Function at 0x423564
Capabilities:
Delete file
Read file on windows

Disassembly:
push 0x654
mov eax, 0x42e039
call fcn.0042cccd
xor edi, edi
mov dword [ebp - 0x258], 7
xor eax, eax
mov dword [ebp - 0x25c], edi
mov word [ebp - 0x26c], ax
push edx
mov dword [ebp - 4], edi
call fcn.0041a5b7
push dword [ebp + 0x14]
lea ecx, [ebp - 0x26c]
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004234dd
cmp dword [0x432c90], edi
je 0x423607
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
jb 0x4235cd
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x432c8c], 1
jl 0x4235ff
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
jb 0x4235f2
mov eax, dword [ebp - 0x26c]
push eax
push 0x406078
call fcn.00411f8a
pop ecx
pop ecx
push 0xd
pop edi
jmp 0x42388b
lea ecx, [ebp - 0x460]
call fcn.00411c5e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x460]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x660]
push eax
push ecx
mov ecx, ebx
mov dword [0x4324ec], 0x401810
mov dword [ebp - 0x660], 0x401610
call fcn.0041a390
lea ecx, [ebp - 0x460]
call fcn.00411d19
mov edx, edi
movzx ecx, byte [ebp + edx - 0x45c]
mov eax, ecx
and ecx, 0xf
shr eax, 4
mov al, byte [eax + 0x4062fc]
cbw
mov word [ebp + edx*4 - 0x54], ax
mov al, byte [ecx + 0x4062fc]
cbw
mov word [ebp + edx*4 - 0x52], ax
inc edx
cmp edx, 0x10
jne 0x423652
xor eax, eax
mov word [ebp - 0x14], ax
cmp byte [0x432024], al
je 0x4237f0
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
jb 0x4236a9
mov eax, dword [ebp - 0x26c]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x65c], esi
lea eax, [esi + 1]
mov byte [ebp - 4], 2
cmp eax, 1
jbe 0x4237dd
lea ecx, [ebp - 0x654]
call fcn.00411c5e
push edi
lea eax, [ebp - 0x658]
mov dword [ebp - 0x658], edi
push eax
push 0x200
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
mov edx, esi
mov esi, edi
sbb eax, eax
and eax, dword [ebp - 0x658]
lea ecx, [edx + 1]
mov dword [ebp - 0x658], eax
cmp ecx, 1
jbe 0x42372d
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x658]
cmp eax, 2
jb 0x423757
mov ecx, 0xfeff
cmp word [ebp - 0x254], cx
jne 0x423757
shr eax, 1
lea ecx, [ebp - 0x254]
push eax
push ecx
lea ecx, [ebp - 0x460]
call fcn.0042562f
jmp 0x42377b
mov ecx, 0x100
cmp eax, ecx
jbe 0x423768
mov eax, ecx
mov dword [ebp - 0x658], eax
lea ecx, [ebp - 0x254]
push eax
push ecx
lea ecx, [ebp - 0x460]
call fcn.00425754
test al, al
je 0x4237c9
cmp dword [0x432c8c], 1
jl 0x4237aa
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
jb 0x42379d
mov eax, dword [ebp - 0x26c]
push eax
push 0x40609c
call fcn.00411f8a
pop ecx
pop ecx
cmp dword [ebp - 0x654], esi
je 0x4237be
push dword [ebp - 0x654]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
cmp dword [ebp - 0x460], esi
jmp 0x42387d
cmp dword [ebp - 0x654], esi
je 0x4237dd
push dword [ebp - 0x654]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
lea eax, [esi + 1]
mov byte [ebp - 4], 1
cmp eax, 1
jbe 0x4237f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x432c8c], 1
jl 0x42381b
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
jb 0x42380e
mov eax, dword [ebp - 0x26c]
push eax
push 0x4060b0
call fcn.00411f8a
pop ecx
pop ecx
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x54]
mov dword [0x4324ec], eax
lea eax, [ebp - 0x26c]
jb 0x423838
mov eax, dword [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x660]
call fcn.0041719f
push eax
push ecx
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0041a390
mov ecx, dword [ebp - 0x65c]
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x423866
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x432c90]
cmp dword [ebp - 0x460], 0
mov dword [0x4324ec], 0x401810
je 0x42388b
push dword [ebp - 0x460]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
lea ecx, [ebp - 0x26c]
call fcn.0040c297
mov eax, edi
call fcn.0042cc77
ret 0x10