Function at 0x4027f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x12c
mov dword [esp + 0x3c], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
push 0x12c
push ebp
call fcn.00416d90
push 0x64
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0x64
mov dword [esp + 0x48], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
push 0x64
push ebx
mov dword [esp + 0x48], esi
call fcn.00416d90
push 0x64
push esi
call fcn.00416d90
add esp, 0x24
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x18]
cmp eax, 5
ja case.default.0x402866
jmp dword [eax*4 + 0x402f74]
push 0x2c
mov dword [esp + 0x14], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
add eax, 0x608
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00412770
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x20]
push edx
push edi
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x1c]
push ecx
push edx
mov dword [esp + 0x34], 1
call fcn.00414910
add esp, 0x1c
cmp eax, 1
jne 0x402a09
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], eax
mov edx, dword [eax + 0x20]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00414890
add esp, 0xc
cmp eax, 1
jne 0x402a09
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push esi
push ebx
mov dword [esp + 0x28], ecx
call fcn.00403f90
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push esi
push ebx
push eax
call fcn.00401b50
add esp, 0x18
cmp eax, edi
mov dword [esp + 0x30], eax
je 0x402a09
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push esi
call fcn.004025c0
lea edx, [esp + 0x28]
push 1
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
push edi
mov dword [esp + 0x40], esi
call fcn.00401d10
add esp, 0x1c
cmp eax, 1
jne 0x402a09
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], 2
mov eax, dword [edx + 0x18]
push eax
call sub.MSVCRT.dll_atoi
mov ecx, dword [esp + 0x48]
mov esi, eax
mov edx, dword [ecx + 0x18]
push edx
call sub.MSVCRT.dll_atoi
add esp, 8
cmp esi, eax
jl 0x402a09
mov edi, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x48]
push edi
push eax
push ecx
push esi
mov dword [esp + 0x28], 4
call fcn.004021b0
add esp, 0x10
test eax, eax
jne 0x402a07
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov dword [eax + 0xc], 0
mov eax, dword [esi]
mov dword [esp + 0x18], edx
push eax
call fcn.00402720
add esp, 4
mov eax, edi
mov ecx, 0x64
add eax, 4
dec ecx
mov dword [eax], 0xffffffff
jne 0x4029cd
mov ecx, dword [esp + 0x1c]
mov dword [edi], 0
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push esi
call fcn.004026e0
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esp + 0x18], 1
mov dword [eax + 0xc], ecx
xor edi, edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x402a1e
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x402a2f
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.0040c500
mov eax, dword [esp + 0x3c]
add esp, 4
cmp eax, 1
mov dword [esp + 0x14], edi
jne case.default.0x402866
cmp dword [esp + 0x18], 4
je case.default.0x402866
mov dword [esp + 0x18], 3
jmp case.default.0x402866
mov ebx, dword [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
push 0x41e0c8
mov edi, dword [ebx + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x2c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x48]
add eax, 0x608
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00412770
mov eax, dword [ebx + 0x14]
lea edx, [esp + 0x24]
push edx
push 0
push eax
push ebp
mov dword [esp + 0x38], 2
call fcn.00414910
add esp, 0x20
cmp eax, 1
jne 0x402d46
mov eax, dword [esp + 0x14]
xor esi, esi
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
jle 0x402d46
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x18]
push eax
call sub.MSVCRT.dll_atoi
mov ecx, dword [ebx + 0x18]
mov edi, eax
push ecx
call sub.MSVCRT.dll_atoi
add esp, 8
cmp edi, eax
jg 0x402b44
mov edx, dword [esp + 0x14]
inc esi
cmp esi, dword [edx + 8]
jl 0x402b16
jmp 0x402d46
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
mov edx, dword [ecx + 0x20]
push edx
push eax
call fcn.00414890
add esp, 0xc
cmp eax, 1
jne 0x402d46
push 0x41e0c4
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push str.UI
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_strstr
push eax
mov dword [esp + 0x38], eax
call fcn.00416df0
add esp, 0x14
test eax, eax
je 0x402be2
call fcn.00416db0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
add ecx, 6
mov esi, dword [esp + 0x48]
sub eax, ecx
add eax, edi
mov edi, dword [esp + 0x54]
push edi
push ecx
push eax
push esi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
call fcn.004021b0
add esp, 0x10
cmp eax, 1
jne 0x402cf3
mov edi, dword [ebx + 0x1c]
or ecx, 0xffffffff
xor eax, eax
push 0x41e0b8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, dword [eax + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, dword [eax + 0x18]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp eax, 1
jne 0x402d31
mov dword [esp + 0x18], 4
jmp 0x402d31
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov dword [eax + 0xc], 0
mov ecx, dword [esi]
push ecx
call fcn.00402720
add esp, 4
mov eax, edi
mov ecx, 0x64
add eax, 4
dec ecx
mov dword [eax], 0xffffffff
jne 0x402d11
push esi
mov dword [edi], 0
call fcn.004026e0
mov edx, dword [esi]
add esp, 4
mov dword [edx + 0xc], ebx
mov eax, dword [esp + 0x10]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040c500
mov ebx, dword [esp + 0x38]
add esp, 4
mov dword [esp + 0x14], 0
xor edi, edi
jmp case.default.0x402866
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x28]
add eax, 0x28
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00414890
add esp, 0xc
cmp eax, 1
jne 0x402ef3
mov edx, dword [esp + 0x2c]
push edx
push ebx
call fcn.00403f90
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
push ebx
push eax
push ecx
call fcn.00415030
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x3c]
push edx
push eax
push ecx
call fcn.00415030
add esp, 0x20
cmp esi, edi
mov edx, eax
jg 0x402dcb
cmp edx, edi
jle 0x402ee6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
sub edx, esi
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
mov edi, ebx
not ecx
dec ecx
add eax, esi
sub eax, ecx
or ecx, 0xffffffff
mov dword [esp + 0x24], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, edx
mov dword [esp + 0x20], ecx
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, eax
mov edx, ecx
mov edi, ebx
push 0x41e0b8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x4c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x28]
or ecx, 0xffffffff
mov byte [ebx + eax], 0
mov edi, dword [edx + 0x1c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
mov eax, dword [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [eax + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x2c]
push eax
push ebp
push ebx
call fcn.00414790
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebx, dword [esp + 0x50]
add esp, 0x1c
xor edi, edi
mov ecx, dword [esp + 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x38], 1
mov dword [esp + 0x18], edi
jmp case.default.0x402866
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x48]
push edx
push eax
push ecx
push esi
call fcn.004021b0
add esp, 0x10
test eax, eax
jne 0x402f3c
mov edx, dword [esi]
push edx
call fcn.00402720
add esp, 4
mov dword [esp + 0x18], 5
jmp case.default.0x402866
mov dword [esp + 0x18], 4
jmp case.default.0x402866
mov edi, 1
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x34]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret