Function at 0x43b480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d13c4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1b40
call fcn.0047bc80
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
cmovae eax, dword [ebp + 8]
push eax
call fcn.00413ac0
mov ecx, eax
call fcn.004140d0
lea ecx, [ebp - 0x1b08]
mov byte [ebp - 4], 2
call fcn.00435730
xorps xmm0, xmm0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b34]
movq qword [ebp - 0x1b14], xmm0
movdqu xmmword [ebp - 0x1b34], xmm0
movdqu xmmword [ebp - 0x1b24], xmm0
call fcn.004174a0
lea ecx, [ebp - 0x1b08]
mov byte [ebp - 4], 4
call fcn.004377d0
lea ecx, [ebp - 0x1b08]
test al, al
je 0x43b7d5
lea eax, [ebp - 0x44]
push eax
call fcn.00437280
cmp dword [ebp - 0x30], 8
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 5
cmovae esi, dword [ebp - 0x44]
call fcn.00413ac0
push esi
mov ecx, eax
call fcn.004140d0
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 6
xor esi, esi
lea ebx, [ebx]
cmp esi, dword [ebp - 0x34]
jae 0x43b59e
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
movzx eax, word [eax + esi*2]
push eax
call fcn.0047f044
add esp, 4
movzx eax, ax
lea ecx, [ebp - 0x5c]
push eax
push 1
call fcn.00413a00
inc esi
jmp 0x43b570
push 0x10
xor eax, eax
mov dword [ebp - 0x18], 7
push str.taskkill__f__im
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004116f0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x2c]
call fcn.004112e0
push 4
push 0x4da47c
lea ecx, [ebp - 0x2c]
call fcn.00411400
lea ecx, [ebp - 0x1b08]
call fcn.00436340
push 0x58
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.0047bb20
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
sub esp, 0xc
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [edx], ax
jne 0x43b62b
xor ecx, ecx
jmp 0x43b63f
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43b630
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004116f0
lea ecx, [ebp - 0xc0]
call fcn.00422ff0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 8
call fcn.00423410
lea eax, [ebp - 0x1b50]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00423120
cmp dword [ebp - 0x1b3c], 8
jb 0x43b68b
push dword [ebp - 0x1b50]
call fcn.0047a557
add esp, 4
lea eax, [ebp - 0x8f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 7
call fcn.004230b0
cmp dword [ebp - 0x18], 8
jb 0x43b6c3
push dword [ebp - 0x2c]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
cmp dword [ebp - 0x48], 8
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x43b6e8
push dword [ebp - 0x5c]
call fcn.0047a557
add esp, 4
cmp dword [ebp - 0x30], 8
mov byte [ebp - 4], 4
jb 0x43b6fd
push dword [ebp - 0x44]
call fcn.0047a557
add esp, 4
call fcn.0043ff60
mov ecx, eax
call fcn.0043f580
lea ecx, [ebp - 0x1b08]
call fcn.004377f0
lea ecx, [ebp - 0x1b08]
mov byte [ebp - 0x1b09], al
call fcn.00435b80
cmp dword [ebp + 0x30], 0
mov esi, 0x4fd044
jbe 0x43b73f
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x20]
mov ecx, esi
push eax
call fcn.004114e0
cmp byte [ebp - 0x1b09], 0
jne 0x43b881
lea ecx, [ebp - 0x1b08]
call fcn.004377d0
test al, al
jne 0x43b881
push dword [ebp - 0x1b14]
mov dword [ebp - method.CTime.virtual_0], vtable.CTime.0
call fcn.0047b041
push dword [ebp - 0x1b10]
call fcn.0047b041
add esp, 8
cmp dword [ebp + 0x1c], 8
jb 0x43b793
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov word [ebp + 8], ax
mov dword [ebp + 0x18], eax
jb 0x43b7b4
push dword [ebp + 0x20]
call fcn.0047a557
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
call fcn.004373e0
test al, al
je 0x43b6fd
call fcn.00425280
mov ecx, eax
call fcn.004254c0
call fcn.0040c960
mov esi, eax
call fcn.00404240
mov edi, eax
call fcn.0043ff60
push 0
push esi
push edi
mov ecx, eax
call fcn.004401d0
push dword [ebp - 0x1b14]
mov dword [ebp - method.CTime.virtual_0], vtable.CTime.0
call fcn.0047b041
push dword [ebp - 0x1b10]
call fcn.0047b041
add esp, 8
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
cmp dword [ebp + 0x1c], 8
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
jb 0x43b854
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x43b879
push dword [ebp + 0x20]
call fcn.0047a557
add esp, 4
or eax, 0xffffffff
jmp 0x43b7b9
call fcn.00413ac0
lea ecx, [ebp - 0x1b50]
push ecx
mov ecx, eax
call fcn.00413b30
mov edi, eax
cmp dword [0x4fd058], 8
mov byte [ebp - 4], 9
cmovae esi, dword [0x4fd044]
cmp dword [edi + 0x14], 8
jb 0x43b8b0
mov edi, dword [edi]
call fcn.004090a0
push 0x165
push esi
push edi
push eax
push 0x200
push 0x504808
call fcn.0047ce7f
add esp, 0x18
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1b3c], 8
jb 0x43b8ea
push dword [ebp - 0x1b50]
call fcn.0047a557
add esp, 4
call fcn.0040b1e0
push 0x504808
push eax
call fcn.0043efb0
add esp, 8
cmp dword [ebp + 0x30], 0
jne 0x43b919
call fcn.00425280
mov ecx, eax
call fcn.00425180
call fcn.0040c900
jmp 0x43b7f3
call fcn.0043ff60
mov ecx, eax
call fcn.0043fa20
test eax, eax
je 0x43b980
call fcn.0043ff60
mov ecx, eax
call fcn.0043f840
cmp eax, 0xb
jl 0x43b980
call fcn.0043ff60
mov ecx, eax
call fcn.0043fa90
mov esi, eax
call fcn.0043ff60
cmp esi, 1
sete cl
movzx ecx, cl
push ecx
mov ecx, eax
call fcn.0043ff10
test al, al
jne 0x43b980
call fcn.0040ca50
mov esi, eax
call fcn.00404240
mov edi, eax
call fcn.0043ff60
push 0
push esi
push edi
mov ecx, eax
call fcn.004401d0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4fd044
mov word [ecx], ax
call fcn.004114e0
lea ecx, [ebp - 0x1b08]
call fcn.00435cd0
cmp byte [ebp + 0x38], 0
mov esi, eax
je 0x43b9c3
lea ecx, [ebp - 0x1b08]
call fcn.00436c30
push 0
lea ecx, [ebp - 0x1b08]
call fcn.00437ba0
push dword [ebp - 0x1b14]
mov dword [ebp - method.CTime.virtual_0], vtable.CTime.0
call fcn.0047b041
push dword [ebp - 0x1b10]
call fcn.0047b041
add esp, 8
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
mov dword [ebp - method.Object.virtual_0], vtable.Object.0
test esi, esi
je 0x43b782
cmp dword [ebp + 0x1c], 8
jb 0x43ba20
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x43ba45
push dword [ebp + 0x20]
call fcn.0047a557
add esp, 4
xor eax, eax
jmp 0x43b7b9