Function at 0x579d24
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.004064dc
mov eax, dword [ebp - 8]
call fcn.004064dc
xor eax, eax
push ebp
push 0x57a096
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x40], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x41], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x42], 0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x57a043
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x42], 0
jne 0x57a056
push 0x57a0b0
push 0
lea eax, [ebp - 0x2c]
mov ecx, 0x57a0c0
mov edx, dword [ebp - 8]
call fcn.004068c8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
call fcn.005792c4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
call fcn.005795d8
call fcn.004601c4
fstp st(0)
xor ebx, ebx
jmp 0x579dee
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x42], 0
jne 0x579dfd
push 0x64
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
cmp byte [eax + 0x6b], 0
je 0x579dde
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
cmp byte [eax + 0x6a], 0
jne 0x579e4b
test bl, bl
jne 0x579e4b
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x42], 0
jne 0x57a056
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
je 0x57a056
mov esi, dword [ebp - 0x24]
add esi, esi
lea esi, [esi + esi*4]
dec esi
test esi, esi
jl 0x579e4b
inc esi
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x42], 0
jne 0x579e4b
push 0x64
call sub.kernel32.dll_Sleep_2
dec esi
jne 0x579e38
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
cmp byte [eax + 0x6a], 0
je 0x579ff5
test bl, bl
jne 0x579ff5
lea eax, [ebp - 0x30]
mov ecx, 0x57a0c0
mov edx, dword [ebp - 8]
call fcn.004068c8
mov eax, dword [ebp - 0x30]
call fcn.0045cf74
test al, al
je 0x579ff5
mov edx, 0x57a0d8
mov eax, 0x57a104
call fcn.0050c8a0
mov dl, 1
mov eax, dword [0x47121c]
call fcn.00476d94
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
call fcn.0045d3fc
mov eax, dword [ebp - 0x34]
call fcn.0045cfbc
test al, al
je 0x579f8b
lea eax, [ebp - 0x38]
mov ecx, 0x57a0c0
mov edx, dword [ebp - 8]
call fcn.004068c8
mov eax, dword [ebp - 0x38]
call fcn.0045cf74
test al, al
je 0x579f18
xor eax, eax
push ebp
push 0x579f0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
mov ecx, 0x57a0c0
mov edx, dword [ebp - 8]
call fcn.004068c8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x579f18
mov eax, dword [ebp - 8]
call fcn.0045cf74
test al, al
je 0x579f5e
xor eax, eax
push ebp
push 0x579f54
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0045d0f4
mov eax, dword [ebp - 8]
call fcn.00406580
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x579f5e
xor eax, eax
push ebp
push 0x579f81
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x579f8b
mov eax, dword [ebp - 0x28]
call fcn.004042e8
xor eax, eax
push ebp
push 0x579fc9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
mov ecx, 0x57a0c0
mov edx, dword [ebp - 8]
call fcn.004068c8
mov eax, dword [ebp - 0x40]
call fcn.00406580
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x579fd3
mov edx, 0x57a0d8
mov eax, 0x57a144
call fcn.0050c8a0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0057a424
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x41], al
jmp 0x57a043
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
mov ecx, dword [eax + 0x6c]
lea eax, [ebp - 0x44]
mov edx, 0x57a184
call fcn.004068c8
mov eax, dword [ebp - 0x44]
mov edx, 0x57a0d8
call fcn.0050c8a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
mov ecx, dword [eax + 0x70]
lea eax, [ebp - 0x48]
mov edx, 0x57a1c4
call fcn.004068c8
mov eax, dword [ebp - 0x48]
mov edx, 0x57a0d8
call fcn.0050c8a0
jmp 0x57a056
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x84]
cmp byte [eax + 0x6a], 0
je 0x579d8d
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x40], 1
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x4c], 1
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x81], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57a09d
lea eax, [ebp - 0x48]
mov edx, 8
call fcn.004064ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004064ec
ret