Function at 0x40f436
Capabilities:
Delete file

Disassembly:
mov eax, 0x415072
call fcn.00414de8
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
cmp word [edi], ax
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
jne 0x40f47b
cmp word [edi + 0x208], ax
jne 0x40f47b
test byte [ebx + 0xa654], 4
je 0x40f841
cmp word [edi + 0x410], ax
je 0x40f841
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov esi, dword [ebx + 0xa660]
call dword [eax + 0x68]
cmp esi, eax
jae 0x40f49a
test byte [ebx + 0xa648], 4
jne 0x40f841
push edi
mov ecx, ebx
call fcn.0040ca0b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov esi, dword [ebx + 0xa660]
call dword [eax + 0x68]
cmp esi, eax
jae 0x40f4bf
push edi
push dword [ebp + 8]
mov ecx, ebx
call fcn.0040ca6b
and dword [ebp + 8], 0
lea eax, [ebx + 0x9e5a]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x40f4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x404764
add ebx, 0xaecc
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x40f841
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov esi, dword [ebx + 0xa660]
call dword [eax + 0x68]
cmp esi, eax
jb 0x40f522
push 0x40473c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f6d3
jmp 0x40f524
xor eax, eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x14], esi
je 0x40f5b3
lea ecx, [ebp - 0x14]
push ecx
push esi
push esi
mov dword [ebp - 4], esi
call eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [ebp - 0x1c], eax
jmp 0x40f562
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
jne 0x40f6d3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xa664]
mov dword [ebp - 0x24], 0x110000
mov esi, dword [ecx]
lea ecx, [ebp - 0x24]
push ecx
push eax
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.004132b7
push eax
push dword [ebp + 8]
mov ecx, 0x417188
call fcn.00408f5b
push eax
push dword [ebp - 0x14]
call dword [esi + 0x10]
test eax, eax
mov dword [ebp + 8], eax
je 0x40f6c2
jmp 0x40f5e9
push 0x38
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
cmp eax, esi
mov dword [ebp - 4], 2
je 0x40f5d2
mov ecx, eax
call fcn.00408cf8
jmp 0x40f5d4
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x40f5e9
push dword [ebp - 0x18]
mov ecx, eax
call fcn.00408d08
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
xor esi, esi
push eax
mov dword [ebp - 4], 3
mov dword [ebp + 8], esi
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x8c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
cmp word [edi + 0x208], si
je 0x40f63e
mov eax, dword [ebx + 0xa65c]
mov ecx, dword [ebx + 0xa664]
cmp eax, ecx
je 0x40f63e
push dword [ebp - 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00413c12
cmp word [edi + 0x410], si
je 0x40f668
test byte [ebx + 0xa654], 4
je 0x40f668
push dword [ebp - 0x14]
mov eax, dword [ebx + 0xa664]
mov ecx, dword [ebx + 0xa65c]
push eax
push ecx
mov ecx, edi
call fcn.00413d71
cmp word [edi], si
je 0x40f685
push dword [ebp - 0x14]
mov eax, dword [ebx + 0xa664]
mov ecx, dword [ebx + 0xa65c]
push eax
push ecx
mov ecx, edi
call fcn.00413845
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x90]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x98]
mov dword [ebp + 8], 1
jmp 0x40f6be
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40f6d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x14], 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [edi + 0x834]
cmp eax, edi
je 0x40f6ee
push edi
push eax
call dword [ebx + 0xa690]
cmp dword [ebp + 8], 0
je 0x40f745
cmp word [edi], 0
je 0x40f745
mov eax, dword [edi + 0x864]
add eax, dword [edi + 0x85c]
je 0x40f745
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ebx + 0xaecc]
lea ecx, [eax + eax + 2]
mov esi, edi
mov edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [ebx + eax*2 + 0xaeca], 0x35
lea eax, [ebx + 0xaecc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x838]
lea esi, [edi + 0x208]
cmp eax, esi
je 0x40f75d
push esi
push eax
call dword [ebx + 0xa690]
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40f7ba
mov eax, dword [ebx + 0xa65c]
cmp eax, dword [ebx + 0xa664]
je 0x40f7ba
cmp word [esi], cx
je 0x40f7ba
cmp dword [edi + 0x86c], ecx
je 0x40f7ba
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0xaecc]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [ebx + eax*2 + 0xaeca], 0x35
lea eax, [ebx + 0xaecc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [edi + 0x83c]
lea esi, [edi + 0x410]
cmp eax, esi
je 0x40f7d4
push esi
push eax
call dword [ebx + 0xa690]
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40f829
test byte [ebx + 0xa654], 4
je 0x40f829
cmp word [esi], cx
je 0x40f829
cmp dword [edi + 0x874], ecx
je 0x40f829
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0xaecc]
mov dword [ebp + 8], edi
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [ebx + eax*2 + 0xaeca], 0x35
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov word [edi], cx
mov word [edi + 0x208], cx
mov word [edi + 0x410], cx
mov word [edi + 0x618], cx
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8