Function at 0x430fa8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x430fb0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x431243
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00431250
mov edx, esi
mov eax, dword [0x4adbf8]
call fcn.0042f740
test al, al
je 0x430ff0
lea eax, [ebx + 8]
mov edx, esi
call fcn.004053c8
jmp 0x431005
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040a2ec
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.004053c8
lea eax, [ebx + 0x72]
xor ecx, ecx
mov edx, 0xc
call fcn.00403914
lea eax, [ebx + 0x7e]
xor ecx, ecx
mov edx, 0x324
call fcn.00403914
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x431033
mov dword [ebx + 0x7e], 0x7fffffff
jmp 0x431036
mov dword [ebx + 0x7e], eax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x431049
mov dword [ebx + 0x82], 0x7fffffff
jmp 0x43104f
mov dword [ebx + 0x82], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x86], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x8a], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x8e], eax
mov dword [ebx + 0x96], 1
movzx eax, word [ebx + 0x28]
mov word [ebx + 0x9e], ax
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x96]
mov eax, ebx
call fcn.00430bf8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xa0]
call fcn.0040a520
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.0040a26c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x1a0]
call fcn.0040a520
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 8]
call fcn.0040a12c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x2a0]
call fcn.0040a520
mov byte [ebp - 1], 0
cmp word [ebx + 0x42], 0
je 0x4310f5
push 0
lea eax, [ebp - 1]
push eax
lea ecx, [ebx + 0x7e]
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebp - 1], 0
jne 0x43121b
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
cmp dword [ebp - 0x18], 0
je 0x431155
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040e310
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x2a0]
call fcn.0040a520
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x24]
call fcn.00409dc8
lea eax, [ebp - 0x34]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea edx, [ebx + 0x1a0]
mov ecx, pe_nt_image_headers32
call fcn.004055e4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov edx, 1
call fcn.0042fc94
mov eax, dword [ebp - 0x28]
call fcn.00405804
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [ebx + 0x3a2], eax
xor eax, eax
mov dword [ebx + 0x3a6], eax
xor eax, eax
mov dword [ebx + 0x3aa], eax
push ebx
lea eax, [ebx + 0x7e]
push eax
mov eax, 0x4304ac
push eax
mov eax, 0x430480
push eax
mov eax, 0x430468
push eax
mov eax, 0x430458
push eax
mov eax, 0x430440
push eax
mov eax, 0x430428
push eax
mov eax, 0x430410
push eax
mov eax, 0x430400
push eax
mov eax, 0x4303f0
push eax
mov eax, 0x4304bc
push eax
lea eax, [ebx + 0x72]
push eax
call fcn.0042da5c
add esp, 0x34
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
setne dl
mov eax, ebx
call fcn.00430a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43124a
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405398
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00405398
ret