Function at 0x402540
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43b87a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x638
mov eax, dword [0x447648]
push ebx
push ebp
mov ebp, dword [esp + 0x658]
mov dword [esp + 0x63c], eax
cmp dword [ebp + 0x18], 0x10
push esi
push edi
mov dword [esp + 0x18], 0
mov byte [esp + 0x13], 1
jb 0x402591
mov eax, dword [ebp + 4]
lea ebx, [ebp + 4]
mov dword [esp + 0x14], ebx
jmp 0x40259a
lea eax, [ebp + 4]
mov dword [esp + 0x14], eax
mov ebx, eax
push eax
call fcn.00401180
mov esi, eax
mov eax, dword [ebp + 0x1c]
cmp eax, 9
ja case.0x4025b5.2
movzx eax, byte [eax + 0x402b50]
jmp dword [eax*4 + 0x402b3c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x43dc5c
push esi
call edi
test eax, eax
je 0x402632
push 0x43dc60
push esi
call edi
test eax, eax
je 0x402632
push 0x43dc68
push esi
call edi
test eax, eax
jne case.0x4025b5.2
mov byte [esp + 0x13], al
mov al, byte [esp + 0x13]
test al, al
mov dword [esp + 0x1c], 0x43ddbc
jne 0x402606
mov dword [esp + 0x1c], 0
mov esi, dword [esp + 0x14]
xor eax, eax
mov ecx, 0x28
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov ebx, 0x10
cmp eax, ebx
jb 0x402954
mov eax, dword [esi]
mov dword [esp + 0x58], eax
jmp 0x402958
cmp dword [ebp + 0x18], 0x10
jb 0x40264a
mov eax, dword [ebx]
push 0x43dc64
push eax
call fcn.00401920
jmp case.0x4025b5.2
mov eax, ebx
push 0x43dc64
push eax
call fcn.00401920
jmp case.0x4025b5.2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x43dc6c
push esi
call edi
test eax, eax
je 0x40268f
push 0x43dc70
push esi
call edi
test eax, eax
je 0x40268f
push 0x43dc94
push esi
call edi
test eax, eax
jne case.0x4025b5.2
jmp 0x4025ee
mov ecx, dword [esp + 0x658]
push ebp
call fcn.00408490
mov esi, eax
test esi, esi
jne 0x4026be
cmp dword [ebp + 0x18], 0x10
jb 0x4026ac
mov eax, dword [ebx]
jmp 0x4026ae
mov eax, ebx
push eax
push str.Patch_has_invalid_format:__s
push 1
call fcn.004021f0
add esp, 0xc
mov eax, dword [esi + 0x10]
xor ebp, ebp
test eax, eax
jbe case.0x4025b5.2
mov edi, dword [esp + 0x65c]
xor ebx, ebx
mov ecx, dword [esi + 0x14]
lea eax, [ebx + ecx]
test byte [eax + 0x10], 1
je 0x402766
cmp dword [eax], 0x714
jne 0x402707
cmp dword [eax + 4], 0x449
jne 0x402707
cmp dword [eax + 8], 0x55c
jne 0x402707
cmp dword [eax + 0xc], 0x58a
je 0x402766
add eax, 0x15
push eax
lea ecx, [esp + 0x40]
call fcn.00406280
push eax
mov ecx, edi
mov dword [esp + 0x654], 0
call fcn.00408000
mov dword [eax], esi
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x650], 0xffffffff
jb 0x402748
mov edx, dword [esp + 0x40]
push edx
call fcn.0042b5b2
add esp, 4
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10]
inc ebp
add ebx, 0x121
cmp ebp, eax
jb 0x4026d4
jmp 0x402afd
push 0x104
lea eax, [esp + 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x200]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4027c3
cmp dword [ebp + 0x18], 0x10
jb 0x4027b1
mov eax, dword [ebx]
jmp 0x4027b3
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov byte [esp + 0x13], 1
jne 0x4027c8
mov byte [esp + 0x13], 0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4027e1
dec eax
push eax
mov ecx, ebp
call fcn.00405850
cmp byte [eax], 0x5c
jne 0x4027e1
mov bl, 1
jmp 0x4027e3
xor bl, bl
mov eax, dword [ebp + 0x18]
mov edi, 0x10
cmp eax, edi
jb 0x4027f7
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
jmp 0x4027fb
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x204]
push eax
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [esp + 0xfc]
push edx
mov byte [esp + 0x203], 0
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x204]
push edx
mov esi, eax
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixA]
test eax, eax
jne 0x402875
cmp dword [ebp + 0x18], edi
mov edi, dword [esp + 0x14]
jb 0x40285f
mov eax, dword [edi]
jmp 0x402863
mov eax, dword [esp + 0x14]
push eax
push str.Security_alert:_trying_to_delete_a_file_above_the_Neoncube_directory___s_
push 1
call fcn.004021f0
add esp, 0xc
jmp 0x402879
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4028a2
push str.Security_alert:_trying_to_delete_the_Neoncube_directory
push 1
call fcn.004021f0
add esp, 8
mov al, byte [esp + 0x13]
test al, al
je case.0x4025b5.2
test esi, esi
je 0x4028e5
test bl, bl
jne 0x402905
cmp dword [ebp + 0x18], 0x10
jb 0x4028c0
mov eax, dword [edi]
jmp 0x4028c2
mov eax, edi
push eax
push str.Confused:_patch_tries_to_delete_file___s__while_it_is_a_folder____aborting
push 1
call fcn.004021f0
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp case.0x4025b5.2
test bl, bl
je 0x4028d2
cmp dword [ebp + 0x18], 0x10
jb 0x4028f3
mov eax, dword [edi]
jmp 0x4028f5
mov eax, edi
push eax
push str.Confused:_patch_tries_to_delete_folder___s__while_it_is_a_file____aborting
push 1
call fcn.004021f0
add esp, 0xc
lea edx, [esp + 0xfc]
push edx
call fcn.00401070
jmp case.0x4025b5.2
mov esi, dword [esp + 0x65c]
push ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00406120
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
je case.0x4025b5.2
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00406740
mov dword [esp + 0x18], 1
jmp 0x402b05
mov dword [esp + 0x58], esi
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x64], 1
call fcn.00411f50
mov ecx, dword [esp + 0x64]
test ecx, ecx
mov edi, eax
je 0x402999
cmp dword [ebp + 0x18], ebx
jb 0x402989
mov eax, dword [esi]
push eax
push ecx
call fcn.00408860
xor eax, eax
jmp 0x402b13
mov eax, esi
push eax
push ecx
call fcn.00408860
xor eax, eax
jmp 0x402b13
mov al, byte [0x44a494]
test al, al
je 0x4029ad
push 0x44a494
push edi
call fcn.00411770
lea edx, [esp + 0x408]
push edx
push edi
call fcn.00411ac0
test eax, eax
jne 0x402af7
mov eax, dword [esp + 0x1c]
push 0
push eax
push 2
push edi
call fcn.00411a80
mov esi, eax
test esi, esi
je 0x402a17
push edi
call fcn.00411f00
cmp dword [ebp + 0x18], ebx
jb 0x4029eb
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
jmp 0x4029ef
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00408860
cmp dword [ebp + 0x18], ebx
jb 0x402a03
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
jmp 0x402a07
mov eax, dword [esp + 0x14]
push eax
push str.Fatal_error__s
push 1
call fcn.004021f0
add esp, 0xc
mov al, byte [esp + 0x13]
test al, al
je 0x402ae1
mov eax, dword [esp + 0x610]
and eax, 0xe0
cmp al, 0xe0
je 0x402ae1
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x50c]
push ecx
push edx
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
xor esi, esi
lea eax, [esp + 0x304]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a70
sub eax, edx
push eax
lea ecx, [esp + 0x308]
push ecx
lea ecx, [esp + 0x28]
call fcn.00406000
mov ecx, dword [esp + 0x65c]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x654], 1
call fcn.00408000
mov dword [eax], esi
cmp dword [esp + 0x38], ebx
mov dword [esp + 0x650], 0xffffffff
jb 0x402ac7
mov eax, dword [esp + 0x24]
push eax
call fcn.0042b5b2
add esp, 4
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x408]
push ecx
push edi
call fcn.00411ac0
test eax, eax
je 0x4029c3
push edi
call fcn.00411f00
mov eax, dword [esp + 0x18]
test eax, eax
jle case.0x4025b5.2
mov edx, dword [esp + 0x664]
mov byte [edx], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x648]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x638]
pop ebx
call fcn.0042b7bd
add esp, 0x644
ret 0x10