Function at 0x595350
Capabilities:
Delete file
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6dc
mov eax, dword [0x64e0a0]
xor eax, esp
mov dword [esp + 0x6d8], eax
push ebx
push esi
lea eax, [esp + 0x2b8]
mov dword [esp + 0x2ac], eax
push edi
lea eax, [esp + 0x2b0]
push eax
movzx eax, byte [0x65c1e4]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2bc], 0x104
mov dword [esp + 0x2c0], 0
call fcn.005b0e80
add esp, 8
sub eax, 0
je 0x5954ad
dec eax
je 0x5953fa
mov eax, dword [esp + 0x2b0]
lea ecx, [esp + 0x2bc]
cmp eax, ecx
je 0x59558f
test eax, eax
je 0x59558f
push eax
call fcn.00541b50
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d8]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x2b0]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 7
push closesocket
push edi
mov dword [esp + 0x80], esi
call dword [0x649010]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x595483
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x595438
cmp eax, 2
jne 0x59547a
test esi, esi
jle 0x59547a
mov eax, esi
cmp esi, 0xc8
jl 0x59544b
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 7
push closesocket
push edi
sub esi, 0xc8
call dword [0x649010]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x595428
jmp 0x595483
lea eax, [ebx + 1]
neg eax
sbb eax, eax
and ebx, eax
mov eax, dword [esp + 0x2b0]
lea ecx, [esp + 0x2bc]
cmp eax, ecx
je 0x5954a2
test eax, eax
je 0x5954a2
push eax
call fcn.00541b50
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x59558b
push dword [esp + 0x2b0]
lea eax, [esp + 0x54]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x68], ebx
call fcn.0041e890
lea eax, [esp + 0x50]
mov dword [esp + 0x30], 0x18
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 0x40
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
lea ebx, [ebx]
push 0
push 0
push 0x20
push 1
push 7
push 0x80
push 0
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x50]
push eax
push 0x80100080
lea eax, [esp + 0x3c]
push eax
call fcn.0041edd6
mov edi, eax
test edi, edi
jns 0x595555
cmp edi, 0xc0000043
je 0x595533
cmp edi, 0xc000000f
jne 0x595555
test esi, esi
jle 0x595555
mov eax, esi
cmp esi, 0xc8
jl 0x595546
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 0xc8
jmp 0x5954f0
push edi
call fcn.0041e908
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call esi
test edi, edi
js 0x59556c
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x2b0]
lea ecx, [esp + 0x2bc]
cmp eax, ecx
je 0x59558b
test eax, eax
je 0x59558b
push eax
call fcn.00541b50
add esp, 4
test ebx, ebx
jne 0x5955a9
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d8]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
cmp byte [0x65c1e4], 0
push ebx
je 0x5955c3
call fcn.0041e90e
push eax
call fcn.0041e908
push eax
call esi
jmp 0x5955c9
call dword [0x649008]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0xa4]
mov dword [esp + 0x98], eax
lea eax, [esp + 0x98]
push eax
movzx eax, byte [0x65c1e4]
push eax
mov ecx, edi
mov dword [esp + 0xa4], 0x104
mov dword [esp + 0xa8], 0
call fcn.005b0e80
add esp, 8
sub eax, 0
je 0x59562e
dec eax
jne 0x59571b
push 0x80
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x59571b
push dword [esp + 0x98]
lea eax, [esp + 0x5c]
push eax
call fcn.0041e890
push 0
push 0
push 0x20
push 1
push 7
push 0x80
lea eax, [esp + 0x70]
mov dword [esp + 0x38], eax
push 0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x38]
push eax
push 0x100180
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0x40
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.0041edd6
test eax, eax
jns 0x5956a8
push eax
call fcn.0041e908
push eax
call esi
jmp 0x59571b
xor eax, eax
push 4
mov dword [esp + 0x94], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], eax
push 0x28
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x1c]
mov dword [esp + 0xa4], 0x80
call fcn.0041ed62
push eax
call fcn.0041e908
push eax
call esi
push dword [esp + 0xc]
call fcn.0041e90e
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0xa4]
cmp eax, ecx
je 0x59573a
test eax, eax
je 0x59573a
push eax
call fcn.00541b50
add esp, 4
lea eax, [esp + 0x4d4]
mov dword [esp + 0x4c8], eax
lea eax, [esp + 0x4c8]
push eax
movzx eax, byte [0x65c1e4]
push eax
mov ecx, edi
mov dword [esp + 0x4d4], 0x104
mov dword [esp + 0x4d8], 0
call fcn.005b0e80
add esp, 8
sub eax, 0
je 0x5957cc
dec eax
je 0x5957b6
mov eax, dword [esp + 0x4c8]
lea ecx, [esp + 0x4d4]
cmp eax, ecx
je 0x595801
test eax, eax
je 0x595801
push eax
call fcn.00541b50
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d8]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push dword [esp + 0x4c8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb esi, esi
neg esi
dec esi
jmp 0x5957da
mov ecx, dword [esp + 0x4c8]
call fcn.005b23d0
mov esi, eax
mov eax, dword [esp + 0x4c8]
lea ecx, [esp + 0x4d4]
cmp eax, ecx
je 0x5957f9
test eax, eax
je 0x5957f9
push eax
call fcn.00541b50
add esp, 4
test esi, esi
je 0x59558f
mov ecx, dword [esp + 0x6e4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00541b41
mov esp, ebp
pop ebp
ret