Function at 0x443e70
Capabilities:
Delete file

Disassembly:
sub esp, 0x110
cmp edx, 9
push ebx
push ebp
push esi
push edi
mov ebp, ecx
jb 0x4440c8
xor eax, eax
mov ax, word [ebp + 7]
add eax, 9
cmp edx, eax
jne 0x4440c8
mov eax, dword [0x645060]
xor ebx, ebx
test eax, eax
mov cl, byte [ebp + 2]
mov dl, byte [ebp + 1]
setle bl
dec ebx
and ebx, eax
test ebx, ebx
jle 0x443ec9
cmp byte [ebx + 8], dl
jne 0x443eb9
cmp byte [ebx + 9], cl
je 0x443ecb
test ebx, ebx
jne 0x443ec2
mov ebx, 0x64505c
mov ebx, dword [ebx + 4]
test ebx, ebx
jg 0x443eaf
xor ebx, ebx
test ebx, ebx
je 0x4440c8
mov eax, dword [ebp + 3]
mov ecx, dword [ebx + 0xc]
cmp eax, ecx
je 0x444094
xor edx, edx
mov esi, eax
mov dx, word [ebp + 7]
add esi, edx
cmp esi, ecx
ja 0x444094
cmp eax, dword [ebx + 0x40]
jne 0x444068
mov al, byte [ebx + 0x34]
mov edx, dword [ebx + 0x44]
or al, 4
xor ecx, ecx
mov byte [ebx + 0x34], al
mov al, byte [esp + 0x124]
mov byte [ebx + 0x3d], al
mov edi, dword [ebp + 3]
mov cx, word [ebp + 7]
add edi, edx
mov edx, ecx
lea esi, [ebp + 9]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [ebp + 7]
mov edx, dword [ebx + 0x40]
add edx, eax
mov dword [ebx + 0x40], edx
mov eax, dword [0x645078]
test eax, eax
je 0x443f6b
mov cl, byte [ebx + 8]
mov dl, byte [ebx + 9]
mov byte [esp + 0x15], cl
mov ecx, dword [ebx + 0x40]
mov byte [esp + 0x16], dl
mov dl, byte [ebx + 0x3d]
mov dword [esp + 0x17], ecx
push edx
lea ecx, [esp + 0x18]
push 7
push ecx
mov byte [esp + 0x20], 5
call eax
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x40]
cmp eax, edx
jne 0x443f98
mov ecx, dword [ebx + 0x44]
call fcn.0040e240
cmp eax, dword [ebx + 0x10]
je 0x443faa
mov al, byte [ebx + 0x34]
mov ecx, ebx
and al, 0xfb
mov dword [ebx + 0x40], 0
mov byte [ebx + 0x34], al
call fcn.00443490
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0x104
lea edx, [esp + 0x20]
push 0x644f50
push edx
call sub.Storm.dll_Ordinal_501
lea eax, [ebx + 0x14]
lea ecx, [esp + 0x1c]
push 0x104
push eax
push ecx
call sub.Storm.dll_Ordinal_503
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.0046a7d0
mov ecx, 0x644f50
call fcn.004dc160
test eax, eax
jne 0x443fee
xor edi, edi
jmp 0x444030
mov edx, 0x17
lea ecx, [esp + 0x1c]
call fcn.004dbb00
mov esi, eax
test esi, esi
jne 0x444006
xor edi, edi
jmp 0x444030
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x44]
push esi
call fcn.004dbbf0
mov ecx, esi
mov edi, eax
call fcn.004dbaf0
test eax, eax
je 0x444021
xor edi, edi
test edi, edi
jne 0x444034
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test edi, edi
je 0x444055
mov al, byte [ebx + 0x34]
mov ecx, ebx
and al, 0xfb
mov byte [ebx + 0x34], al
call fcn.00443490
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov byte [ebx + 0x34], 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, dword [0x645078]
test eax, eax
je 0x4440c1
mov cl, byte [ebx + 8]
mov dl, byte [ebx + 9]
mov byte [esp + 0x11], cl
mov ecx, dword [esp + 0x124]
mov byte [esp + 0x12], dl
push ecx
mov byte [esp + 0x14], 6
push 3
lea edx, [esp + 0x18]
jmp 0x4440be
mov eax, dword [0x645078]
test eax, eax
je 0x4440c1
mov cl, byte [ebx + 8]
mov dl, byte [ebx + 9]
mov byte [esp + 0x11], cl
mov ecx, dword [esp + 0x124]
mov byte [esp + 0x12], dl
push ecx
mov byte [esp + 0x14], 6
push 3
lea edx, [esp + 0x18]
push edx
call eax
mov ecx, ebx
call fcn.00443490
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4