Function at 0x428340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42aa64
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x434150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x81], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0x7c]
call fcn.00401160
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401160
mov byte [ebp - 4], 1
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0x4c]
push eax
call fcn.0042a190
add esp, 4
mov byte [ebp - 4], 2
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0xb8]
call fcn.00401160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.00401e70
push eax
call fcn.0042a310
add esp, 8
cmp dword [ebp - 0x54], 0
je 0x428439
mov edx, dword [ebp - 0x54]
push edx
lea ecx, [ebp - 0x4c]
call fcn.00401e40
lea ecx, [ebp - 0x7c]
call fcn.00401da0
lea ecx, [ebp - 0x30]
call fcn.00401da0
lea ecx, [ebp - 0x4c]
call fcn.00401e00
test eax, eax
je 0x4284a5
push 0x4e4
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00401e70
push eax
call fcn.004259f0
add esp, 0xc
cmp dword [ebp - 0xbc], 0
je 0x4284a5
mov ecx, dword [ebp - 0xbc]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.00401280
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0xf0]
push eax
call fcn.004114ba
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00401da0
cmp dword [ebp + 0xc], 0
je 0x4284d9
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041141b
add esp, 4
test eax, eax
je 0x4284d9
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00426000
add esp, 8
lea ecx, [ebp - 0x7c]
call fcn.00401e00
test eax, eax
je 0x428528
lea ecx, [ebp - 0xb8]
call fcn.00401e00
test eax, eax
je 0x428528
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00401230
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf4], esp
lea edx, [ebp - 0x7c]
push edx
call fcn.004019b0
mov dword [ebp - 0x100], eax
call fcn.00426870
add esp, 0x24
jmp 0x428566
lea ecx, [ebp - 0x7c]
call fcn.00401e00
test eax, eax
je 0x42853f
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x104], eax
jmp 0x42854b
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401250
lea ecx, [ebp - 0x30]
push ecx
call fcn.00426ac0
add esp, 4
cmp dword [ebp + 8], 0
je 0x428598
mov edx, dword [ebp + 8]
push edx
call fcn.00427de0
add esp, 4
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428598
jmp 0x428c07
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x94]
push ecx
push 0x42f33c
push 0
call fcn.0040ff30
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x4285c6
jmp 0x428c07
push 1
mov edx, dword [ebp - 0x94]
movzx eax, byte [edx + 1]
imul eax, eax, 0x468
push eax
call fcn.00410640
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x42860c
mov dword [ebp - 0x98], 0x8007000e
mov ecx, dword [ebp - 0x98]
push ecx
push 0x3a1
push 0x42f348
call fcn.00410700
jmp 0x428c07
mov edx, dword [ebp - 0x94]
movzx eax, byte [edx + 1]
imul eax, eax, 0xa8
mov ecx, dword [ebp - 0x94]
lea edx, [ecx + eax + 4]
mov dword [ebp - 0x88], edx
mov byte [ebp - 0xbd], 0
jmp 0x428643
mov al, byte [ebp - 0xbd]
add al, 1
mov byte [ebp - 0xbd], al
movzx ecx, byte [ebp - 0xbd]
mov edx, dword [ebp - 0x94]
movzx eax, byte [edx + 2]
cmp ecx, eax
jge 0x4286b3
movzx ecx, byte [ebp - 0xbd]
shl ecx, 4
add ecx, dword [ebp - 0x88]
mov dword [ebp - 0xc4], ecx
push 1
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004270d0
add esp, 0xc
test eax, eax
je 0x4286b1
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call fcn.004271b0
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x4286b1
jmp 0x428c07
jmp 0x428635
cmp dword [ebp - 0x5c], 0
jne 0x428745
mov byte [ebp - 0xc5], 0
jmp 0x4286d5
mov cl, byte [ebp - 0xc5]
add cl, 1
mov byte [ebp - 0xc5], cl
movzx edx, byte [ebp - 0xc5]
mov eax, dword [ebp - 0x94]
movzx ecx, byte [eax + 2]
cmp edx, ecx
jge 0x428745
movzx edx, byte [ebp - 0xc5]
shl edx, 4
add edx, dword [ebp - 0x88]
mov dword [ebp - 0xcc], edx
push 0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004270d0
add esp, 0xc
test eax, eax
je 0x428743
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.004271b0
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428743
jmp 0x428c07
jmp 0x4286c6
cmp dword [ebp + 0x14], 0
je 0x428755
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0xcd], 0
jmp 0x42876c
mov al, byte [ebp - 0xcd]
add al, 1
mov byte [ebp - 0xcd], al
movzx ecx, byte [ebp - 0xcd]
mov edx, dword [ebp - 0x94]
movzx eax, byte [edx + 1]
cmp ecx, eax
jge 0x428c07
mov dword [ebp - 0xe4], 0
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0xdc], edx
movzx eax, byte [ebp - 0xcd]
imul eax, eax, 0xa8
mov ecx, dword [ebp - 0x94]
lea edx, [ecx + eax + 4]
mov dword [ebp - 0xd8], edx
movzx eax, byte [ebp - 0x81]
imul eax, eax, 0x468
add eax, dword [ebp - 0x60]
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0x30]
call fcn.00401e00
test eax, eax
je 0x4287f0
lea ecx, [ebp - 0x30]
call fcn.00401230
mov dword [ebp - 0x108], eax
jmp 0x4287fa
mov dword [ebp - 0x108], 0x42f358
push 0
mov ecx, dword [ebp - 0x108]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.0040f9a0
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428820
jmp 0x428c07
push 0x27
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0xd8]
add ecx, 0x8c
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428850
jmp 0x428c07
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 0xa4]
and eax, 0x100
je 0x42886f
mov dword [ebp - 0xdc], 6
jmp 0x4288bc
cmp dword [ebp - 0xdc], 7
je 0x4288bc
lea ecx, [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 0xa0]
push eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ecx + 0x9c]
push edx
mov eax, dword [ebp - 0xe0]
push eax
call fcn.00427570
add esp, 0x10
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x4288bc
jmp 0x428c07
cmp dword [ebp - 0xdc], 0
jne 0x4288ca
jmp 0x42875e
mov cl, byte [ebp - 0x81]
add cl, 1
mov byte [ebp - 0x81], cl
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0xd8]
push eax
call fcn.00427c50
add esp, 8
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428900
jmp 0x428c07
mov dword [ebp - 0xe4], 1
mov ecx, dword [ebp - 0x80]
push ecx
push 0x104
mov edx, dword [ebp - 0xe0]
add edx, 0x4e
push edx
call fcn.00401c70
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428936
jmp 0x428c07
cmp dword [ebp - 0x5c], 0
je 0x428a32
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 0x80
je 0x428a32
push 0
push str._TRANSFORMS_
lea edx, [ebp - 0x50]
push edx
call fcn.0040fa30
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x42897c
jmp 0x428c07
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 4
je 0x428a09
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 1
push ecx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0xd8]
push eax
call fcn.004276b0
add esp, 0x10
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x4289c8
jmp 0x428c07
cmp dword [ebp - 0x5c], 0
je 0x4289de
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.0040f4e0
mov dword [ebp - 0x5c], 0
push 0
mov edx, dword [ebp - 0x58]
push edx
call fcn.00410180
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0040fa30
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428a07
jmp 0x428c07
jmp 0x428a32
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.00410180
push eax
lea edx, [ebp - 0x50]
push edx
call fcn.0040fa30
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428a32
jmp 0x428c07
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 4
je 0x428adb
lea edx, [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 1
push ecx
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0xd8]
push eax
call fcn.00427840
add esp, 0x10
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428a85
jmp 0x428c07
mov dword [ebp - 0xe4], 0
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x8c]
push edx
push 0x104
mov eax, dword [ebp - 0xe0]
add eax, 0x256
push eax
call fcn.00401c70
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428ac9
jmp 0x428c07
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + 0x460], 1
jmp 0x428ae1
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 8
jne 0x428b1c
mov dword [ebp - 0xd4], 3
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 0xa4]
and eax, 0x10
je 0x428b1c
mov ecx, dword [ebp - 0xd4]
or ecx, 0x40
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx + 0xa4]
and eax, 1
push eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ecx + 0xa4]
and edx, 0x200
push edx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 0xa4]
and ecx, 0x10
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xd8]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 0xe0]
push edx
call fcn.00427ed0
add esp, 0x28
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jge 0x428b93
jmp 0x428c07
cmp dword [ebp - 0x98], 1
jne 0x428bdf
mov eax, dword [ebp - 0xe0]
cmp dword [eax + 0x460], 0
je 0x428bdd
mov ecx, dword [ebp - 0xe0]
add ecx, 0x256
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov eax, dword [ebp - 0xe0]
mov word [eax + 0x256], dx
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + 0x460], 0
jmp 0x428bef
mov edx, dword [ebp - 0xe0]
mov dword [edx + 0x464], 1
cmp dword [ebp - 0xe4], 0
je 0x428c02
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42875e
cmp dword [ebp - 0x98], 0
jge 0x428d1c
push 0xbc2
call fcn.00401c30
add esp, 4
cmp eax, dword [ebp - 0x98]
je 0x428d1c
push 0xbc3
call fcn.00401c30
add esp, 4
cmp eax, dword [ebp - 0x98]
je 0x428d1c
push 0x669
call fcn.00401c30
add esp, 4
cmp eax, dword [ebp - 0x98]
je 0x428d1c
mov byte [ebp - 0xe5], 0
jmp 0x428c77
mov cl, byte [ebp - 0xe5]
add cl, 1
mov byte [ebp - 0xe5], cl
movzx edx, byte [ebp - 0xe5]
movzx eax, byte [ebp - 0x81]
cmp edx, eax
jge 0x428d1c
movzx ecx, byte [ebp - 0xe5]
imul ecx, ecx, 0x468
add ecx, dword [ebp - 0x60]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
cmp dword [edx + 0x464], 0
je 0x428cd5
push 0
push 0
push 1
push 3
push 7
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xec]
push ecx
call fcn.00427ed0
add esp, 0x28
mov edx, dword [ebp - 0xec]
movzx eax, word [edx + 0x256]
test eax, eax
je 0x428cf9
mov ecx, dword [ebp - 0xec]
add ecx, 0x256
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xec]
movzx eax, word [edx + 0x4e]
test eax, eax
je 0x428d17
mov ecx, dword [ebp - 0xec]
add ecx, 0x4e
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x428c68
cmp dword [ebp - 0x5c], 0
je 0x428d2c
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x60], 0
je 0x428d3b
mov eax, dword [ebp - 0x60]
push eax
call fcn.004106c0
cmp dword [ebp - 0x9c], 0
je 0x428d51
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x80], 0
je 0x428d60
mov edx, dword [ebp - 0x80]
push edx
call fcn.0040f4e0
cmp dword [ebp - 0x5c], 0
je 0x428d6f
mov eax, dword [ebp - 0x5c]
push eax
call fcn.0040f4e0
cmp dword [ebp - 0x8c], 0
je 0x428d84
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.0040f4e0
cmp dword [ebp - 0x58], 0
je 0x428d93
mov edx, dword [ebp - 0x58]
push edx
call fcn.0040f4e0
cmp dword [ebp - 0x50], 0
je 0x428da2
mov eax, dword [ebp - 0x50]
push eax
call fcn.0040f4e0
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0xfc], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb8]
call fcn.004011d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00401e20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004011d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.004011d0
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00411220
mov esp, ebp
pop ebp
ret