Function at 0x412b90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550a1b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x5a9f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0x118], esp
mov byte [ecx], bl
lea edi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x412be0
sub eax, edi
push eax
push esi
call fcn.00404400
call fcn.004066a0
add esp, 0x20
cmp eax, ebx
jne 0x412c43
push 1
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0x118], esp
mov byte [ecx], bl
lea edi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x412c20
sub eax, edi
push eax
push esi
call fcn.00404400
call fcn.004066a0
add esp, 0x20
cmp eax, ebx
jne 0x412c43
xor eax, eax
jmp 0x412e25
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x118], eax
cmp edi, ebx
je 0x412cab
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
jne 0x412ca5
mov dword [ebp - 0x118], ebx
jmp 0x412d1b
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
cmp eax, ebx
je 0x412d1b
push 0x58382c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x11c], eax
cmp eax, ebx
je 0x412cf2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call edi
mov ecx, dword [ebp - 0x11c]
push str.Wow64RevertWow64FsRedirection
push ecx
mov dword [ebp - 0x12c], eax
call edi
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x120], ebx
jne 0x412d1b
mov eax, dword [ebp - 0x12c]
cmp eax, ebx
je 0x412d1b
lea edx, [ebp - 0x124]
push edx
call eax
test eax, eax
je 0x412d1b
mov dword [ebp - 0x120], 1
xor eax, eax
push 0x103
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 0x14c], ebx
mov byte [ebp - 0x114], bl
call fcn.00528f50
push esi
lea edx, [ebp - 0x114]
mov ecx, 0x14
push 0x104
push edx
mov word [ebp - 0x13c], cx
call fcn.00526b93
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412d90
sub eax, edx
mov byte [ebp + eax - 0x114], bl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412da5
sub eax, edx
mov byte [ebp + eax - 0x113], bl
lea ecx, [ebp - 0x14c]
lea eax, [ebp - 0x114]
push ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x148], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
neg esi
sbb esi, esi
cmp dword [ebp - 0x118], ebx
je 0x412e11
cmp dword [ebp - 0x120], ebx
je 0x412e11
mov eax, dword [ebp - 0x128]
cmp eax, ebx
je 0x412e11
mov edx, dword [ebp - 0x124]
push edx
call eax
test eax, eax
je 0x412e11
mov dword [ebp - 0x120], ebx
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x412e22
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00523d1e
mov esp, ebp
pop ebp
ret