Function at 0x411b60
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x8659a919
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
sub eax, 0x8659a919
je 0x411c84
jmp 0x411b88
mov eax, dword [ebp - 0x1c]
sub eax, 0x99e56135
je 0x411d74
jmp 0x411b9b
mov eax, dword [ebp - 0x1c]
sub eax, 0xb2fda85f
je 0x411e0e
jmp 0x411bae
mov eax, dword [ebp - 0x1c]
sub eax, 0xb44da002
je 0x411ea7
jmp 0x411bc1
mov eax, dword [ebp - 0x1c]
sub eax, 0xc6bc53eb
je 0x411e8c
jmp 0x411bd4
mov eax, dword [ebp - 0x1c]
sub eax, 0xdf9559f1
je 0x411eb3
jmp 0x411be7
mov eax, dword [ebp - 0x1c]
sub eax, 0xee7525ed
je 0x411cef
jmp 0x411bfa
mov eax, dword [ebp - 0x1c]
sub eax, 0x5ecf67a
je 0x411e66
jmp 0x411c0d
mov eax, dword [ebp - 0x1c]
sub eax, 0x2b30c857
je 0x411e72
jmp 0x411c20
mov eax, dword [ebp - 0x1c]
sub eax, 0x2b3bf8e1
je 0x411ec6
jmp 0x411c33
mov eax, dword [ebp - 0x1c]
sub eax, 0x57ff75c6
je 0x411ee1
jmp 0x411c46
mov eax, dword [ebp - 0x1c]
sub eax, 0x596e9db4
je 0x411d9b
jmp 0x411c59
mov eax, dword [ebp - 0x1c]
sub eax, 0x6514d76e
je 0x411d80
jmp 0x411c6c
mov eax, dword [ebp - 0x1c]
sub eax, 0x68e21e9b
je 0x411ebf
jmp 0x411c7f
jmp 0x411ef7
mov ecx, dword [0x44256c]
mov eax, dword [0x442568]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2b3bf8e1
mov ecx, 0xee7525ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [0x44256c]
mov eax, dword [0x442568]
mov edx, ecx
sub edx, 0x4dd58966
sub edx, 1
add edx, 0x4dd58966
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2b3bf8e1
mov ecx, 0x99e56135
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov dword [ebp - 0x18], 0x6514d76e
jmp 0x411ef7
mov edx, dword [ebp - 0x14]
mov eax, 0x68e21e9b
mov ecx, 0x596e9db4
cmp edx, 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov ecx, dword [0x44256c]
mov eax, dword [0x442568]
mov edx, ecx
add edx, 0xac131d11
sub edx, 1
sub edx, 0xac131d11
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x57ff75c6
mov ecx, 0xb2fda85f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [0x44256c]
mov ecx, dword [0x442568]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57ff75c6
mov ecx, 0x5ecf67a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov dword [ebp - 0x18], 0x2b30c857
jmp 0x411ef7
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0xc6bc53eb
jmp 0x411ef7
mov dl, byte [ebp - 9]
mov eax, 0xb44da002
mov ecx, 0xdf9559f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x411ef7
mov dword [ebp - 0x18], 0x68e21e9b
jmp 0x411ef7
mov dword [ebp - 0x18], 0x68e21e9b
jmp 0x411ef7
add esp, 0x18
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x18], 0xee7525ed
jmp 0x411ef7
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 0x18], 0xb2fda85f
jmp 0x411b72