Function at 0x447780
Capabilities:
Delete file
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x174
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x68], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x50], ecx
lea ecx, [eax + eax*8]
shl ecx, 4
push ebx
mov dword [esp + 0x58], edx
mov edx, dword [ecx + 0x468d04]
push esi
push edi
mov dword [esp + 0x48], ecx
cmp edx, dword [ecx + 0x468d00]
jl 0x4477e1
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0045d089
mov esp, ebp
pop ebp
ret
lea edx, [eax*8]
sub edx, eax
mov eax, dword [0x468ec0]
mov edi, dword [eax + edx*8]
mov edx, dword [ecx + 0x468d0c]
mov eax, dword [ecx + 0x468d14]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x64], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x58], eax
cmp dx, word [ecx + 0x468d08]
jge 0x44805d
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
lea esp, [esp]
cmp dword [esp + 0x50], 1
je 0x448059
mov eax, dword [esp + 0x48]
cmp dword [eax + 0x468d18], 7
jle 0x4479c2
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x4c]
movzx esi, byte [ecx + edx]
lea eax, [esi - 0xfb]
cmp eax, 4
ja case.default.0x447867
jmp dword [eax*4 + 0x44807c]
push edi
push 1
lea eax, [esp + 0x37]
push 1
push eax
call ebx
add esp, 0x10
lea ecx, [eax - 1]
mov al, byte [esp + 0x2f]
neg ecx
sbb ecx, ecx
inc ecx
cmp al, 0x64
jle 0x44789c
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
movsx edx, al
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
lea eax, [esp + 0x44]
push 2
push eax
call ebx
add esp, 0x10
lea ecx, [eax - 1]
mov ax, word [esp + 0x3c]
neg ecx
sbb ecx, ecx
mov edx, 0x7fe4
inc ecx
cmp ax, dx
jle 0x4478e5
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
cwde
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
lea ecx, [esp + 0x4c]
push 4
push ecx
call ebx
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x44], 0x7fffffe4
jle 0x447aa0
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
lea edx, [esp + 0x5c]
push 4
push edx
call ebx
fld dword [esp + 0x64]
fcom qword [0x466de8]
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
fnstsw ax
inc ecx
test ah, 0x41
jne 0x447a39
fstp st(0)
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
push 8
lea eax, [esp + 0x74]
push eax
call ebx
fld qword [0x466de0]
fld qword [esp + 0x78]
add esp, 0x10
fcom st(1)
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x447a21
fstp st(0)
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
test esi, esi
je 0x447acb
push edi
push 1
push esi
lea ecx, [esp + 0x84]
push ecx
jmp 0x447abd
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x4c]
movzx eax, byte [edx + eax]
lea ecx, [eax - 0x62]
cmp ecx, 0xa
ja case.0x4479e1.99
movzx ecx, byte [ecx + 0x4480a8]
jmp dword [ecx*4 + 0x448090]
push edi
push 1
lea edx, [esp + 0x37]
push 1
push edx
call ebx
add esp, 0x10
lea ecx, [eax - 1]
mov al, byte [esp + 0x2f]
neg ecx
sbb ecx, ecx
inc ecx
cmp al, 0x7f
jne 0x447a16
fld qword [0x4a5b10]
fstp qword [esp + 0x30]
jmp 0x447ad5
movsx eax, al
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
push 8
lea ecx, [esp + 0x74]
push ecx
jmp 0x447972
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
lea eax, [esp + 0x44]
push 2
push eax
call ebx
add esp, 0x10
lea ecx, [eax - 1]
mov ax, word [esp + 0x3c]
neg ecx
sbb ecx, ecx
mov edx, 0x7fff
inc ecx
cmp ax, dx
je 0x44799a
cwde
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
jmp 0x447ad5
push edi
push 1
lea ecx, [esp + 0x4c]
push 4
push ecx
call ebx
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [esp + 0x44], 0x7fffffff
je 0x44799a
fild dword [esp + 0x44]
fstp qword [esp + 0x30]
jmp 0x447ad5
lea esi, [eax - 0x7f]
test esi, esi
je 0x447acb
push edi
push 1
push esi
lea edx, [esp + 0x84]
push edx
call ebx
add esp, 0x10
cmp eax, 1
je 0x447acb
xor ecx, ecx
jmp 0x447ad0
mov ecx, 1
mov byte [esp + esi + 0x78], 0
test ecx, ecx
jne 0x447ae1
mov dword [esp + 0x50], 1
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
mov edx, dword [ecx + eax*4]
test edx, edx
je 0x447cee
jns 0x447b8a
cmp dword [0x476bc4], 0
je 0x447b48
mov esi, dword [esp + 0x60]
cmp edx, 0xffffffff
je 0x447b10
mov esi, dword [esp + 0x5c]
fld qword [esp + 0x30]
sub esp, 8
fadd qword [0x466d60]
fstp qword [esp]
call sub.MSVCR100.dll_floor
fstp qword [esi]
add esp, 8
fld qword [0x4802c0]
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 5
jnp 0x447d0b
mov eax, dword [esp + 0x40]
jmp 0x447cee
lea eax, [esp + 0x78]
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447b50
sub eax, esi
cmp eax, 0xc
ja 0x447e25
cmp edx, 0xffffffff
mov edx, dword [esp + 0x60]
je 0x447b6f
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x78]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x447b77
mov eax, dword [esp + 0x40]
jmp 0x447cee
cmp edx, 1
jne 0x447cee
mov edx, dword [esp + 0x48]
cmp dword [edx + 0x468d18], 7
jle 0x447ccc
mov ecx, dword [esp + 0x4c]
cmp byte [eax + ecx], 0xfb
jae 0x447cda
push str.mdm_variables_must_be_numeric__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x447c41
cmp dword [0x489ad0], 0
je 0x447c41
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x447c14
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [0x489ad0]
add esp, 4
push edx
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x447c32
mov edx, dword [0x489ad0]
push str.__body___html__n
push edx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov ecx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push ecx
call esi
mov edx, dword [0x4899d8]
add esp, 4
push edx
call esi
mov eax, dword [0x4802bc]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802cc]
add esp, 4
push ecx
call esi
mov edx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edx
call esi
mov eax, dword [0x4899d8]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802bc]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802cc]
add esp, 4
push edx
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x447cc4
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov edx, dword [esp + 0x4c]
cmp byte [eax + edx], 0x80
jae 0x447f3f
mov ecx, dword [esp + 0x58]
fld qword [esp + 0x30]
mov edx, dword [esp + 0x74]
fstp qword [edx + ecx*8]
inc ecx
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x48]
movsx edx, word [ecx + 0x468d08]
inc eax
mov dword [esp + 0x40], eax
cmp eax, edx
jl 0x447830
jmp 0x44805d
push str.ID_must_be_no_more_than_12_digits_long_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x447d9a
cmp dword [0x489ad0], 0
je 0x447d9a
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x447d6d
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [0x489ad0]
add esp, 4
push edx
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x447d8b
mov edx, dword [0x489ad0]
push str.__body___html__n
push edx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov ecx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push ecx
call esi
mov edx, dword [0x4899d8]
add esp, 4
push edx
call esi
mov eax, dword [0x4802bc]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802cc]
add esp, 4
push ecx
call esi
mov edx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edx
call esi
mov eax, dword [0x4899d8]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802bc]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802cc]
add esp, 4
push edx
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x447e1d
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
push str.Your_ID_variable_is_longer_than_12_characters._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x447eb4
cmp dword [0x489ad0], 0
je 0x447eb4
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x447e87
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [0x489ad0]
add esp, 4
push edx
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x447ea5
mov edx, dword [0x489ad0]
push str.__body___html__n
push edx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov ecx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push ecx
call esi
mov edx, dword [0x4899d8]
add esp, 4
push edx
call esi
mov eax, dword [0x4802bc]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802cc]
add esp, 4
push ecx
call esi
mov edx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edx
call esi
mov eax, dword [0x4899d8]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802bc]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802cc]
add esp, 4
push edx
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x447f37
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
push str.mdm_variables_must_be_numeric__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
cmp dword [0x4a5b3c], 0
je 0x447fce
cmp dword [0x489ad0], 0
je 0x447fce
push str.stdout
push 0x476be0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x447fa1
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [0x489ad0]
add esp, 4
push edx
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll__chsize_s]
add esp, 0xc
cmp dword [0x4a5b4c], 0
je 0x447fbf
mov edx, dword [0x489ad0]
push str.__body___html__n
push edx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 8
mov eax, dword [0x489ad0]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
call fcn.0040a1a0
mov ecx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
inc dword [0x468ff8]
push ecx
call esi
mov edx, dword [0x4899d8]
add esp, 4
push edx
call esi
mov eax, dword [0x4802bc]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802cc]
add esp, 4
push ecx
call esi
mov edx, dword [0x469488]
mov esi, dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edx
call esi
mov eax, dword [0x4899d8]
add esp, 4
push eax
call esi
mov ecx, dword [0x4802bc]
add esp, 4
push ecx
call esi
mov edx, dword [0x4802cc]
add esp, 4
push edx
call esi
add esp, 4
cmp dword [0x468ff8], 0
je 0x448051
call fcn.00409900
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [esp + 0x48]
inc dword [ecx + 0x468d04]
mov ecx, dword [esp + 0x17c]
mov eax, dword [esp + 0x50]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045d089
mov esp, ebp
pop ebp
ret