Function at 0x403578
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x290], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
push edi
push 0xd
mov dword [esp + 0x30], eax
mov ebx, edx
pop eax
mov dword [esp + 0x28], ecx
mov esi, eax
mov edi, 0xa0
mov dword [esp + 0xc], esi
mov edx, edi
mov ecx, ebx
call fcn.00402125
add eax, 0xe
cmp eax, edi
ja 0x4036b1
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x403a34
lea eax, [esp + 0xb8]
push 0x180
push eax
call dword [sym.imp.msvcrt.dll__chmod]
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.msvcrt.dll_remove]
add esp, 0xc
lea eax, [esp + 0xb8]
push edi
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
push 0x1001
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
lea eax, [esp + 0xb8]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
cmp edi, 0xffffffff
jne 0x403650
push 4
jmp 0x4036b3
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x40672c]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x4036b1
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalSize]
push dword [0x4063f0]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x403886
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 6
pop eax
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404bf0
mov esp, ebp
pop ebp
ret 4
mov cl, byte [edi + 1]
cmp cl, 0x3a
jne 0x4036d9
cmp byte [edi + 2], 0x5c
je 0x4036e3
cmp byte [edi], 0x5c
jne 0x4036ed
cmp cl, 0x5c
jne 0x4036ed
mov byte [esp + 0x158], 0
jmp 0x40371d
mov esi, dword [esp + 0x28]
mov edx, 0xa0
mov ecx, esi
call fcn.00402125
mov ecx, 0xa0
cmp eax, ecx
jge 0x4036b1
mov edx, ecx
lea ecx, [esp + 0x158]
push esi
call fcn.00401590
test eax, eax
js 0x403a34
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402125
mov edx, 0xa0
lea ecx, [esp + 0x158]
mov esi, eax
call fcn.00402125
add esi, eax
mov eax, 0xa0
cmp esi, eax
jae 0x4036b1
push edi
mov edx, eax
lea ecx, [esp + 0x15c]
call fcn.004015c3
test eax, eax
js 0x403a34
mov edi, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x1c]
call fcn.00402125
mov edx, 0xa0
mov ecx, ebx
mov esi, eax
call fcn.00402125
inc eax
mov ecx, 0xa0
add eax, esi
cmp eax, ecx
jae 0x4036b1
push edi
push ebx
push 0x401144
push ecx
lea eax, [esp + 0xc8]
push eax
call fcn.0040162e
add esp, 0x14
test eax, eax
js 0x403a34
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401270
call fcn.0040fef1
test eax, eax
je 0x4038a3
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call fcn.0040fef1
test eax, eax
je 0x4038a3
mov edi, dword [esp + 0x18]
cmp byte [edi], 0x40
jne 0x40382c
cmp byte [0x406cc0], 0
je 0x40389f
mov esi, dword [esp + 0xc]
mov dword [esp + 0x24], 1
jmp 0x403863
lea edx, [esp + 0xb8]
lea ecx, [esp + 0x158]
call fcn.0040fef1
movzx esi, ax
push 0xd
pop eax
mov dword [esp + 0xc], esi
cmp si, ax
jne 0x4038aa
lea eax, [esp + 0xb8]
push 0x100
push eax
call dword [sym.imp.msvcrt.dll__chmod]
pop ecx
pop ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x10]
add edi, eax
mov dword [esp + 0x18], edi
call fcn.00402125
mov ecx, dword [esp + 0x10]
inc ecx
add ecx, eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov ecx, edi
call fcn.00402125
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4036cb
jmp 0x4038aa
push 3
jmp 0x4038a5
push 7
pop esi
mov dword [esp + 0xc], esi
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov edi, 0xa0
mov ecx, ebx
mov edx, edi
call fcn.00402125
add eax, 0xe
cmp eax, edi
ja 0x4036b1
push ebx
push 0x401260
lea eax, [esp + 0xc0]
push edi
push eax
call fcn.0040162e
add esp, 0x10
test eax, eax
js 0x403a34
mov edi, dword [esp + 0x2c]
mov edx, 0xa0
mov ecx, ebx
mov byte [edi], 0
call fcn.00402125
mov ecx, 0xa0
cmp eax, ecx
jae 0x4036b1
mov edx, ecx
lea ecx, [esp + 0x1f8]
push ebx
call fcn.00401590
test eax, eax
js 0x403a34
push 0xd
pop eax
mov byte [edi], 0x5c
cmp si, ax
jne 0x4039c4
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x140]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x40127c
call fcn.00403480
test eax, eax
je 0x4039b6
sub esp, 0x88
lea esi, [esp + 0xb8]
mov edx, ebx
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.00403480
test eax, eax
je 0x4039b6
sub esp, 0x88
lea esi, [esp + 0xb8]
lea edx, [esp + 0x280]
push 0x22
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x401280
call fcn.00403480
test eax, eax
jne 0x4039bd
push 7
jmp 0x4036b3
mov esi, dword [esp + 0xc]
push 0xd
pop eax
cmp dword [esp + 0x24], 0
je 0x403a2c
cmp si, ax
jne 0x403a2c
push dword [0x40672c]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, eax
test esi, esi
je 0x4036b1
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalLock]
test eax, eax
je 0x4036a5
lea ecx, [esp + 0xb8]
push ecx
push ecx
push eax
push esi
push ebx
push dword [esp + 0x3c]
push ecx
push ecx
call fcn.004018e1
push dword [0x40672c]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push dword [0x4063f0]
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov ax, si
jmp 0x4036b4
call fcn.00402159
int3