Function at 0x43a980
Capabilities:
Delete file
Set file attributes
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abfd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x680
mov eax, dword [0x4d3804]
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x670], ecx
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0043b830
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00402080
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x70]
mov ecx, dword [eax + 2]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x4b6f08
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c90
add esp, 0x10
push 0
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x6c]
add ecx, 4
call fcn.0046d400
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
lea ecx, [ebp - 0x34]
call fcn.00408620
mov byte [ebp - 4], 2
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x70]
push ecx
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x6c]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x6c]
mov eax, dword [edx]
call dword [eax + 0x38]
test eax, eax
je 0x43aa53
jmp 0x43b59d
push 0x80
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x670]
add ecx, 0x7c
call fcn.004020e0
mov word [ebp - 0x458], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x207
lea edx, [ebp - 0x458]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
push 2
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x468]
call fcn.0043bd90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x468]
call fcn.0042e9d0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x468]
call fcn.0042ea00
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x40], 0
jbe 0x43aaf8
cmp dword [ebp - 0x44], 0
ja 0x43b44a
push 0x4b6f10
lea ecx, [ebp - 0x4a8]
call fcn.00403fe0
mov byte [ebp - 4], 4
push 0x4b6f14
lea ecx, [ebp - 0x4a4]
call fcn.00403fe0
mov byte [ebp - 4], 5
push 0x4b6f18
lea ecx, [ebp - 0x4a0]
call fcn.00403fe0
mov byte [ebp - 4], 6
push 0x4b6f1c
lea ecx, [ebp - 0x49c]
call fcn.00403fe0
mov byte [ebp - 4], 7
push 0x4b6f20
lea ecx, [ebp - 0x498]
call fcn.00403fe0
mov byte [ebp - 4], 8
push 0x4b6f24
lea ecx, [ebp - 0x494]
call fcn.00403fe0
mov byte [ebp - 4], 9
push 0x4b6f28
lea ecx, [ebp - 0x490]
call fcn.00403fe0
mov byte [ebp - 4], 0xa
push 0x4b6f2c
lea ecx, [ebp - 0x48c]
call fcn.00403fe0
mov byte [ebp - 4], 0xb
push str.docx
lea ecx, [ebp - 0x488]
call fcn.00403fe0
mov byte [ebp - 4], 0xc
push 0x4b6f35
lea ecx, [ebp - 0x484]
call fcn.00403fe0
mov byte [ebp - 4], 0xd
push str.xlsx
lea ecx, [ebp - 0x480]
call fcn.00403fe0
mov byte [ebp - 4], 0xe
push 0x4b6f3d
lea ecx, [ebp - 0x47c]
call fcn.00403fe0
mov byte [ebp - 4], 0xf
push str.pptx
lea ecx, [ebp - 0x478]
call fcn.00403fe0
mov byte [ebp - 4], 0x10
push 0x4b6f45
lea ecx, [ebp - 0x474]
call fcn.00403fe0
mov byte [ebp - 4], 0x11
push 0x4b6f46
lea ecx, [ebp - 0x470]
call fcn.00403fe0
mov byte [ebp - 4], 0x12
push 0x4b6f47
lea ecx, [ebp - 0x46c]
call fcn.00403fe0
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x670]
mov dword [ecx + 0x54], 1
lea ecx, [ebp - 0x3c]
call fcn.00415db0
mov dword [ebp - 0x4b0], 0
jmp 0x43ac68
mov edx, dword [ebp - 0x4b0]
add edx, 1
mov dword [ebp - 0x4b0], edx
mov eax, dword [ebp - 0x4b0]
lea ecx, [ebp + eax*8 - 0x4a8]
call fcn.00403590
movzx ecx, al
test ecx, ecx
jne 0x43aebf
mov edx, dword [ebp - 0x4b0]
lea ecx, [ebp + edx*8 - 0x4a8]
call fcn.00402160
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x4b4]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0040be70
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x4b0]
lea eax, [ebp + edx*8 - 0x4a8]
push eax
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0043be10
add esp, 8
movzx edx, al
test edx, edx
je 0x43aeab
push 0x4b6f48
mov eax, dword [ebp - 0x4b0]
lea ecx, [ebp + eax*8 - 0x4a4]
push ecx
call fcn.0043be30
add esp, 8
movzx edx, al
test edx, edx
je 0x43ae8d
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.ole32.dll_StgIsStorageFile]
test eax, eax
je 0x43ad2a
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43aebf
mov dword [ebp - 0x4e0], 0
lea ecx, [ebp - 0x4e0]
push ecx
push 0
push 0
push 0x12
push 0
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.ole32.dll_StgOpenStorage]
test eax, eax
je 0x43ad68
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43aebf
cmp dword [ebp - 0x4e0], 0
jne 0x43ad85
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43aebf
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d8], 0x4b6f4c
mov dword [ebp - 0x4d4], str.Workbook
mov dword [ebp - 0x4d0], str.WordBook
mov dword [ebp - 0x4cc], str.Word
mov dword [ebp - 0x4c8], str.WordDocument
mov dword [ebp - 0x4c4], str.PP40
mov dword [ebp - 0x4c0], str.PowerPoint
mov dword [ebp - 0x4bc], str.PowerPoint_Document
mov dword [ebp - 0x4e4], 0
jmp 0x43adfa
mov eax, dword [ebp - 0x4e4]
add eax, 1
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 8
jae 0x43ae3d
lea ecx, [ebp - 0x4dc]
push ecx
push 0
push 0x12
push 0
mov edx, dword [ebp - 0x4e4]
mov eax, dword [ebp + edx*4 - 0x4d8]
push eax
mov ecx, dword [ebp - 0x4e0]
push ecx
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx]
call dword [eax + 0x10]
cmp dword [ebp - 0x4dc], 0
je 0x43ae3b
jmp 0x43ae3d
jmp 0x43adeb
cmp dword [ebp - 0x4dc], 0
jne 0x43ae69
mov ecx, dword [ebp - 0x4e0]
push ecx
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx]
call dword [eax + 8]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43aebf
mov ecx, dword [ebp - 0x4dc]
push ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
call dword [eax + 8]
mov ecx, dword [ebp - 0x4e0]
push ecx
mov edx, dword [ebp - 0x4e0]
mov eax, dword [edx]
call dword [eax + 8]
mov ecx, dword [ebp - 0x670]
mov dword [ecx + 0x54], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43aebf
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4b4]
call fcn.004020c0
jmp 0x43ac59
mov edx, dword [ebp - 0x670]
cmp dword [edx + 0x54], 0
je 0x43aef8
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea eax, [ebp - 0x4a8]
push eax
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
jmp 0x43b59d
push 0
push 4
push 0
push 0
mov ecx, dword [ebp - 0x670]
push ecx
push 0x43a6b0
call fcn.00494984
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jne 0x43b269
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a362e
mov dword [ebp - 0x674], eax
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x608]
push edx
lea ecx, [ebp - 0x580]
call fcn.004a3592
mov dword [ebp - 0x678], eax
mov byte [ebp - 4], 0x17
push 0
push 0
push 1
push 0x4c0120
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
lea ecx, [ebp - 0x580]
call fcn.004a27db
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jne 0x43afd6
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x580]
call fcn.004a2421
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a3db1
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea eax, [ebp - 0x4a8]
push eax
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
mov byte [ebp - 4], 2
jmp 0x43b59d
push 1
lea ecx, [ebp - 0x580]
call fcn.004a2af4
lea ecx, [ebp - 0x4f0]
call fcn.00433df0
push 0xffffffffffffffff
lea ecx, [ebp - 0x4f0]
push ecx
lea ecx, [ebp - 0x580]
call fcn.004a1f8e
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 0
jne 0x43b060
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x580]
call fcn.004a2421
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a3db1
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea edx, [ebp - 0x4a8]
push edx
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
mov byte [ebp - 4], 2
jmp 0x43b59d
call fcn.0042e7c0
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x4e8], eax
mov ecx, dword [ebp - 0x4e8]
call fcn.0042e770
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
mov dword [ebp - 0x504], ecx
lea edx, [ebp - 0x4f0]
push edx
mov ecx, dword [ebp - 0x504]
call fcn.0049ba10
mov eax, dword [ebp - 0x504]
push eax
mov ecx, dword [ebp - 0x4e8]
call fcn.0042e790
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.0043a5c0
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0
jne 0x43b138
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x580]
call fcn.004a2421
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a3db1
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea edx, [ebp - 0x4a8]
push edx
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
mov byte [ebp - 4], 2
jmp 0x43b59d
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0
push 0
lea ecx, [ebp - 0x500]
call fcn.00401f00
push 0xffffff
lea ecx, [ebp - 0x500]
call fcn.00433df0
push eax
mov edx, dword [ebp - 0x670]
mov ecx, dword [edx + 0x68]
call fcn.0049b8ca
push 0xffffffffffffffff
lea ecx, [ebp - 0x500]
call fcn.00433df0
push eax
mov eax, dword [ebp - 0x670]
mov ecx, dword [eax + 0x68]
push ecx
lea ecx, [ebp - 0x580]
call fcn.004a2b27
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0
jne 0x43b20a
mov edx, dword [ebp - 0x670]
mov ecx, dword [edx + 0x68]
call fcn.0049670a
mov eax, dword [ebp - 0x670]
mov dword [eax + 0x68], 0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x580]
call fcn.004a2421
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a3db1
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea ecx, [ebp - 0x4a8]
push ecx
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
mov byte [ebp - 4], 2
jmp 0x43b59d
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x580]
call fcn.004a2421
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x608]
call fcn.004a3db1
jmp 0x43b25d
mov dword [ebp - 4], 0x13
jmp 0x43b42c
mov eax, dword [ebp - 0x4ac]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x4ac]
call fcn.0043bdf0
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x628], 0
jmp 0x43b2a6
mov ecx, dword [ebp - 0x628]
add ecx, 0xa
mov dword [ebp - 0x628], ecx
cmp dword [ebp - 0x628], 0x7530
jge 0x43b317
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x644]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x43b2f2
cmp dword [ebp - 0x640], 0x203
jne 0x43b2d9
jmp 0x43b317
cmp dword [ebp - 0x640], 0x202
jne 0x43b2f2
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0xa
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
jne 0x43b315
jmp 0x43b317
jmp 0x43b297
push 0x64
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x60c], eax
mov edx, dword [ebp - 0x4ac]
mov dword [edx + 0x24], 1
cmp dword [ebp - 0x60c], 0x102
jne 0x43b3b0
push 0
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4ac]
call dword [eax + 0x78]
mov ecx, dword [ebp - 0x670]
mov dword [ecx + 0x50], 1
mov ecx, dword [ebp - 0x670]
call fcn.0043b720
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea edx, [ebp - 0x4a8]
push edx
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
jmp 0x43b59d
mov eax, dword [ebp - 0x4ac]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4ac]
call dword [edx + 0x78]
mov eax, dword [ebp - 0x670]
cmp dword [eax + 0x78], 0
je 0x43b405
mov ecx, dword [ebp - 0x670]
call fcn.0043b720
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea ecx, [ebp - 0x4a8]
push ecx
call fcn.0047d422
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
jmp 0x43b59d
lea edx, [ebp - 0x624]
push edx
mov ecx, dword [ebp - 0x670]
add ecx, 0x60
call fcn.0041c8f0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x61c]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 3
push fcn.004020c0
push 0x10
push 4
lea edx, [ebp - 0x4a8]
push edx
call fcn.0047d422
jmp 0x43b4e9
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.0043a5c0
test eax, eax
jne 0x43b472
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
jmp 0x43b59d
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x68]
call fcn.00404d00
push eax
lea ecx, [ebp - 0x64c]
call fcn.0042e6c0
mov byte [ebp - 4], 0x19
push 0xffffff
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0
push 0
lea ecx, [ebp - 0x65c]
call fcn.00401f00
mov ecx, eax
call fcn.00433df0
push eax
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x68]
call fcn.0049b8ca
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 0
push 0
lea edx, [ebp - 0x468]
push edx
lea ecx, [ebp - 0x64c]
call fcn.0042e720
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64c]
call fcn.0042e700
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x664]
call fcn.00401ed0
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x670]
mov edx, dword [ecx + 0x68]
push edx
mov eax, dword [ebp - 0x670]
mov ecx, dword [eax + 0x80]
call fcn.0042dcc0
mov ecx, dword [ebp - 0x670]
mov ecx, dword [ecx + 0x80]
call fcn.00406d50
test eax, eax
jne 0x43b546
push 4
mov edx, dword [ebp - 0x670]
mov ecx, dword [edx + 0x80]
call fcn.004921fb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x468]
call fcn.0042e8d0
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x668], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401c70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004020c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004020c0
mov eax, dword [ebp - 0x668]
jmp 0x43b5e3
lea ecx, [ebp - 0x3c]
call fcn.00429470
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x66c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401c70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004020c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004020c0
mov eax, dword [ebp - 0x66c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0047bda9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret