Function at 0x4041b9
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bfce
mov eax, dword fs:[0]
push eax
mov eax, 0x1ac8
call fcn.0041b930
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push edi
push edi
push edi
push 0x4036b6
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00403a9c
push 0x9b8
lea eax, [ebp - 0x1ad4]
push edi
push eax
call fcn.00406f90
add esp, 0xc
lea ecx, [ebp - 0x1ad4]
call fcn.00402ac4
sub esp, 0x18
mov dword [ebp - 4], edi
mov ecx, esp
push str.52D298A1564D23A51AD7505925E98635
call fcn.00403088
lea ecx, [ebp - 0x1ad4]
call fcn.0040269b
push 0xff
xor ebx, ebx
mov dword [ebp - 0x1ac8], 6
lea eax, [ebp - 0x110]
inc ebx
push edi
push eax
mov dword [ebp - 0x1ac4], ebx
mov dword [ebp - 0x1ac0], ebx
call fcn.00406f90
push 3
push edi
push ebx
mov esi, str._d._d._d
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004025fe
lea eax, [ebp - 0x10e4]
mov dword [ebp - 0x10ec], edi
push eax
lea eax, [ebp - 0x10e8]
mov dword [ebp - 0x10e8], edi
push eax
lea eax, [ebp - 0x10ec]
mov dword [ebp - 0x10e4], edi
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00402631
add esp, 0x34
cmp eax, 3
jne 0x4042e0
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x1abc], eax
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x1ab8], eax
mov eax, dword [ebp - 0x10e4]
mov dword [ebp - 0x1ab4], eax
mov esi, 0xfd0
lea eax, [ebp - 0x10e0]
push esi
push edi
push eax
call fcn.00406f90
add esp, 0xc
mov dword [ebp - 0x10e4], 0x4e91
lea eax, [ebp - 0x10e0]
push esi
push eax
sub esp, 0x18
lea eax, [ebp - 0x1134]
mov ecx, esp
lea esi, [ebp - 0x10e4]
push eax
call fcn.00401dd8
push 4
pop edx
mov ecx, esi
call fcn.00402a40
add esp, 0x20
or esi, 0xffffffff
test eax, eax
jle 0x404353
lea eax, [ebp - 0x10e0]
push eax
call fcn.0040fd54
pop ecx
test eax, eax
jle 0x404359
lea eax, [ebp - 0x10e0]
push eax
call fcn.0040fd54
pop ecx
jmp 0x404355
mov eax, esi
test eax, eax
jg 0x404399
lea ecx, [ebp - 0x1ad4]
call fcn.00402c68
mov esi, 0x535bb8
mov ecx, esi
call fcn.004033f4
mov ecx, esi
call fcn.00403325
push ecx
push ecx
call fcn.00403919
pop ecx
pop ecx
test eax, eax
js 0x404392
call fcn.00404086
test eax, eax
js 0x404392
call fcn.004034a4
mov esi, ebx
jmp 0x40445f
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1ad4]
call fcn.00402e2a
lea eax, [ebp - 0x111c]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x1ad4]
call fcn.00402f18
lea ecx, [ebp - 0x1ad4]
mov byte [ebp - 4], 2
call fcn.00402db6
cmp eax, 0x14
jle 0x404443
lea ecx, [ebp - 0x1ad4]
call fcn.00402c68
cmp dword [ebp - 0x10f0], 8
lea ecx, [ebp - 0x1104]
cmovae ecx, dword [ebp - 0x1104]
call fcn.004033f4
cmp dword [ebp - 0x10f0], 8
lea ecx, [ebp - 0x1104]
cmovae ecx, dword [ebp - 0x1104]
call fcn.00403325
cmp dword [ebp - 0x1108], 8
lea eax, [ebp - 0x111c]
cmovae eax, dword [ebp - 0x111c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push ecx
call fcn.00403919
pop ecx
pop ecx
call fcn.00404086
test eax, eax
js 0x404445
call fcn.004034a4
mov esi, ebx
push edi
push ebx
lea ecx, [ebp - 0x111c]
call fcn.00401dfe
push edi
push ebx
lea ecx, [ebp - 0x1104]
call fcn.00401dfe
lea ecx, [ebp - 0x1ad4]
call fcn.00402bf5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004044b5
mov esp, ebp
pop ebp
ret