Function at 0x41be18
Capabilities:
Accept command line arguments
Delete file

Disassembly:
push 0x2d4
mov eax, 0x46e4d1
call fcn.0045f3fe
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c92c
call fcn.004132cd
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x18]
or edi, 0xffffffff
add ecx, 0x7f8
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c944
call fcn.004132cd
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x18]
add ecx, 0x834
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c970
call fcn.004132cd
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x18]
add ecx, 0x8e8
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c99c
call fcn.004132cd
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x18]
add ecx, 0x870
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c9b8
call fcn.004132cd
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x18]
add ecx, 0x8ac
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40c9cc
call fcn.004132cd
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0x18]
add ecx, 0x960
mov dword [ebp - 4], edi
call fcn.0041afb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
mov ebx, 0x40c8b8
push ebx
call fcn.004132cd
mov dword [ebp - 4], 6
mov eax, dword [esi + 0x18]
add eax, 0x7f8
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 7
mov eax, dword [esi + 0x18]
add eax, 0x834
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409384
call fcn.004132cd
mov dword [ebp - 4], 8
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x18]
add eax, 0x870
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push ebx
call fcn.004132cd
mov dword [ebp - 4], 0xa
mov eax, dword [esi + 0x18]
add eax, 0x8ac
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409384
call fcn.004132cd
mov dword [ebp - 4], 0xb
mov eax, dword [esi + 0x18]
add eax, 0x960
push eax
mov dword [ebp - 4], edi
call fcn.0041af70
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x2e0], eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x41c049
sub eax, ecx
sar eax, 1
lea edi, [eax + 1]
mov dword [ebp - 0x2d4], eax
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x2dc], edi
neg ecx
or ecx, eax
push ecx
call fcn.0043e603
xor edi, edi
pop ecx
mov dword [ebp - 0x2d8], eax
cmp eax, edi
je 0x41c0b7
mov ecx, dword [ebp - 0x2d4]
lea ecx, [ecx + ecx + 2]
push ecx
push edi
push eax
call fcn.004433d0
push dword [ebp - 0x2e0]
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d8]
call fcn.0043e613
add esp, 0x18
jmp 0x41c0c3
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2d8], eax
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d8]
call fcn.0043ec7e
push 0x40ca04
push dword [ebp - 0x2d8]
call fcn.0043f2df
add esp, 0x10
mov dword [ebp - 0x2d4], eax
cmp eax, edi
je 0x41c27e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0xc
mov eax, dword [esi + 0x18]
add eax, 0x7f8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
mov eax, dword [ebp - 0x2d4]
add eax, 4
cmp word [eax], 0x75
je 0x41c148
push 0x40ca0c
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
test eax, eax
je 0x41c176
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0xd
mov eax, dword [esi + 0x18]
add eax, 0x834
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push 0x40a710
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c1ba
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40a710
call fcn.004132cd
mov dword [ebp - 4], 0xe
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push 0x40a718
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c1fe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40a718
call fcn.004132cd
mov dword [ebp - 4], 0xf
mov eax, dword [esi + 0x18]
add eax, 0x8e8
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push 0x40ca14
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c23a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x10
mov eax, dword [esi + 0x18]
add eax, 0x870
jmp 0x41c274
push 0x40ca30
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c27e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x11
mov eax, dword [esi + 0x18]
add eax, 0x8ac
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push dword [0x47dc38]
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
cmp eax, edi
je 0x41c3a3
push dword [0x47dc38]
lea ecx, [ebp - 0x25c]
call fcn.004132cd
mov dword [ebp - 4], 0x12
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x2d4]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2d4], eax
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x25c]
call fcn.00411dad
mov eax, dword [ebp - 0x2d4]
movzx eax, word [eax]
push eax
call fcn.0043ef36
pop ecx
test eax, eax
jne 0x41c322
mov eax, dword [ebp - 0x2d4]
jmp 0x41c2fe
mov eax, dword [ebp - 0x2dc]
cmp word [eax], 0
je 0x41c322
mov eax, dword [ebp - 0x2d4]
inc edi
lea eax, [eax + edi*2]
mov dword [ebp - 0x2dc], eax
movzx eax, word [eax]
push eax
call fcn.0043ef36
pop ecx
test eax, eax
je 0x41c2f8
xor ecx, ecx
push 2
lea eax, [edi + 1]
pop edx
mov dword [ebp - 0x2d0], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043e603
lea ecx, [edi + edi + 2]
push ecx
push 0
push eax
mov dword [ebp - 0x2dc], eax
call fcn.004433d0
push dword [ebp - 0x2d4]
push dword [ebp - 0x2d0]
push dword [ebp - 0x2dc]
call fcn.0043e613
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push dword [ebp - 0x2dc]
call fcn.004132cd
mov dword [ebp - 4], 0x13
mov eax, dword [esi + 0x18]
add eax, 0x960
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push dword [ebp - 0x2dc]
call fcn.0043e687
pop ecx
xor edi, edi
push 0x40ca44
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
mov ecx, eax
cmp ecx, edi
je 0x41c451
add ecx, 0xa
jmp 0x41c3cc
cmp ax, 0x20
jne 0x41c3da
inc ecx
inc ecx
movzx eax, word [ecx]
mov dword [ebp - 0x2d4], ecx
cmp ax, di
jne 0x41c3c4
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
jmp 0x41c3ef
mov ecx, dword [ebp - 0x2d4]
movzx eax, word [ecx]
test ax, ax
je 0x41c41d
push eax
call fcn.0043ef1e
pop ecx
test eax, eax
je 0x41c41d
mov eax, dword [ebp - 0x2d4]
mov ax, word [eax]
add dword [ebp - 0x2d4], 2
mov word [ebp + edi*2 - 0x1c], ax
inc edi
cmp edi, 4
jb 0x41c3e9
cmp edi, 4
jne 0x41c44f
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132cd
mov dword [ebp - 4], 0x14
mov eax, dword [esi + 0x18]
add eax, 0x564
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
xor edi, edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40ca50
call fcn.004132cd
mov dword [ebp - 4], 0x15
mov ecx, dword [esi + 0x18]
add ecx, 0x924
or dword [ebp - 4], 0xffffffff
call fcn.0041afb2
push 0x40ca6c
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
cmp eax, edi
je 0x41c4b3
push 0x409cf4
call fcn.004132cd
mov dword [ebp - 4], 0x16
jmp 0x41c4c0
push ebx
call fcn.004132cd
mov dword [ebp - 4], 0x17
mov eax, dword [esi + 0x18]
add eax, 0x924
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0041af70
push 0x40ca90
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2d4], eax
call fcn.004132cd
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x2d4], edi
je 0x41c515
push 0x409cf4
lea ecx, [ebp - 0x2b0]
call fcn.00413ccf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40ca98
call fcn.004132cd
mov byte [ebp - 4], 0x19
mov ecx, dword [esi + 0x18]
add ecx, 0x744
mov byte [ebp - 4], 0x18
call fcn.0041afb2
sub esp, 0x1c
lea eax, [ebp - 0x2b0]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x1a
mov eax, dword [esi + 0x18]
add eax, 0x744
push eax
mov byte [ebp - 4], 0x18
call fcn.0041af70
push 0x40cab0
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
cmp eax, edi
jne 0x41c5a1
push 0x40cab8
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
mov dword [ebp - 0x2d4], eax
push ebx
lea ecx, [ebp - 0x294]
call fcn.004132cd
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x2d4], edi
je 0x41c5ce
push 0x409cf4
lea ecx, [ebp - 0x294]
call fcn.00413ccf
call fcn.0041cdf1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cac0
call fcn.004132cd
mov byte [ebp - 4], 0x1c
mov ecx, dword [esi + 0x18]
mov ebx, 0x780
add ecx, ebx
mov byte [ebp - 4], 0x1b
call fcn.0041afb2
sub esp, 0x1c
lea eax, [ebp - 0x294]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x1d
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x1b
call fcn.0041af70
push 0x409384
lea ecx, [ebp - 0x278]
call fcn.004132cd
mov byte [ebp - 4], 0x1e
push 0x40cad8
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c80b
push 0x40caf4
push dword [ebp - 0x2e0]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c708
add eax, 0x1e
push eax
lea ecx, [ebp - 0x278]
call fcn.00413ccf
push edi
push 0x40cb14
lea ecx, [ebp - 0x278]
call fcn.00419b55
cmp eax, 0xffffffff
je 0x41c6ca
push eax
push edi
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x278]
call fcn.00419b85
mov byte [ebp - 4], 0x1f
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x278]
call fcn.00411dfc
mov byte [ebp - 4], 0x1e
push edi
push 1
lea ecx, [ebp - 0x25c]
jmp 0x41c806
mov byte [ebp - 4], 0x1b
push edi
push 1
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push 1
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x2b0]
call fcn.00411dad
xor al, al
call fcn.0045f490
ret
push 0x40cb30
push dword [ebp - 0x2e0]
call fcn.0043f2df
pop ecx
pop ecx
cmp eax, edi
je 0x41c8d5
add eax, 0x2e
push eax
lea ecx, [ebp - 0x240]
call fcn.004132cd
mov byte [ebp - 4], 0x20
push edi
push 0x40cb60
lea ecx, [ebp - 0x240]
call fcn.00419b55
cmp eax, 0xffffffff
je 0x41c894
push eax
push edi
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00419b85
mov byte [ebp - 4], 0x21
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.00411dfc
mov byte [ebp - 4], 0x20
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x25c]
call fcn.00411dad
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x240]
call fcn.0041cc58
test al, al
jne 0x41c7de
mov byte [ebp - 4], 0x1e
push edi
push ebx
lea ecx, [ebp - 0x240]
call fcn.00411dad
mov byte [ebp - 4], 0x1b
push edi
push ebx
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push ebx
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push ebx
jmp 0x41c6f5
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x41c7f3
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x1e
push edi
push ebx
lea ecx, [ebp - 0x240]
call fcn.00411dad
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cb8c
call fcn.004132cd
mov byte [ebp - 4], 0x22
mov ecx, dword [esi + 0x18]
mov ebx, 0x4b0
add ecx, ebx
mov byte [ebp - 4], 0x1e
call fcn.0041afb2
sub esp, 0x1c
lea eax, [ebp - 0x278]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x23
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x1e
call fcn.0041af70
push 0x40cbc4
push dword [ebp - 0x2d8]
call fcn.0043f2df
pop ecx
pop ecx
lea ecx, [ebp - 0x2cc]
mov ebx, eax
call fcn.00411d68
mov byte [ebp - 4], 0x24
cmp ebx, edi
je 0x41c984
add ebx, 4
jmp 0x41c91c
mov byte [ebp - 4], 0x1e
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x240]
call fcn.00411dad
mov byte [ebp - 4], 0x1b
push edi
push esi
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push esi
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push esi
jmp 0x41c6f5
xor bl, bl
mov byte [ebp - 4], 0x1b
push edi
push 1
lea ecx, [ebp - 0x278]
call fcn.00411dad
mov byte [ebp - 4], 0x18
push edi
push 1
lea ecx, [ebp - 0x294]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x2b0]
call fcn.00411dad
mov al, bl
jmp 0x41c702
cmp ax, 0x20
jne 0x41c924
inc ebx
inc ebx
movzx eax, word [ebx]
cmp ax, di
jne 0x41c914
push 0x22
pop eax
mov dword [ebp - 0x2dc], 0x20
cmp word [ebx], ax
jne 0x41c93e
inc ebx
mov dword [ebp - 0x2dc], eax
inc ebx
push dword [ebp - 0x2dc]
push ebx
call fcn.0043f846
pop ecx
pop ecx
mov dword [ebp - 0x2d0], eax
cmp eax, edi
je 0x41c95b
xor ecx, ecx
mov word [eax], cx
push ebx
lea ecx, [ebp - 0x2cc]
call fcn.00413ccf
mov eax, dword [ebp - 0x2d0]
cmp eax, edi
je 0x41ca6e
mov cx, word [ebp - 0x2dc]
mov word [eax], cx
jmp 0x41ca6e
lea ecx, [ebp - 0x240]
call fcn.00411d68
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x25c]
call fcn.00411d68
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x25c]
push eax
push 0x1e
pop eax
mov ecx, esi
call fcn.0041badf
lea eax, [ebp - 0x240]
push eax
push 0x11
pop eax
mov ecx, esi
call fcn.0041badf
push 0x409cac
lea ecx, [ebp - 0x240]
call fcn.00413343
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push edi
push eax
call fcn.004433d0
mov eax, dword [ebp - 0x23c]
add esp, 0xc
cmp dword [ebp - 0x228], 8
jae 0x41ca07
lea eax, [ebp - 0x23c]
cmp dword [ebp - 0x244], 8
mov ebx, dword [ebp - 0x258]
jae 0x41ca1c
lea ebx, [ebp - 0x258]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0041a843
lea ecx, [ebp - 0x2cc]
test eax, eax
je 0x41ca3c
lea eax, [ebp - 0x224]
push eax
jmp 0x41ca41
push 0x40cbd4
call fcn.00413ccf
mov byte [ebp - 4], 0x25
push 0
push 1
lea ecx, [ebp - 0x25c]
call fcn.00411dad
mov byte [ebp - 4], 0x24
push 0
push 1
lea ecx, [ebp - 0x240]
call fcn.00411dad
xor edi, edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push 0x40cbec
call fcn.004132cd
mov byte [ebp - 4], 0x27
mov ecx, dword [esi + 0x18]
mov ebx, 0x474
add ecx, ebx
mov byte [ebp - 4], 0x24
call fcn.0041afb2
sub esp, 0x1c
lea eax, [ebp - 0x2cc]
mov ecx, esp
mov dword [ebp - 0x2d0], esp
push eax
call fcn.004132f9
mov byte [ebp - 4], 0x28
mov eax, dword [esi + 0x18]
add eax, ebx
push eax
mov byte [ebp - 4], 0x24
call fcn.0041af70
mov byte [ebp - 4], 0x1e
push edi
push 1
lea ecx, [ebp - 0x2cc]
call fcn.00411dad
mov bl, 1
jmp 0x41c8d7