Function at 0x43a5a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50334d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x567e00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x78], edx
cmp byte [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
jne 0x43a822
test esi, esi
je 0x43a822
cmp word [esi], 0
je 0x43a822
test eax, eax
je 0x43a822
cmp word [eax], 0
je 0x43a822
test ecx, ecx
je 0x43a822
cmp word [ecx], 0
je 0x43a822
lea edi, [edx + 0x50]
push eax
mov ecx, edi
call fcn.00423d40
push str..dlcache
mov ecx, edi
call fcn.004203e0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x43a640
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0042ccb0
mov ebx, eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004162e0
add esp, 8
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x43a66a
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.0043ca50
mov edx, dword [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x43a6b5
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43a6ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43a6ab
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004c6f6f
add esp, 8
call fcn.0042ccb0
push 0
push 0
mov ecx, eax
call fcn.00490770
call dword [sym.imp.kso.dll_curl_easy_init]
mov edx, esi
mov ebx, eax
lea eax, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x43a6d2
sub edx, eax
sar edx, 1
lea eax, [edx + 1]
mov dword [ebp - 0x70], eax
cmp eax, 0x3fffffff
jg 0x43a723
add eax, eax
call fcn.004c7600
mov eax, esp
mov dword [ebp - 0x74], eax
test eax, eax
je 0x43a723
mov edx, dword [ebp - 0x70]
push 0
push 0
mov byte [eax], 0
lea ecx, [edx + edx]
push ecx
push eax
push 0xffffffffffffffff
push esi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x74]
jmp 0x43a725
xor eax, eax
mov esi, dword [sym.imp.kso.dll_curl_easy_setopt]
push eax
push 0x2712
push ebx
call esi
push 0x437200
push 0x4e2b
push ebx
call esi
push dword [ebp - 0x78]
push 0x2711
push ebx
call esi
push 5
push 0x44
push ebx
call esi
push 1
push 0x34
push ebx
call esi
push 0
push 0x2b
push ebx
call esi
add esp, 0x48
push 0x4372f0
push 0x4e58
push ebx
call esi
push ebx
call dword [sym.imp.kso.dll_curl_easy_perform]
push ebx
mov esi, eax
call dword [sym.imp.kso.dll_curl_easy_cleanup]
add esp, 0x14
test esi, esi
jne 0x43a802
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x43a792
mov eax, dword [edi]
push eax
call fcn.00416b00
add esp, 4
test al, al
je 0x43a7fd
mov eax, 0x30
push 0x40
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x43a7c2
mov eax, dword [edi]
lea ecx, [ebp - 0x54]
push ecx
push eax
call fcn.004ecbf0
push dword [ebp - 0x7c]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x10
test eax, eax
je 0x43a7e7
mov esi, 0x2712
jmp 0x43a802
cmp dword [edi + 0x14], 8
jb 0x43a7ef
mov edi, dword [edi]
push 3
push dword [ebp - 0x80]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x43a802
mov esi, 0x2711
call fcn.0042ccb0
test esi, esi
mov edx, 0x517cdc
mov ecx, 0x517ccc
cmovne ecx, edx
push ecx
mov ecx, eax
call fcn.0043ca90
mov eax, esi
jmp 0x43a824
xor eax, eax
lea esp, [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f8b
mov esp, ebp
pop ebp
ret 0xc