Function at 0x420be0
Capabilities:
Delete file
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x480394]
push esi
push edi
push 0
push 0
push 0
push eax
call dword [sym.imp.MSVCR100.dll__fseeki64]
mov ecx, dword [0x480394]
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push ecx
push 1
lea edx, [esp + 0x24]
push 6
push edx
call esi
push 6
lea eax, [esp + 0x30]
push str.SSHCM2
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x2c
test eax, eax
je 0x420d57
push str.Not_a_valid_mdm_file._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x420ccd
cmp dword [0x489ad0], 0
je 0x420ccd
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x420ca0
mov ecx, dword [0x489ad0]
push ecx
call dword [sym.imp.MSVCR100.dll__ftelli64]
add esp, 4
push edx
mov edx, dword [0x489ad0]
push eax
push edx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x420cbd
mov eax, dword [0x489ad0]
push str.__body___html__n
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov ecx, dword [0x489ad0]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov edx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push edx
call esi
mov eax, dword [0x4899d8]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802bc]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802cc]
add esp, 4
push edx
call esi
mov eax, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push eax
call esi
mov ecx, dword [0x4899d8]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802bc]
add esp, 4
push edx
call esi
mov eax, dword [0x4802cc]
add esp, 4
push eax
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x420d4f
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [0x480394]
push ecx
push 1
push 4
push 0x468eb8
call esi
fld dword [0x468eb8]
fcomp qword [0x466e68]
add esp, 0x10
fnstsw ax
test ah, 5
jp 0x420e9d
push str.You_will_have_to_remake_this_mdm_file.__Sorry__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x420e13
cmp dword [0x489ad0], 0
je 0x420e13
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x420de5
mov edx, dword [0x489ad0]
push edx
call dword [sym.imp.MSVCR100.dll__ftelli64]
add esp, 4
push edx
push eax
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x420e03
mov ecx, dword [0x489ad0]
push str.__body___html__n
push ecx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov edx, dword [0x489ad0]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov eax, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push eax
call esi
mov ecx, dword [0x4899d8]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802bc]
add esp, 4
push edx
call esi
mov eax, dword [0x4802cc]
add esp, 4
push eax
call esi
mov ecx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push ecx
call esi
mov edx, dword [0x4899d8]
add esp, 4
push edx
call esi
mov eax, dword [0x4802bc]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802cc]
add esp, 4
push ecx
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x420e95
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov edx, dword [0x480394]
push edx
push 1
push 4
push 0x489ac8
call esi
mov eax, dword [0x480394]
push eax
push 1
push 4
push 0x476e24
call esi
mov ecx, dword [0x480394]
push ecx
push 1
push 4
push 0x4804ac
call esi
mov edx, dword [0x480394]
push edx
push 1
push 4
push 0x4a5b24
call esi
mov eax, dword [0x480394]
add esp, 0x40
push eax
push 1
push 4
push 0x4802e0
call esi
mov ecx, dword [0x480394]
push ecx
push 1
push 4
push 0x4a5b2c
call esi
mov edx, dword [0x480394]
push edx
push 1
push 4
push 0x489a98
call esi
mov eax, dword [0x480394]
push eax
push 1
push 4
push 0x476d10
call esi
mov ecx, dword [0x480394]
add esp, 0x40
push ecx
push 1
push 4
push 0x489aac
call esi
mov eax, dword [0x489aac]
add esp, 0x10
test eax, eax
jns 0x420f5c
neg eax
mov dword [0x476bc4], 1
jmp 0x420f66
mov dword [0x476bc4], 0
mov edx, dword [0x480394]
push edx
push 1
push 4
push 0x489aac
mov dword [0x489ae4], eax
call esi
mov edi, dword [0x489ac8]
inc edi
imul edi, edi, 0xd
add esp, 0x10
call fcn.00409ea0
mov ecx, dword [0x4601f8]
mov dword [eax], ecx
mov edx, dword [0x4601fc]
mov dword [eax + 4], edx
mov ecx, dword [0x460200]
mov dword [eax + 8], ecx
movzx edx, byte [0x460204]
mov byte [eax + 0xc], dl
mov edi, dword [0x476e24]
inc edi
imul edi, edi, 0xd
mov dword [0x489aa4], eax
mov dword [0x476d00], eax
call fcn.00409ea0
mov ecx, dword [str._ICPTROW]
mov dword [eax], ecx
mov edx, dword [0x46020c]
mov dword [eax + 4], edx
mov ecx, dword [0x460210]
mov dword [eax + 8], ecx
movzx edx, byte [0x460214]
mov byte [eax + 0xc], dl
mov edi, dword [0x4804ac]
inc edi
imul edi, edi, 0xd
mov dword [0x4804c8], eax
mov dword [0x476d04], eax
call fcn.00409ea0
mov ecx, dword [str._ICPTCOL]
mov dword [eax], ecx
mov edx, dword [0x46021c]
mov dword [eax + 4], edx
mov ecx, dword [0x460220]
mov dword [eax + 8], ecx
movzx edx, byte [0x460224]
mov byte [eax + 0xc], dl
mov ecx, dword [0x489ac8]
inc ecx
imul ecx, ecx, 0xd
mov dword [0x4695ec], eax
mov dword [0x476d08], eax
test ecx, ecx
je 0x42105f
mov eax, dword [0x480394]
push eax
push 1
push ecx
mov ecx, dword [0x489aa4]
push ecx
call esi
mov eax, dword [0x4695ec]
add esp, 0x10
mov ecx, dword [0x476e24]
inc ecx
imul ecx, ecx, 0xd
test ecx, ecx
je 0x421087
mov edx, dword [0x480394]
mov eax, dword [0x4804c8]
push edx
push 1
push ecx
push eax
call esi
mov eax, dword [0x4695ec]
add esp, 0x10
mov ecx, dword [0x4804ac]
inc ecx
imul ecx, ecx, 0xd
test ecx, ecx
je 0x4210a5
mov edx, dword [0x480394]
push edx
push 1
push ecx
push eax
call esi
add esp, 0x10
mov eax, dword [0x480394]
push eax
push 1
lea ecx, [esp + 0x10]
push 4
push ecx
call esi
mov eax, dword [esp + 0x18]
add esp, 0x10
lea edi, [eax + eax*2]
call fcn.00409ea0
mov ecx, dword [esp + 8]
lea edx, [eax + ecx]
mov dword [0x4695d4], edx
add edx, ecx
mov dword [0x4695d0], eax
mov dword [0x4695d8], edx
test ecx, ecx
je 0x42112f
mov edx, dword [0x480394]
push edx
push 1
push ecx
push eax
call esi
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
je 0x42112f
mov ecx, dword [0x480394]
mov edx, dword [0x4695d4]
push ecx
push 1
push eax
push edx
call esi
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
je 0x42112f
mov ecx, dword [0x480394]
mov edx, dword [0x4695d8]
push ecx
push 1
push eax
push edx
call esi
add esp, 0x10
mov eax, dword [0x476e24]
mov edx, dword [0x4804ac]
mov ecx, dword [0x468ec0]
lea edi, [edx + eax]
add edi, dword [0x489ac8]
mov dword [ecx + 0x3c], eax
add edi, edi
add edi, edi
add edi, edi
mov dword [ecx + 0x74], edx
mov dword [esp + 8], edi
call fcn.00409ea0
mov edi, dword [0x489ac8]
mov edx, dword [0x476e24]
lea ecx, [eax + edi*8]
mov dword [0x4804e8], ecx
lea ecx, [ecx + edx*8]
mov dword [0x489b24], ecx
mov ecx, dword [0x4804ac]
add ecx, edx
add ecx, edi
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov dword [0x476e2c], eax
je 0x4211a9
mov edx, dword [0x480394]
push edx
push 1
push ecx
push eax
call esi
mov edx, dword [0x476e24]
add esp, 0x10
mov edi, dword [0x4802e0]
imul edi, edx
add edi, edi
add edi, edi
add edi, edi
call fcn.00409ea0
mov edi, dword [0x4a5b2c]
imul edi, dword [0x4804ac]
add edi, edi
add edi, edi
add edi, edi
mov dword [0x4a5b5c], eax
call fcn.00409ea0
cmp dword [0x476bc4], 0
mov edi, dword [0x4802e0]
mov dword [0x4804d4], eax
je 0x421216
add edi, edi
add edi, edi
add edi, edi
call fcn.00409ea0
mov edi, dword [0x4a5b2c]
add edi, edi
add edi, edi
add edi, edi
mov dword [0x489ab0], eax
call fcn.00409ea0
mov dword [0x489adc], eax
jmp 0x421240
mov eax, dword [0x4a5b5c]
imul edi, edi, 0xd
mov dword [0x489adc], eax
call fcn.00409ea0
mov edi, dword [0x4a5b2c]
imul edi, edi, 0xd
mov dword [0x476d0c], eax
call fcn.00409ea0
mov dword [0x4a5b34], eax
cmp dword [0x476bc4], 0
mov ecx, dword [0x4802e0]
je 0x421262
lea eax, [ecx*8]
test eax, eax
je 0x421287
mov edx, dword [0x489ab0]
jmp 0x421271
mov eax, ecx
imul eax, eax, 0xd
test eax, eax
je 0x421287
mov edx, dword [0x476d0c]
mov ecx, dword [0x480394]
push ecx
push 1
push eax
push edx
call esi
mov ecx, dword [0x4802e0]
add esp, 0x10
imul ecx, dword [0x476e24]
add ecx, ecx
add ecx, ecx
add ecx, ecx
je 0x4212ab
mov eax, dword [0x480394]
push eax
push 1
push ecx
mov ecx, dword [0x4a5b5c]
push ecx
call esi
add esp, 0x10
cmp dword [0x476bc4], 0
mov eax, dword [0x4a5b2c]
je 0x4212cb
lea ecx, [eax*8]
test ecx, ecx
je 0x4212ee
mov eax, dword [0x489adc]
jmp 0x4212d9
mov ecx, eax
imul ecx, ecx, 0xd
test ecx, ecx
je 0x4212ee
mov eax, dword [0x4a5b34]
mov edx, dword [0x480394]
push edx
push 1
push ecx
push eax
call esi
mov eax, dword [0x4a5b2c]
add esp, 0x10
imul eax, dword [0x4804ac]
add eax, eax
add eax, eax
add eax, eax
je 0x421313
mov ecx, dword [0x480394]
mov edx, dword [0x4804d4]
push ecx
push 1
push eax
push edx
call esi
add esp, 0x10
mov eax, dword [0x480394]
push eax
call dword [sym.imp.MSVCR100.dll__ftelli64]
add esp, 4
mov dword [0x4a5b18], eax
mov dword [0x4a5b1c], edx
call fcn.00403500
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.0045d089
mov esp, ebp
pop ebp
ret