Function at 0x4267f1
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x485667
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e0
mov eax, dword [0x4aadb8]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x2e4], eax
mov eax, dword [esi + 0xc90]
xor ebp, ebp
cmp eax, ebp
mov dword [esi + 0x74], ebp
ja 0x42681b
push ebp
push ebp
push 0x48eb1c
call fcn.0047bc66
jmp 0x426b21
push edi
push 1
mov ecx, esi
call fcn.00474603
mov eax, dword [esi + 0x6cc]
cmp dword [eax - 0xc], ebp
lea edi, [esi + 0x6cc]
jg 0x426847
push ebp
push ebp
push 0x48eb04
call fcn.0047bc66
jmp 0x426b20
mov ecx, dword [esi + 0x6c8]
cmp dword [ecx - 0xc], ebp
jg 0x426863
push ebp
push ebp
push 0x48eaf0
call fcn.0047bc66
jmp 0x426b20
push ebx
push eax
mov ecx, esi
call fcn.00414e90
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [edx - 0xc]
push ebx
mov dword [esp + 0x18], eax
call fcn.00461333
mov ecx, dword [esp + 0x18]
add esp, 4
cmp eax, ecx
push ebx
je 0x4268a0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebp
push ebp
push 0x48eac8
call fcn.0047bc66
jmp 0x426b1f
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [edi]
push ecx
lea edx, [esi + 0xd9c]
push edx
lea eax, [esp + 0x1f0]
push str._s_s.txt
push eax
xor ebx, ebx
call fcn.0045fbcd
lea ecx, [esp + 0x1f8]
push 0x48ab04
push ecx
call fcn.004606c3
add esp, 0x18
cmp eax, ebp
je 0x42699c
push eax
call fcn.0046013a
push edi
lea edx, [esp + 0x20]
push 0x48eab4
push edx
call fcn.00407130
push str..txt
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x314], ebp
call fcn.00407070
add esp, 0x1c
mov eax, dword [eax]
push 4
push 0x48be1c
push eax
mov ecx, esi
mov byte [esp + 0x304], 1
call fcn.00474473
cmp eax, 7
lea ecx, [esp + 0x1c]
sete bl
call fcn.00401970
or edi, 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x2f8], edi
call fcn.00401970
test bl, bl
jne 0x426b1f
cmp dword [esi + 0xea0], ebp
mov ebx, 1
jne 0x42699c
push ebp
lea ecx, [esp + 0x34]
call fcn.004419a0
lea ecx, [esp + 0x30]
mov dword [esp + 0x2f8], 2
call fcn.0047325f
mov ecx, dword [esp + 0x1e4]
mov dword [esi + 0xea0], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2f8], edi
call fcn.00441a00
cmp dword [0x4ac284], ebp
jne 0x426ab6
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x22]
cmp eax, dword [esi + 0xc94]
je 0x426a69
mov dword [esi + 0xc94], eax
lea eax, [esi + 0xc98]
push eax
lea ecx, [esp + 0x18]
mov dword [0x4ac288], ebp
call fcn.00402080
push str._Ebu_Qc_ebu
lea ecx, [esp + 0x14]
mov dword [esp + 0x2fc], 3
call fcn.00402080
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
xor edi, edi
cmp ecx, ebp
mov byte [esp + 0x2f8], 4
jle 0x426a33
mov edi, edi
push edi
lea ecx, [esp + 0x14]
call fcn.004066e0
dec al
lea ecx, [esp + 0x10]
push eax
push edi
call fcn.00406700
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
inc edi
cmp edi, ecx
jl 0x426a10
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401db0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.00401970
lea ecx, [esp + 0x14]
mov dword [esp + 0x2f8], 0xffffffff
call fcn.00401970
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x58c], edx
mov dword [esi + 0x594], 1
mov dword [esi + 0x590], ebp
mov dword [esi + 0x59c], ebp
mov dword [esi + 0x5a0], ebp
mov dword [esi + 0x598], ebp
mov dword [esi + 0x588], ebx
cmp dword [0x4ac294], ebp
je 0x426b1f
mov eax, dword [esi + 0x224]
lea ecx, [esi + 0x224]
call dword [eax + 0x140]
jmp 0x426b1f
cmp dword [0x4a9448], ebp
jg 0x426b17
push ebp
push ebp
push 0x48ea6c
call fcn.0047bc66
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x58c], ecx
mov dword [esi + 0x594], 1
mov dword [esi + 0x590], ebp
mov dword [esi + 0x59c], ebp
mov dword [esi + 0x5a0], ebp
mov dword [esi + 0x598], ebp
mov dword [esi + 0x588], ebx
cmp dword [0x4ac294], ebp
je 0x426b1f
mov edx, dword [esi + 0x224]
lea ecx, [esi + 0x224]
call dword [edx + 0x140]
jmp 0x426b1f
push ebx
mov ecx, esi
call fcn.0041f000
pop ebx
pop edi
mov ecx, dword [esp + 0x2e8]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2e0]
pop ebp
call fcn.0045f776
add esp, 0x2ec
ret