Function at 0x10045fab
Capabilities:
Check if file exists
Delete file
Enumerate processes

Disassembly:
push 0x2ec
mov eax, 0x100ae48a
call fcn.10091010
mov dword [ebp - 0x2f0], ecx
push 0x100cb52c
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
pop ecx
pop ecx
xor ebx, ebx
or edi, 0xffffffff
push 0xf
mov esi, ebx
mov dword [ebp - 0x30], ebx
pop eax
mov dword [ebp - 0x2f8], esi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x40], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 1
call fcn.10047b84
mov byte [ebp - 4], 2
call fcn.1004869f
push ebx
push 2
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x2f4], edi
mov dword [ebp - 0x2e8], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, edi
jne 0x1004603a
mov eax, edi
jmp 0x1004607a
lea eax, [ebp - 0x2e8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1004606d
mov esi, edi
lea eax, [ebp - 0x2e8]
inc esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1004604e
mov dword [ebp - 0x2f4], esi
mov esi, dword [ebp - 0x2f8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x104]
push eax
call fcn.100469ed
lea eax, [ebp - 0x11c]
push eax
call fcn.100486d4
lea ecx, [ebp - 0x160]
call fcn.100475cf
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x160]
test eax, eax
je 0x100460bd
xor esi, esi
mov edi, eax
inc esi
jmp 0x100463df
call fcn.10047950
test al, al
jne 0x100460ce
push 2
pop esi
jmp 0x100463d9
call fcn.10035efb
push eax
push 0x100c979c
push 0x100c92a4
push ecx
call fcn.10041280
pop ecx
mov ecx, eax
call fcn.10041641
mov ecx, dword [ebp - 0xfc]
lea eax, [ecx - 1]
cmp eax, 0x16b
ja 0x10046115
push ecx
push 0x100c97ac
push 0x100c92a4
push ecx
call fcn.10041280
pop ecx
mov ecx, eax
call fcn.10041641
cmp dword [ebp - 0xf8], 0
jne 0x10046153
call fcn.10045657
push dword [ebp - 0xf8]
push 0x100cb558
push eax
call fcn.100448e6
add esp, 0xc
lea ecx, [ebp - 0x160]
call fcn.10047c38
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.100072c0
jmp 0x10046487
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xf4]
sar eax, 4
cmp eax, 1
jae 0x1004616e
push 8
jmp 0x100460c8
lea ecx, [ebp - 0xe8]
call fcn.100472b6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe8]
push dword [ebp - 0xf4]
call fcn.10047341
test al, al
je 0x1004639a
lea ecx, [ebp - 0xe8]
call fcn.100473e9
test al, al
je 0x1004639a
cmp dword [ebp - 0xb0], 0x10
lea eax, [ebp - 0xc4]
cmovae eax, dword [ebp - 0xc4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10048620
mov byte [ebp - 4], 4
cmp dword [ebp - 0x7c], 0
jne 0x100461fb
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
je 0x100461fb
push 5
pop esi
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100072c0
jmp 0x1004639d
cmp dword [ebp - 0x78], 0
mov byte [ebp - 0x2e9], 0
jne 0x10046232
lea eax, [ebp - 0x2e9]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10046c0e
test al, al
je 0x10046232
cmp byte [ebp - 0x2e9], 0
jne 0x1004622e
cmp dword [ebp - 0x7c], 0
jne 0x10046232
push 0xa
jmp 0x100461e9
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.10046e1b
test eax, eax
jne 0x1004624a
push 6
jmp 0x100461e9
mov ecx, dword [ebp - 0x2f0]
call fcn.1004b786
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x2f0]
lea eax, [ebp - 0x1c0]
push eax
call fcn.1004718e
add esp, 0xc
push 0x100cb590
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 5
push eax
call fcn.10005021
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 7
call fcn.100072c0
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call ebx
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
push 1
cmovae ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x100462e0
push 0xc
pop esi
push 0
push 1
lea ecx, [ebp - 0x70]
call fcn.100072c0
jmp 0x100461ea
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1004887b
test eax, eax
je 0x1004636f
xor ebx, ebx
lea ecx, [ebp - 0x70]
xor esi, esi
push ebx
inc esi
push esi
call fcn.100072c0
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.100072c0
push ebx
push esi
lea ecx, [ebp - 0x94]
call fcn.100072c0
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.100072c0
push ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.100072c0
push ebx
push esi
lea ecx, [ebp - 0xe0]
call fcn.100072c0
lea ecx, [ebp - 0x160]
call fcn.10047c38
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.100072c0
push ebx
push esi
jmp 0x1004648b
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0xc4]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0xb0], 0x10
push ecx
cmovae eax, dword [ebp - 0xc4]
push eax
call fcn.100464d0
jmp 0x100462cf
push 9
pop esi
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0xac]
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0xc4]
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0xe0]
call fcn.100072c0
lea ecx, [ebp - 0x160]
call fcn.10047c38
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.100072c0
push edi
push esi
push 0x100cb598
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
lea ecx, [ebp - 0x1a8]
call fcn.10048094
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1a8]
test esi, esi
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x168], edi
sete byte [ebp - 0x16c]
call fcn.100475cf
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1004645e
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
push 0x100cb5d0
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
pop ecx
pop ecx
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], 0x100cbae4
call fcn.100475a4
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100072c0
xor al, al
call fcn.10090fbf
ret