Function at 0x453b0c
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbb8
mov word [esp + 2], dx
mov byte [esp], al
mov dword [esp + 4], 0xfffffffe
movsx eax, word [esp + 2]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
lea ebp, [eax + 0xc]
mov eax, ebp
call fcn.00428760
test al, al
je 0x454414
mov edx, dword [0x48d550]
add edx, 0x100
lea eax, [esp + 0x33e]
call fcn.00405c48
mov eax, dword [ebp + 8]
call fcn.0040fb28
push eax
lea eax, [esp + 0x342]
push eax
call sub.kernel32.dll_lstrcatA
push 0x454424
lea eax, [esp + 0x342]
push eax
call sub.kernel32.dll_lstrcatA
push 0
lea eax, [esp + 0x342]
push eax
call sub.kernel32.dll__lcreat
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], 0xffffffff
jne 0x453bb6
lea edx, [esp + 0x33e]
mov ax, 3
call fcn.0040de10
jmp 0x454414
push 4
push 0x1000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0
jne 0x453bf0
push 0
push 0x10000
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x4543cc
mov eax, dword [esp + 0x34]
mov ecx, 0xff
mov edx, 0x10000
call fcn.00402db8
push 0x10000
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push eax
call sub.kernel32.dll__hwrite
mov dword [esp + 0x14], 0x10000
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x30], 0
mov eax, dword [0x48d550]
cmp byte [eax + 0x18b1], 8
je 0x453c60
mov eax, dword [0x48d550]
cmp byte [eax + 0x18b1], 9
jne 0x453c77
mov ax, 0x142
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
jmp 0x453c8c
mov ax, 0x145
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
mov eax, dword [0x48d5f4]
mov byte [eax], 1
push 0x22c
mov ecx, dword [0x48da44]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
mov edx, dword [0x48d498]
mov dword [edx], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov byte [esp + 0xf], 1
mov eax, dword [0x48da44]
mov dl, 0xd
call fcn.00405cf8
test eax, eax
je 0x453ce2
mov byte [esp + 0xf], 2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
fild qword [esp + 0x20]
fild qword [ebp + 0xc]
fcompp
fnstsw ax
sahf
je 0x454205
push 1
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
dec eax
jl 0x45438d
cmp byte [esp], 1
jne 0x453d2d
cmp byte [esp + 8], 0x3a
jne 0x45438d
cmp byte [esp], 0
jne 0x453d3e
cmp byte [esp + 8], 0x53
jne 0x45438d
cmp byte [esp], 0
jne 0x453dc2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
push 1
lea ecx, [esp + 0xe]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
cmp byte [esp + 0xa], 0x30
jb 0x45438d
cmp byte [esp + 0xa], 0x39
ja 0x45438d
cmp byte [esp + 0xa], 0x34
je 0x45438d
cmp byte [esp + 0xa], 0x36
je 0x45438d
cmp byte [esp + 0xa], 0x36
ja 0x454205
cmp byte [esp + 0xa], 0x31
jne 0x453da8
mov byte [esp + 0xd], 4
cmp byte [esp + 0xa], 0x32
jne 0x453db4
mov byte [esp + 0xd], 6
cmp byte [esp + 0xa], 0x33
jne 0x453dc7
mov byte [esp + 0xd], 8
jmp 0x453dc7
mov byte [esp + 0xd], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
push 2
lea ecx, [esp + 0xf]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
mov eax, dword [0x48d8a0]
mov bl, byte [esp + 0xb]
mov edx, ebx
and edx, 0xff
bt dword [eax], edx
jae 0x45438d
mov eax, dword [0x48d8a0]
mov dl, byte [esp + 0xc]
and edx, 0xff
bt dword [eax], edx
jae 0x45438d
mov eax, ebx
call fcn.00411e9c
and eax, 0xff
mov ebx, eax
shl ebx, 4
mov al, byte [esp + 0xc]
call fcn.00411e9c
and eax, 0xff
add bx, ax
mov eax, ebx
add eax, eax
mov ebx, eax
cmp byte [esp], 0
jne 0x453e8d
cmp byte [esp + 0xa], 0x30
je 0x453e56
cmp byte [esp + 0xa], 0x35
jne 0x453e8d
movzx eax, bx
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
fild qword [esp + 0x20]
faddp st(1)
xor eax, eax
mov al, byte [esp + 0xf]
mov dword [esp + 0x444], eax
fild dword [esp + 0x444]
faddp st(1)
fistp qword [esp + 0x20]
wait
jmp 0x453ce2
movzx esi, byte [esp + 0xd]
push esi
mov ecx, dword [0x48da44]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
mov eax, dword [0x48da44]
mov byte [eax + esi], 0
mov eax, dword [0x48da44]
call fcn.0040bfbc
add eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x45438d
cmp byte [esp], 0
je 0x45404b
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
push 2
lea ecx, [esp + 0xf]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
cmp eax, 2
jl 0x45438d
cmp byte [esp + 0xc], 0x32
jne 0x453f7c
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
push 4
mov ecx, dword [0x48da44]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
mov eax, dword [0x48da44]
mov byte [eax + 4], 0
mov eax, dword [0x48da44]
call fcn.0040bfbc
mov dword [esp + 0x1c], eax
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x45438d
mov eax, dword [esp + 0x1c]
shl eax, 4
mov dword [esp + 0x1c], eax
movzx eax, bx
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
fild qword [esp + 0x20]
faddp st(1)
fistp qword [esp + 0x20]
wait
jmp 0x453ce2
cmp byte [esp + 0xc], 0x34
jne 0x453ff7
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
push 4
mov ecx, dword [0x48da44]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
mov eax, dword [0x48da44]
mov byte [eax + 4], 0
mov eax, dword [0x48da44]
call fcn.0040bfbc
mov dword [esp + 0x1c], eax
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x45438d
mov eax, dword [esp + 0x1c]
shl eax, 0x10
mov dword [esp + 0x1c], eax
movzx eax, bx
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
fild qword [esp + 0x20]
faddp st(1)
fistp qword [esp + 0x20]
wait
jmp 0x453ce2
cmp byte [esp + 0xc], 0x31
je 0x454205
mov al, byte [esp + 0xc]
cmp al, 0x33
je 0x45400e
cmp al, 0x35
jne 0x454035
movzx eax, bx
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
fild qword [esp + 0x20]
faddp st(1)
fadd dword [0x45442c]
fistp qword [esp + 0x20]
wait
jmp 0x453ce2
cmp byte [esp + 0xb], 0x30
jne 0x45438d
cmp byte [esp + 0xc], 0x30
jne 0x45438d
cmp byte [esp], 0
jne 0x45405e
xor eax, eax
mov al, byte [esp + 0xd]
sub bx, ax
sub bx, 2
movzx edi, bx
mov esi, edi
add esi, 2
push esi
lea ecx, [esp + 0x40]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.004254a8
cmp eax, esi
jl 0x4543cc
mov eax, edi
shr eax, 1
mov byte [esp + 0xe], al
xor ebx, ebx
mov bl, byte [esp + 0xe]
add ebx, dword [esp + 0x10]
cmp ebx, dword [esp + 0x14]
jle 0x4540bc
sub ebx, dword [esp + 0x14]
push ebx
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x346]
mov edx, dword [esp + 0x40]
call fcn.00453a3c
test al, al
je 0x4543cc
movzx edi, byte [esp + 0xe]
test edi, edi
jle 0x4540f7
lea ebx, [esp + 0x3c]
lea esi, [esp + 0x23e]
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0040fdac
mov cl, byte [ebx + 1]
mov dl, byte [ebx]
call fcn.00453984
test al, al
je 0x4543cc
inc esi
add ebx, 2
dec edi
jne 0x4540d0
xor eax, eax
mov al, byte [esp + 0xf]
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
fild qword [esp + 0x20]
faddp st(1)
fistp qword [esp + 0x20]
wait
xor ecx, ecx
mov cl, byte [esp + 0xe]
lea edx, [esp + 0x23e]
mov eax, dword [0x48da44]
call fcn.00405a94
push 0
push 0
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.kernel32.dll_SetFilePointer_1
xor ebx, ebx
mov bl, byte [esp + 0xe]
push ebx
lea eax, [esp + 0x242]
push eax
mov eax, dword [esp + 0x40]
push eax
call sub.kernel32.dll__hwrite
cmp eax, ebx
jge 0x45417a
call fcn.0040eb04
mov eax, dword [0x48d9fc]
mov byte [eax], 1
lea edx, [esp + 0x33e]
mov ax, 5
call fcn.0040de10
add dword [esp + 0x10], ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
call fcn.0040bb84
mov dword [esp + 0x18], eax
inc byte [esp + 0x30]
cmp byte [esp + 0x30], 0x32
jne 0x453ce2
fild qword [esp + 0x20]
fild qword [ebp + 0xc]
fdivp st(1)
fmul dword [0x454430]
call fcn.004028a0
mov edx, dword [0x48d1d8]
mov byte [edx], al
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x4541d0
call fcn.00414c64
call fcn.0040f494
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
je 0x4541fb
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [esp + 0x33e]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x454414
mov byte [esp + 0x30], 0
jmp 0x453ce2
mov dl, 0xe
mov ax, 0x1f
call fcn.0042d52c
dec eax
jne 0x45424c
mov eax, dword [0x48d550]
mov edx, dword [eax + 0x17ac]
shl edx, 0xa
mov eax, dword [esp + 0x18]
call fcn.0040bb84
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x346]
mov edx, dword [esp + 0x40]
call fcn.00453a3c
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_SetEndOfFile_1
mov eax, ebp
call fcn.00428820
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp + 0x76], 4
je 0x454297
mov ax, word [ebp + 0x72]
call fcn.00412944
mov edx, eax
mov eax, dword [0x48da44]
call fcn.00405c48
jmp 0x4542a4
mov edx, dword [ebp + 8]
mov eax, dword [0x48da44]
call fcn.00405c48
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov ax, 0xf8
call fcn.0040bc04
push eax
mov eax, dword [0x48db04]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [0x48da44]
push eax
lea eax, [esp + 0x342]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x454318
mov edx, dword [0x48da44]
mov ax, 3
call fcn.0040de10
mov ax, 0x148
call fcn.0040bc04
lea edx, [esp + 0x33e]
call fcn.0040f5a0
mov eax, dword [0x48da44]
mov edx, 4
call fcn.00411d74
jmp 0x454383
cmp byte [ebp + 0x76], 4
je 0x454325
mov eax, ebp
call fcn.00424b08
mov eax, dword [0x48da44]
call fcn.00412f30
fistp qword [ebp + 0xc]
wait
fild qword [ebp + 0xc]
fsub dword [0x454434]
movsx eax, word [ebp + 0x72]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
fistp qword [eax + 0x494]
wait
movsx eax, word [ebp + 0x72]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov byte [eax + 0x55e], 1
movsx eax, word [ebp + 0x72]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov byte [eax + 0x8f], 0
mov dword [esp + 4], 0xffffffff
call fcn.0040eb04
jmp 0x454414
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0040fdac
mov dword [esp + 0x440], eax
fild dword [esp + 0x440]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov ax, 0x146
call fcn.0040bc04
call fcn.0040f4d4
mov eax, dword [0x48da44]
mov edx, 3
call fcn.00411d74
mov eax, ebp
call fcn.00428820
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [esp + 0x33e]
push eax
call sub.kernel32.dll_DeleteFileA_1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0040fdac
mov dword [esp + 4], eax
push 0x4000
push 0x10000
mov eax, dword [esp + 0x3c]
push eax
call sub.kernel32.dll_VirtualFree_1
call fcn.0040eb04
mov eax, dword [esp + 4]
add esp, 0x448
pop ebp
pop edi
pop esi
pop ebx
ret