Function at 0x447978
Capabilities:
Delete file

Disassembly:
sti
dec dword [ebp + 0x1de8084d]
lahf
sti
dec dword [ebp + 0x15e8204d]
lahf
sti
dec dword [ebx + 0x645ff44d]
mov dword [0], ecx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3b
ja 0x447b89
add cl, byte [ecx + 0x4c]
scasb al, byte es:[edi]
jbe 0x447958
test byte [edx], ch
salc
imul edx, dword [ebx + 0x1983a151], 0xffffff95
xchg ebp, eax
stosd dword es:[edi], eax
aam 0xb
jle 0x4479ee
adc al, 0x14
dec ebp
imul ebp, dword [edi + 0x3c], 0x62b59269
dec edx
cmp ah, byte [edi]
sbb al, byte [ebx + 0x2f]
jecxz 0x447a01
lahf
mov dword fs:[0xa7f5f02d], eax
cmp eax, 0xd2f066a4
fldcw word [edi + ebp*4]
movsd dword es:[edi], dword [esi]
jae 0x447a32
std
mov esp, 0x90cc0c6b
imul esp, ecx, 0x45966e1e
jne 0x4479f0
stosd dword es:[edi], eax
salc
mov al, bl
dec edi
jns 0x447a1a
add bl, byte [edi + 0xe66dd9b]
push cs
mov ebp, 0x2f6f0370
xchg esi, eax
pop edx
push eax
sbb esp, dword [ebx + 0x7d]
mov al, dh
lcall 0x22de, 0x20131674
push ss
adc esp, dword [eax]
fisub word [edx]
and dh, bl
and cl, byte [ecx - 0x50]
invalid
dec ecx
mov al, 0xdb
adc eax, 0xd3af2acf
add ecx, dword [edi + 0x784009c4]
push 0x34
mov dword [0x63c8c1df], eax
jb 0x4479de
js 0x447a6d
xor al, 0xa3
ffreep st(1)
enter 0x7263, 0xffffffffffffffd3
jb 0x447a11
repne insb byte es:[edi], dx
mov al, byte [0x432cd9cd]
fldcw word [ebx + eax*2]
jge 0x447a55
fcmovbe st(0), st(3)
cmp bh, dh
sti
xchg esp, eax
retf 0xa315
out dx, eax
dec esi
pop ecx
mov dh, 0x57
mov ebx, 0x69acc668
lcall 0xfcc2, 0xa9f455bf
sub al, 0xb5
mov esi, 0x943919e5
jle 0x447a88
jns 0x447a87
sbb dh, cl
wait
xchg esi, eax
int1
lodsb al, byte [esi]
pop es
adc esp, 0x42
retf 0xd7e9
adc edi, edi
adc esi, edx
inc edi
mov ch, 0xde
sti
or byte [esi], ah
mov al, 0x51
fld xword [eax - 0xb]
mov dword [0xc42a2ccc], eax
push 0x2ccca3f5
sub al, ah
push 0x17997395
aas
nop
xor eax, 0x430c80ac
cmp ebp, ebp
mov bh, 0xa4
sub ah, byte [eax]
push edi
pop edx
mov edi, dword [ecx - 0x5c565a65]
push eax
imul esp, ecx, 0xffffff99
xlatb
fnsave dword [eax + ebp*8 + 0x761a58d7]
das
mov dword [eax], ebx
add ebp, dword [edi]
aad 0x94
scasd eax, dword es:[edi]
pop es
clc
imul edi, dword [edi + edi*2 - 0x16694814], 0x54107c0c
jns 0x447b28
imul esi, ecx, 0xafeebd03
push ds
scasb al, byte es:[edi]
int1
add edi, dword [ebp - 0x51e15012]
cwde
jp 0x447a6f
xchg ebp, eax
pushfd
jl 0x447a7b
nop
mov ah, 0x60
leave
xor eax, 0x78bf1129
xor esp, eax
test bh, cl
jl 0x447b14
push 0xffffffffffffff94
or bh, byte [edx*4 - 0x508cc056]
arpl word [ecx], di
push esp
fisub word [ecx + 0x3cf37461]
inc eax
or ch, ah
movsb byte es:[edi], byte [esi]
xchg ebp, eax
movsd dword es:[edi], dword [esi]
jge 0x447abe
movsb byte es:[edi], byte [esi]
dec ebx
push edx
shl byte ss:[edx - 0x7c937c08], 1
jne 0x447aef
iretd
and ah, byte [edx - 0x77c2cb4a]
mov eax, dword [0x380f68d6]
into
mov ecx, esi
lds ecx, [edi]
push esp
or al, byte [edi + 0x4dd92da7]
jmp [esi + eax*4 + 0x43]
sub eax, 0x6cff4dd9
xchg byte [ebx + 0x5e], al
retf 0xb38
mov ecx, esi
call fcn.00447167
pop esi
test al, al
je 0x447baf
cmp dword [0x576794], 8
mov eax, 0x576780
cmovae eax, dword [0x576780]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret