Function at 0x40358f
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x290], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
push 0xd
mov dword [esp + 0x30], eax
mov ebx, edx
pop eax
mov dword [esp + 0x28], ecx
mov esi, eax
mov edi, 0xa0
mov dword [esp + 0xc], esi
mov edx, edi
mov ecx, ebx
call fcn.00402127
add eax, 0xe
cmp eax, edi
jbe 0x4035e6
push 6
pop eax
jmp 0x403a43
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040160e
add esp, 0x10
test eax, eax
js 0x403a5a
lea eax, [esp + 0xb8]
push 0x180
push eax
call dword [sym.imp.msvcrt.dll__chmod]
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 0xc
lea eax, [esp + 0xb8]
push edi
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
push 0x1001
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
lea eax, [esp + 0xb8]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
cmp edi, 0xffffffff
jne 0x40366e
push 4
jmp 0x4035e0
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x40672c]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x4035de
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x4063f0]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x403897
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
jmp 0x4035de
mov cl, byte [edi + 1]
cmp cl, 0x3a
jne 0x4036e6
cmp byte [edi + 2], 0x5c
je 0x4036f0
cmp byte [edi], 0x5c
jne 0x4036fa
cmp cl, 0x5c
jne 0x4036fa
mov byte [esp + 0x158], 0
jmp 0x40372e
mov esi, dword [esp + 0x28]
mov edx, 0xa0
mov ecx, esi
call fcn.00402127
mov ecx, 0xa0
cmp eax, ecx
jge 0x4035de
mov edx, ecx
lea ecx, [esp + 0x158]
push esi
call fcn.00401570
test eax, eax
js 0x403a5a
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402127
mov edx, 0xa0
lea ecx, [esp + 0x158]
mov esi, eax
call fcn.00402127
add esi, eax
mov eax, 0xa0
cmp esi, eax
jae 0x4035de
push edi
mov edx, eax
lea ecx, [esp + 0x15c]
call fcn.004015a3
test eax, eax
js 0x403a5a
mov edi, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x1c]
call fcn.00402127
mov edx, 0xa0
mov ecx, ebx
mov esi, eax
call fcn.00402127
inc eax
mov ecx, 0xa0
add eax, esi
cmp eax, ecx
jae 0x4035de
push edi
push ebx
push 0x401144
push ecx
lea eax, [esp + 0xc8]
push eax
call fcn.0040160e
add esp, 0x14
test eax, eax
js 0x403a5a
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401270
call fcn.0040fd47
test eax, eax
je 0x4039cd
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call fcn.0040fd47
test eax, eax
je 0x4039cd
mov edi, dword [esp + 0x18]
cmp byte [edi], 0x40
jne 0x40383d
cmp byte [0x406cc0], 0
je 0x4039c1
mov esi, dword [esp + 0xc]
mov dword [esp + 0x24], 1
jmp 0x403874
lea edx, [esp + 0xb8]
lea ecx, [esp + 0x158]
call fcn.0040fd47
movzx esi, ax
push 0xd
pop eax
mov dword [esp + 0xc], esi
cmp si, ax
jne 0x4038ae
lea eax, [esp + 0xb8]
push 0x100
push eax
call dword [sym.imp.msvcrt.dll__chmod]
pop ecx
pop ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x10]
add edi, eax
mov dword [esp + 0x18], edi
call fcn.00402127
mov ecx, dword [esp + 0x10]
inc ecx
add ecx, eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402127
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4036d8
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edi, 0xa0
mov ecx, ebx
mov edx, edi
call fcn.00402127
add eax, 0xe
cmp eax, edi
ja 0x4035de
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040160e
add esp, 0x10
test eax, eax
js 0x403a5a
mov edi, dword [esp + 0x2c]
mov edx, 0xa0
mov ecx, ebx
mov byte [edi], 0
call fcn.00402127
mov ecx, 0xa0
cmp eax, ecx
jae 0x4035de
mov edx, ecx
lea ecx, [esp + 0x1f8]
push ebx
call fcn.00401570
test eax, eax
js 0x403a5a
push 0xd
pop eax
mov byte [edi], 0x5c
cmp si, ax
jne 0x4039d8
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call fcn.0040fd47
test eax, eax
je 0x4039ba
sub esp, 0x88
lea esi, [esp + 0xb8]
mov edx, ebx
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.0040fd47
test eax, eax
je 0x4039ba
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x280]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.00403495
test eax, eax
jne 0x4039d1
push 7
jmp 0x4035e0
push 3
pop esi
mov dword [esp + 0xc], esi
jmp 0x4038ae
push 7
jmp 0x4039c3
mov esi, dword [esp + 0xc]
push 0xd
pop eax
cmp dword [esp + 0x24], 0
je 0x403a40
cmp si, ax
jne 0x403a40
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, eax
test esi, esi
je 0x4035de
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalLock]
test eax, eax
je 0x4036c7
lea ecx, [esp + 0xb8]
push ecx
push ecx
push eax
push esi
push ebx
push dword [esp + 0x3c]
push ecx
push ecx
call fcn.004018c3
push dword [0x40672c]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ax, si
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404c50
mov esp, ebp
pop ebp
ret 4
call fcn.0040215d
int3