Function at 0x413550
Capabilities:
Check if file exists
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de11e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x28], 0
push edi
mov dword [ebp - 0x34], ebx
mov ecx, 0x51072e
mov dword [ebp - 4], 0
call fcn.004b787d
push 0x104
lea eax, [ebp - 0x174]
push 0
push eax
call fcn.004ba8e0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
mov eax, dword [ebx + 4]
push 4
mov eax, dword [eax]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x70], 0
call fcn.004b78d2
add esp, 0x10
mov dword [eax], 0
push 0
push 0
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x17c]
push eax
push 0x4145e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x413cb6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
mov byte [ebp + 0xf], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 0x5a
test eax, eax
jne 0x413774
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x49005a
lea ebx, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x50
sub ebx, eax
mov dword [ebp - 0x1c], 0
mov edi, ebx
mov dword [ebp - 0x18], 0
sar edi, 1
lea esi, [ecx - 0x5a]
mov dword [ebp - 0x14], 0
je 0x413689
cmp edi, 0x7fffffff
ja 0x413cc0
push edi
lea ecx, [ebp - 0x1c]
call fcn.004036a0
mov esi, eax
lea eax, [ebp - 0x30]
push ebx
push eax
push esi
lea ecx, [esi + edi*2]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], ecx
call fcn.004ba360
lea eax, [esi + edi*2]
add esp, 0xc
mov dword [ebp - 0x18], eax
push ecx
mov edi, esp
mov byte [ebp - 4], 2
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x10], edi
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x413cc5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.004048d0
test al, al
jne 0x4136e8
test esi, esi
jne 0x4136c7
xor ecx, ecx
jmp 0x4136df
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4136d0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00406d70
push 0x82
push ecx
mov esi, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.004049c0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.0040c330
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.0040c550
test bl, bl
jne 0x413774
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x54]
push 0xc
push eax
call fcn.00413ff0
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x10
jb 0x413c27
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413765
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413ced
push ecx
push edx
call fcn.004b786f
add esp, 8
jmp 0x413c27
call fcn.00409390
xor eax, eax
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x40], ax
lea ebx, [ebp - 0x3e]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x37005c
sub ebx, eax
mov dword [ebp - 0x4c], 0x61007a
mov edi, ebx
mov dword [ebp - 0x48], 0x65002e
sar edi, 1
mov esi, 0
mov dword [ebp - 0x44], 0x650078
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
je 0x4137fe
cmp edi, 0x7fffffff
ja 0x413ccf
push edi
lea ecx, [ebp - 0x1c]
call fcn.004036a0
mov esi, eax
lea eax, [ebp - 0x50]
push ebx
push eax
push esi
lea ecx, [esi + edi*2]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], ecx
call fcn.004ba360
lea eax, [esi + edi*2]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x34]
mov edi, dword [edi + 4]
mov eax, dword [edi + 4]
mov byte [ebp - 4], 6
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x41381d
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x413833
call fcn.004059f0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x413cd4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], eax
test esi, esi
jne 0x41384d
xor ecx, ecx
jmp 0x413861
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413852
sub ecx, edx
sar ecx, 1
mov eax, dword [edi + 4]
push ecx
push esi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404aa0
mov eax, dword [ebp - 0x10]
add esp, 0x14
mov edi, dword [ebp - 0x20]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
cmp esi, edi
je 0x4138cc
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x4138c0
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x4138c0
push esi
call fcn.004049c0
add esp, 4
mov dword [ebp - 0x38], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x4138b8
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x38]
add eax, 0x10
mov dword [ebp - 0x20], eax
jmp 0x4138cc
push dword [eax - 0xc]
lea ecx, [ebp - 0x20]
push eax
call fcn.00406d70
mov byte [ebp - 4], 5
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4138e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0040c550
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x49005a
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x50
sub eax, ecx
mov dword [ebp - 0x1c], 0
xor ebx, ebx
mov dword [ebp - 0x18], 0
mov esi, eax
mov dword [ebp - 0x14], ebx
sar esi, 1
mov edi, ebx
mov dword [ebp - 0x38], eax
je 0x41395b
cmp esi, 0x7fffffff
ja 0x413cde
push esi
lea ecx, [ebp - 0x1c]
call fcn.004036a0
push dword [ebp - 0x38]
mov edi, eax
lea eax, [ebp - 0x30]
push eax
push edi
mov dword [ebp - 0x1c], edi
lea ebx, [edi + esi*2]
mov dword [ebp - 0x14], ebx
call fcn.004ba360
lea eax, [edi + esi*2]
add esp, 0xc
mov dword [ebp - 0x18], eax
push ecx
mov esi, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x28], esi
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x413ce3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push edi
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.004048d0
test al, al
jne 0x4139b8
test edi, edi
jne 0x413999
xor ecx, ecx
jmp 0x4139af
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4139a0
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00406d70
push 0x86
push ecx
mov esi, esp
mov byte [ebp - 4], 9
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
push eax
call fcn.004049c0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 7
call fcn.0040c330
add esp, 0xc
mov byte [ebp - 4], 1
test al, al
sete al
mov byte [ebp - 0x21], al
test edi, edi
je 0x413a28
sub ebx, edi
sar ebx, 1
add ebx, ebx
cmp ebx, 0x1000
jb 0x413a1b
mov ecx, dword [edi - 4]
add ebx, 0x23
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x413ced
mov edi, ecx
push ebx
push edi
call fcn.004b786f
mov al, byte [ebp - 0x21]
add esp, 8
test al, al
je 0x413a84
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413a84
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x54]
push 0x11
push eax
call fcn.00413ff0
mov ecx, dword [ebp - 0x40]
cmp ecx, 0x10
jb 0x413a7b
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413a71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413ced
push ecx
push edx
call fcn.004b786f
add esp, 8
mov byte [ebp + 0xf], 0
jmp 0x413c60
lea esi, [ebp - 0x56]
mov dword [ebp - 0x28], 0
mov ebx, esi
lea eax, [ebp - 0x68]
sub ebx, eax
nop word [eax + eax]
movaps xmm0, xmmword [0x4e4cb0]
xor edi, edi
mov word [ebp - 0x58], 0x75
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x68], xmm0
test ebx, ebx
je 0x413b02
cmp ebx, 0x7fffffff
ja 0x413cf2
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004029a0
mov edi, eax
lea eax, [ebp - 0x68]
sub esi, eax
mov dword [ebp - 0x1c], edi
push esi
push eax
lea ecx, [edi + ebx]
push edi
mov dword [ebp - 0x14], ecx
call fcn.004ba360
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
call fcn.004059f0
test eax, eax
je 0x413cb6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.004048d0
test al, al
jne 0x413b9e
test edi, edi
je 0x413b96
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [eax - 1]
test esi, esi
jle 0x413b96
mov ecx, dword [ebp - 0x10]
mov edx, 1
mov eax, dword [ecx - 8]
sub edx, dword [ecx - 4]
sub eax, esi
or eax, edx
jge 0x413b6d
push esi
lea ecx, [ebp - 0x10]
call fcn.00406580
mov ecx, dword [ebp - 0x10]
push esi
push ecx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
cmp esi, dword [eax - 8]
jg 0x413cf7
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + esi*2], cx
jmp 0x413b9e
lea ecx, [ebp - 0x10]
call fcn.00405360
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, 4
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004082d0
mov edx, dword [ebp - 0x10]
add esp, 0x14
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413be3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0040c4f0
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x413c23
cmp eax, 0x103
je 0x413c1f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 2
jge 0x413c1c
lea esi, [ebp - 0x56]
jmp 0x413aa0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x413c27
mov byte [ebp + 0xf], 1
mov eax, dword [ebp - 0x34]
push 0
push 0x32
push 0x466
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], 1
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push dword [ebp - 0x20]
call esi
mov edx, dword [ebp - 0x20]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413c81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x413ca0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xf]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004048a0
call fcn.0040c5b0
push 0x80004005
call fcn.004048a0
call fcn.0040c5b0
push 0x80004005
call fcn.004048a0
call fcn.0040c5b0
push 0x80004005
call fcn.004048a0
call fcn.004be79f
call fcn.0040c5b0
push 0x80070057
call fcn.004048a0
int3