Function at 0x45e8c0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d387b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd0
mov eax, dword [0x689140]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
push 0
push 0
push 2
push 0
mov dword [ebp - 4], 0
lea eax, [ebx + 0x1c]
cmp dword [ebx + 0x30], 7
push 1
cmova eax, dword [ebx + 0x1c]
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
cmp eax, 0xffffffff
jne 0x45e945
mov edi, 5
jmp 0x45ec8f
push 0
mov ecx, 1
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 2
lea ecx, [ebp - 0x18]
push ecx
push 0x9c040
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebx + 0xc]
cmp ecx, eax
jne 0x45e987
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x8c], esi
jmp 0x45e99d
push ecx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x68], esi
mov byte [ebp - 4], 2
test esi, esi
jne 0x45e9b0
lea edi, [esi + 4]
jmp 0x45ec86
cmp dword [ebx + 0x18], 0
xorps xmm0, xmm0
movq qword [ebp - 0x7c], xmm0
mov dword [ebp - 0x74], 0
je 0x45e9db
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x44]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
call fcn.0045d960
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 8]
mov eax, ecx
mov edx, dword [ebp - 0x44]
shr eax, 1
test al, 1
jne 0x45ea05
and edx, 0xfffffffd
jmp 0x45ea08
or edx, 2
mov eax, edx
shr ecx, 3
or eax, 1
mov dword [ebp - 0x50], 0
and edx, 0xfffffffe
mov dword [ebp - 0x4c], 0
test cl, 1
xorps xmm0, xmm0
mov ecx, dword [ebx + 8]
cmovne edx, eax
shr ecx, 2
mov eax, edx
and edx, 0xfffffffb
or eax, 4
test cl, 1
push 0x16
cmovne edx, eax
lea ecx, [ebp - 0x60]
push str.Dumped_by_CrashHandler
mov dword [ebp - 0x44], edx
movups xmmword [ebp - 0x60], xmm0
call fcn.00428c10
mov byte [ebp - 4], 4
cmp dword [ebx + 0x44], 0
je 0x45ea90
push 2
push 0x623450
lea ecx, [ebp - 0x60]
call fcn.00422380
cmp dword [ebx + 0x48], 7
lea eax, [ebx + 0x34]
push dword [ebx + 0x44]
cmova eax, dword [ebx + 0x34]
lea ecx, [ebp - 0x60]
push eax
call fcn.00422380
nop dword [eax]
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x80]
movlpd qword [ebp - 0x70], xmm0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x80], 1
call fcn.0045f910
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x70], 1
mov eax, dword [edi]
mov dword [ebp - 0x6c], eax
mov eax, dword [edi]
mov dword [eax], 0xb
mov eax, dword [ebp - 0x50]
lea ecx, [eax*2 + 2]
mov eax, dword [edi]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x60]
cmp dword [ebp - 0x4c], 7
mov eax, dword [edi]
cmova ecx, dword [ebp - 0x60]
cmp byte [0x6ee31d], 0
mov dword [eax + 8], ecx
mov dword [ebp - 0x1c], 0
je 0x45ecbf
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
mov esi, dword [0x6ee410]
mov ecx, esi
push eax
push 0
push 0
call dword [0x5f2510]
call esi
test eax, eax
jne 0x45ecf6
inc dword [ebp - 0x28]
mov esi, dword [ebp - 0x44]
cmp dword [ebp - 0x30], eax
je 0x45eb5d
mov ecx, esi
mov dword [ebp - 0x80], esi
cmp esi, ecx
jne 0x45eb5d
lea ecx, [ebp - 0x40]
call fcn.0045f430
mov ecx, dword [ebp - 0x80]
mov eax, dword [eax]
not eax
and ecx, eax
sub dword [ebp - 0x30], 1
mov dword [ebp - 0x44], ecx
je 0x45eb56
mov dword [ebp - 0x80], ecx
jmp 0x45eb33
mov dword [ebp - 0x34], 0
push 0
xor ecx, ecx
mov dword [ebp - 0x48], esi
cmp dword [ebx + 0x18], ecx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
cmove eax, ecx
mov ecx, dword [ebp - 0x84]
push eax
push esi
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x8c]
push dword [ebx + 0xc]
push esi
call dword [0x5f2510]
call dword [ebp - 0x84]
test eax, eax
jne 0x45ebda
lea ecx, [ebp - 0x1c]
call fcn.0056c7a0
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0045f5b0
push 0xc
push edi
call fcn.0059886a
add esp, 8
cmp dword [ebp - 0x30], 0
jne 0x45ea90
cmp dword [ebx + 0x30], 7
lea eax, [ebx + 0x1c]
cmova eax, dword [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 6
jmp 0x45ec6f
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x84]
movq xmm0, qword [str.dump]
mov dword [ebp - 0x84], eax
mov eax, dword [0x628468]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x98], 0x31353439
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x94], 0x33343636
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xa4], ecx
lea ecx, [ebp - 0xb4]
push 0x30
push str.Dumped_in_process_on_attempts__with_flags_:x
movq qword [ebp - 0xb4], xmm0
mov dword [ebp - 0xa0], pe_nt_image_headers32
call fcn.0045fe50
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0056c7a0
mov ecx, edi
call fcn.0045f5b0
push 0xc
push edi
call fcn.0059886a
add esp, 8
xor edi, edi
lea ecx, [ebp - 0x60]
call fcn.00428f60
lea ecx, [ebp - 0x40]
call fcn.0045f480
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebx + 0x34]
call fcn.00428f60
lea ecx, [ebx + 0x1c]
call fcn.00428f60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059860b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.NtDll_Fncs_not_initialized
lea ecx, [ebp - 0xdc]
call fcn.00427770
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xc4]
call fcn.00424200
push 0x6852a8
lea eax, [ebp - 0xc4]
push eax
call fcn.00599dcb
push str.LdrLockLoaderLock
push eax
lea ecx, [ebp - 0x9c]
call fcn.0043cf90
push 0x68501c
lea eax, [ebp - 0x9c]
push eax
call fcn.00599dcb
int3