Function at 0x434df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe840
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx - 8], esi
je 0x435031
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
cmp dword [eax - 8], esi
je 0x435031
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x20], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ebx, [ebx]
cmp byte [ebp - 0x11], 0
je 0x434fc5
cmp esi, 3
jge 0x434f53
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041ea10
mov byte [ebp - 4], 1
push 0x514670
lea ecx, [ebp - 0x1c]
call fcn.0041d470
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x18]
call fcn.0041ea10
mov byte [ebp - 4], 2
push 0x514670
lea ecx, [ebp - 0x18]
call fcn.0041d470
mov eax, esi
sub eax, 0
je 0x434f05
dec eax
je 0x434ece
dec eax
jne 0x434f32
push str.misc_vault.dat
lea ecx, [ebp - 0x1c]
call fcn.0041d470
push str.misc_vault.dat
jmp 0x434f17
push str.pwd_vault.dat
lea ecx, [ebp - 0x1c]
call fcn.0041d470
push str.pwd_vault.dat
lea ecx, [ebp - 0x18]
call fcn.0041d470
push 1
push 0
mov edi, dword [ebp - 0x18]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x434f32
push 1
mov edx, dword [ebp - 0x1c]
push edx
push edi
jmp 0x434f29
push str.ewallet.dat
lea ecx, [ebp - 0x1c]
call fcn.0041d470
push str.ewallet.dat
lea ecx, [ebp - 0x18]
call fcn.0041d470
push 1
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x434f32
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00416630
inc esi
mov dword [ebp - 0x20], esi
jmp 0x434e60
dec esi
mov dword [ebp - 0x20], esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ecx]
test esi, esi
js 0x435031
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0041ea10
mov byte [ebp - 4], 3
push 0x514670
lea ecx, [ebp - 0x1c]
call fcn.0041d470
mov eax, esi
sub eax, 0
je 0x434fa0
dec eax
je 0x434f99
dec eax
jne 0x434fad
push str.misc_vault.dat
jmp 0x434fa5
push str.pwd_vault.dat
jmp 0x434fa5
push str.ewallet.dat
lea ecx, [ebp - 0x1c]
call fcn.0041d470
mov eax, dword [ebp - 0x1c]
push eax
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00416630
dec esi
mov dword [ebp - 0x20], esi
jmp 0x434f60
dec esi
mov dword [ebp - 0x20], esi
mov bl, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
js 0x435031
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041ea10
mov byte [ebp - 4], bl
push 0x514670
lea ecx, [ebp - 0x1c]
call fcn.0041d470
mov eax, esi
sub eax, 0
je 0x43500c
dec eax
je 0x435005
dec eax
jne 0x435019
push str.misc_vault.dat
jmp 0x435011
push str.pwd_vault.dat
jmp 0x435011
push str.ewallet.dat
lea ecx, [ebp - 0x1c]
call fcn.0041d470
mov edx, dword [ebp - 0x1c]
push edx
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00416630
dec esi
mov dword [ebp - 0x20], esi
jmp 0x434fd1
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret