Function at 0x477b75
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4b246c
push eax
mov eax, 0x21a4
mov dword fs:[0], esp
call fcn.0047aff0
mov al, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x3c], esi
mov byte [esp + 0x28], al
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x21c4]
lea edx, [esp + 0x28]
push ecx
push edx
push str._editsignature.html
mov ecx, esi
mov dword [esp + 0x21c8], ebx
call fcn.00470fc0
test al, al
jne 0x477bbd
mov eax, dword [esp + 0x2c]
push eax
jmp 0x477f09
mov cl, byte [0x4d83ac]
xor eax, eax
mov byte [esp + 0xa4], cl
mov ecx, 0x41
lea edi, [esp + 0xa5]
lea edx, [esp + 0xa4]
rep stosd dword es:[edi], eax
push edx
mov ecx, esi
call fcn.004997e0
lea ecx, [esp + 0x18]
call fcn.00489cd0
push ebx
push 1
lea eax, [esp + 0xac]
push 1
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x21cc], 1
call fcn.00489d20
test al, al
jne 0x477c3c
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x21bc], bl
call fcn.00489d10
mov edx, dword [esp + 0x2c]
push edx
jmp 0x477f09
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x38], ebx
call fcn.00413b20
mov ebp, dword [esp + 0x21c8]
lea eax, [esp + 0x1ac]
push eax
mov ecx, ebp
mov byte [esp + 0x21c0], 2
call fcn.0044bcd0
mov ecx, dword [esi + 0x4c]
push eax
call fcn.0040f640
test al, al
jne 0x477ccd
lea ecx, [esp + 0x18]
call fcn.00489e00
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x21bc], 1
call fcn.00413b60
lea ecx, [esp + 0x18]
mov byte [esp + 0x21bc], bl
call fcn.00489d10
mov edx, dword [esp + 0x2c]
push edx
jmp 0x477f09
lea ecx, [esp + 0x20]
call fcn.00489f00
test al, al
je 0x477e90
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
push 0x64
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
lea ecx, [esi + 0x44]
call fcn.00499870
test al, al
je 0x477e90
cmp byte [esp + 0x40], bl
je 0x477e9b
lea ecx, [esp + 0x13]
push ebx
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x48]
push edx
push eax
push ebp
mov ecx, esi
mov byte [esp + 0x27], bl
call fcn.00471310
test al, al
je 0x477e90
cmp byte [esp + 0x13], bl
jne 0x477ccd
mov esi, str.PROCESSSIGNATURELINK
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x477d58
cmp cl, bl
je 0x477d54
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x477d58
add eax, 2
add esi, 2
cmp cl, bl
jne 0x477d34
xor eax, eax
jmp 0x477d5d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x477dbc
mov eax, dword [0x4d5f90]
mov dword [esp + 0x14], eax
mov ecx, ebp
mov byte [esp + 0x21bc], 3
call fcn.00479da0
push eax
lea ecx, [esp + 0x18]
push str._updatesignature_id_s
push ecx
call fcn.004a0e91
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00489f00
test al, al
mov byte [esp + 0x21bc], 2
lea ecx, [esp + 0x14]
je 0x477e8b
call fcn.004a3625
jmp 0x477ccd
mov esi, str.ENABLED
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x477de9
cmp cl, bl
je 0x477de5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x477de9
add eax, 2
add esi, 2
cmp cl, bl
jne 0x477dc5
xor eax, eax
jmp 0x477dee
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x477e12
lea ecx, [esp + 0x1ac]
call fcn.00413b90
test al, al
je 0x477ccd
push 8
push str._checked
jmp 0x477cbc
mov esi, str.SIGNATURE
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x477e3f
cmp cl, bl
je 0x477e3b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x477e3f
add eax, 2
add esi, 2
cmp cl, bl
jne 0x477e1b
xor eax, eax
jmp 0x477e44
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x477ccd
push 2
push 0x4cb968
lea ecx, [esp + 0x20]
call fcn.00489f00
test al, al
je 0x477e90
lea ecx, [esp + 0x1ac]
call fcn.0044bcd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x1b0]
call fcn.0044bcd0
push eax
jmp 0x477cbc
call fcn.004a3625
lea ecx, [esp + 0x18]
call fcn.00489e00
jmp 0x477ed2
lea ecx, [esp + 0x18]
call fcn.00489e00
mov esi, dword [esp + 0x21c4]
push str.html
push 1
lea edx, [esp + 0xac]
push 0xc8
push edx
mov ecx, esi
call fcn.00495a70
test al, al
jne 0x477ee0
push ebx
mov ecx, esi
call fcn.00497450
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x21bc], 1
call fcn.00413b60
lea ecx, [esp + 0x18]
mov byte [esp + 0x21bc], bl
call fcn.00489d10
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004a2a3d
mov ecx, dword [esp + 0x21b8]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21b0
ret 8