Function at 0x65832c
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65858f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4cc]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x65855f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4cc]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005133bc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x410]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004f80dc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004f8110
mov eax, dword [ebp - 8]
cmp byte [eax + 0x61b], 0
jne 0x6583b5
mov eax, dword [ebp - 8]
call fcn.00662e28
push 0x6585ac
mov eax, dword [ebp - 8]
push dword [eax + 0x610]
push 0x6585f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407380
mov eax, dword [ebp - 0xc]
mov edx, 0x658610
call fcn.0057db20
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0064c304
lea eax, [ebp - 0x10]
mov edx, 0x658654
call fcn.00407230
mov eax, dword [ebp - 0x10]
call fcn.00471794
test al, al
je 0x658438
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0064c304
lea eax, [ebp - 0x14]
mov edx, 0x658654
call fcn.00407230
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
call fcn.00406f68
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x610]
lea eax, [ebp - 0x1c]
mov ecx, 0x6585f4
call fcn.004072b0
mov eax, dword [ebp - 0x1c]
call fcn.00471794
test al, al
je 0x65848f
push 0x6586a4
mov eax, dword [ebp - 8]
push dword [eax + 0x610]
push 0x6585f4
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00407380
mov eax, dword [ebp - 0x20]
mov edx, 0x658610
call fcn.0057db20
mov eax, dword [ebp - 8]
call fcn.0065b36c
xor ecx, ecx
push ebp
push 0x65850d
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
call fcn.0065bd90
mov eax, dword [ebp - 8]
cmp dword [eax + 0x628], 0
je 0x6584c6
mov eax, dword [ebp - 8]
add eax, 0x628
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.004047c4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x410]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x670]
test ebx, ebx
je 0x658503
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x610]
lea eax, [ebp - 4]
mov ecx, 0x65871c
call fcn.004072b0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0060cafc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658517
mov edx, 0x658610
mov eax, 0x658760
call fcn.0057db20
mov eax, dword [ebp - 8]
call fcn.00659368
mov eax, dword [ebp - 8]
call fcn.00659500
mov eax, dword [ebp - 8]
call fcn.006596b0
mov eax, dword [ebp - 8]
cmp byte [eax + 0x61b], 0
jne 0x658552
mov eax, dword [ebp - 8]
call fcn.00662e28
push 0
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658596
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ed4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406ed4
lea eax, [ebp - 4]
call fcn.00406ecc
ret