mov ebp, eax
jmp 0x46782b
lea edx, [eax + ebx]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x41], edx
jb 0x4677df
lea edx, [eax + ebx]
cmp byte [edx], 0
je 0x4677df
mov ebp, eax
jmp 0x46782b
mov edx, dword [esp + 0x34]
dec edx
cmp eax, edx
jge 0x467803
lea edx, [eax + ebx]
cmp byte [edx], 0
jne 0x467803
lea edx, [eax + ebx]
inc edx
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x41], edx
jae 0x46781e
lea edx, [eax + ebx]
inc edx
cmp byte [edx], 0
jne 0x467823
lea edx, [eax + ebx]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x41], edx
jb 0x467823
lea ebp, [eax + 1]
jmp 0x46782b
inc eax
dec edi
jne 0x46779c
cmp byte [ebx], 0xd
jne 0x46783f
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x46783f
mov eax, 2
jmp 0x467841
xor eax, eax
cmp ebp, 0xffffffff
jne 0x46784e
mov edi, dword [esp + 0x38]
sub edi, eax
jmp 0x467852
mov edi, ebp
sub edi, eax
push edi
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll__hwrite
mov dword [esp + 0x84], eax
fild dword [esp + 0x84]
fild qword [esp]
faddp st(1)
fistp qword [esp]
wait
cmp edi, eax
jle 0x46788f
mov edx, dword [0x4be538]
mov ax, 5
call fcn.004acdac
jmp 0x467a4e
cmp ebp, 0xffffffff
je 0x467714
mov dword [esp + 0x84], ebp
fild dword [esp + 0x84]
fild qword [esp + 0x18]
faddp st(1)
fistp qword [esi + 0x12c]
wait
fld xword [0x467bb8]
fild qword [esp + 8]
fmulp st(1)
fild qword [esp]
fcompp
fnstsw ax
sahf
jbe 0x467929
mov ax, 0x2f9
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4beb38]
call fcn.004b81b0
push 0x467b84
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_lstrcatA
push dword [esp + 4]
push dword [esp + 4]
call fcn.004b1e30
push eax
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beb38]
push eax
mov eax, dword [0x4bee9c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x46793d
mov eax, dword [0x4bee68]
cmp byte [eax], 4
jae 0x46796e
fild qword [esp]
fcomp dword [0x467bc4]
fnstsw ax
sahf
jb 0x46796e
mov ax, 0x313
call fcn.004aa600
push eax
mov ax, 0x312
call fcn.004aa600
mov ecx, 4
pop edx
call fcn.004b12b8
jmp 0x467a4e
mov eax, dword [esp + 0x30]
call fcn.004b22b8
fadd dword [0x467bc8]
fild qword [esp + 0x28]
fcompp
fnstsw ax
sahf
jae 0x467a3c
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [0x4be538]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
mov eax, dword [0x4bedb0]
mov dl, 0x2e
call fcn.004b838c
test eax, eax
je 0x4679b9
mov byte [eax], 0
push 0x467bcc
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
fild dword [esp + 0x3c]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b849c
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4be728]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
call fcn.004b1914
test al, al
je 0x467a0f
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x467a4e
mov eax, dword [0x4be538]
call fcn.004adcb4
mov dword [esp + 0x30], eax
inc dword [esp + 0x3c]
mov byte [esi + 0x435], 1
cmp byte [esp + 0x40], 1
je 0x467672
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
push ebx
call sub.kernel32.dll_GlobalFree
call fcn.004adbe0
fild qword [esp]
fcomp dword [0x467bb4]
fnstsw ax
sahf
jne 0x467a8d
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x467b70
push 0
push 0
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0044c078
mov ebx, eax
mov eax, dword [esi + 0x84]
test eax, eax
je 0x467b20
cmp dword [eax + 0x1ac], 0
je 0x467ac2
mov eax, dword [esi + 0x84]
mov eax, dword [eax + 0x1ac]
call fcn.004b8480
mov eax, dword [0x4be538]
call fcn.004b8404
mov edx, dword [esi + 0x84]
mov dword [edx + 0x1ac], eax
mov eax, dword [0x4bef50]
mov eax, dword [eax]
mov byte [eax + 0x163], 1
mov eax, dword [esi + 0x84]
mov ax, word [eax + 2]
call fcn.00484cc8
test bx, bx
jle 0x467b20
mov eax, dword [esi + 0x84]
mov dx, word [eax + 2]
mov ax, 2
call fcn.004066c4
movsx edx, bx
mov ecx, dword [0x4be754]
mov edx, dword [ecx + edx*4 - 4]
mov dword [edx + 0x80], eax
push dword [esp + 4]
push dword [esp + 4]
call fcn.004b1e30
mov edx, dword [0x4bedb0]
mov eax, dword [0x4beb38]
call fcn.004b81b0
mov ax, 0x1eb
call fcn.004aa600
mov edx, dword [0x4be538]
call fcn.004ae1b0
mov edx, dword [0x4beb38]
mov eax, dword [0x4bedb0]
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
mov edx, 4
call fcn.004b12a8
mov byte [esi + 0x435], 0
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret