Function at 0x401890
Capabilities:
Delete file

Disassembly:
push rdi
mov eax, 0x1460
call fcn.004024a0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1450], rax
lea rcx, [rsp + 0x1051]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x1050], 0
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0xc51]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xc50], 0
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x450], 0
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x1050]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
xor edx, edx
nop
movzx eax, byte [rsp + rdx + 0x1050]
add rdx, 1
test al, al
mov byte [rsp + rdx + 0xc4f], al
jne 0x401920
lea rcx, [rsp + 0x851]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x850], al
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x50], 0
call sub.MSVCR80.dll_memset
xor eax, eax
lea rdi, [rsp + 0x850]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xc50]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x401990
xor eax, eax
lea rdi, [rsp + 0x850]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str._ampa.exe]
mov rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
movzx eax, word [0x00403320]
lea rdx, [rsp + 0xc50]
mov word [rdi + 7], ax
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4019f0
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str._system32_ampa.sys]
mov rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x00403330]
lea r8, [rsp + 0xc50]
mov qword [rdi + 7], rax
movzx eax, word [0x00403338]
mov word [rdi + 0xf], ax
movzx eax, byte [0x0040333a]
mov byte [rdi + 0x11], al
xor eax, eax
lea rdi, [rsp + 0x450]
repne scasb al, byte [rdi]
xor edx, edx
nop
nop
movzx eax, byte [r8 + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x401a60
xor eax, eax
lea rdi, [rsp + 0x450]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.SysWOW64_ampa.sys]
lea rcx, [rsp + 0x850]
mov qword [rdi - 1], rax
mov rax, qword [0x00403348]
mov qword [rdi + 7], rax
movzx eax, word [0x00403350]
mov word [rdi + 0xf], ax
movzx eax, byte [0x00403352]
mov byte [rdi + 0x11], al
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x850]
test eax, eax
lea rcx, str.Failed_to_delete__s._n
je 0x401ad7
lea rcx, str.Successfully_delete_the_file:__s._n
call qword [sym.imp.MSVCR80.dll_printf]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x50]
lea rcx, str.Failed_to_delete__s._n
test eax, eax
je 0x401aff
lea rcx, str.Successfully_delete_the_file:__s._n
call qword [sym.imp.MSVCR80.dll_printf]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x401b64
lea rcx, [rsp + 0x20]
call rax
cmp word [rsp + 0x20], 9
jne 0x401b64
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x450]
lea rcx, str.Failed_to_delete__s._n
test eax, eax
je 0x401b5e
lea rcx, str.Successfully_delete_the_file:__s._n
call qword [sym.imp.MSVCR80.dll_printf]
mov eax, 1
mov rcx, qword [rsp + 0x1450]
xor rcx, rsp
call fcn.00401bf0
add rsp, 0x1460
pop rdi
ret