Function at 0x65781c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x657825
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x657d26
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x138]
xor ecx, ecx
mov edx, 0x114
call fcn.00403b8c
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x134]
add eax, eax
lea eax, [eax + eax*4]
add eax, dword [ebp - 0x130]
cmp eax, 0x3d
jb 0x6578f0
mov byte [ebp - 0x21], 1
lea ecx, [ebp - 0x144]
mov edx, 0x1a
xor eax, eax
call fcn.0052cfb8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00482dcc
push dword [ebp - 0x140]
push 0x657d44
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 8]
call fcn.00406f3c
push dword [ebp - 0x148]
push 0x657dd0
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.00407348
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x20]
call fcn.0040700c
jmp 0x6578f4
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00406f3c
cmp byte [ebp - 0x21], 0
je 0x657a7a
mov eax, dword [ebp - 0x18]
call fcn.006559ec
test al, al
je 0x657a7a
cmp dword [ebp - 0xc], 0
jne 0x6579e2
mov eax, dword [ebp - 0x18]
call fcn.006559ec
test al, al
je 0x657a7a
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x14c]
call fcn.0047a474
test al, al
je 0x657a7a
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x150]
call fcn.00657770
test al, al
jne 0x6579d6
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.00406f3c
mov eax, dword [ebp - 0x154]
call fcn.006564c8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x158]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x657a7a
mov eax, dword [ebp - 0x20]
call fcn.004068c4
mov edx, 0x657ddc
mov ecx, 1
call fcn.0052cabc
jmp 0x657a7a
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x657cd3
cmp dword [ebp - 0xc], 1
jne 0x657a7a
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x15c]
call fcn.00657770
test al, al
je 0x657a6e
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 8]
call fcn.00406f3c
mov eax, dword [ebp - 0x160]
call fcn.006564c8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x164]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x657cd3
mov eax, dword [ebp - 0x20]
call fcn.004068c4
mov edx, 0x657ddc
mov ecx, 1
call fcn.0052cabc
jmp 0x657cd3
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x657cd3
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00655b38
cmp dword [ebp - 0x1c], 0
je 0x657ccc
cmp dword [ebp - 0x18], 0
je 0x657b04
cmp byte [ebp - 0x21], 0
je 0x657aa8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00406f3c
jmp 0x657b0f
push 1
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x16c]
mov edx, dword [ebp - 8]
call fcn.00406840
mov eax, dword [ebp - 0x16c]
push eax
lea eax, [ebp - 0x170]
mov edx, dword [ebp - 4]
call fcn.00406840
mov eax, dword [ebp - 0x170]
mov edx, dword [ebp - 0xc]
and edx, 0x80000001
jns 0x657aea
dec edx
or edx, 0xfffffffe
inc edx
dec edx
sete cl
pop edx
call fcn.006557b8
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x14]
call fcn.00406ff8
jmp 0x657b0f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00406f3c
mov eax, dword [ebp - 0x14]
call fcn.00657770
or al, byte [ebp - 0x21]
je 0x657c8f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00655c68
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
je 0x657b42
sub eax, 2
je 0x657bec
jmp 0x657c96
lea ecx, [ebp - 0x17c]
mov edx, 0x1a
xor eax, eax
call fcn.0052cfb8
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.00482dcc
push dword [ebp - 0x178]
push 0x657d44
lea eax, [ebp - 0x180]
mov edx, dword [ebp - 8]
call fcn.00406f3c
push dword [ebp - 0x180]
push 0x657dd0
lea eax, [ebp - 0x174]
mov edx, 4
call fcn.00407348
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x20]
call fcn.0040700c
lea eax, [ebp - 0x184]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x184]
call fcn.0047a474
test al, al
je 0x657c96
lea eax, [ebp - 0x188]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x188]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x657c96
lea ecx, [ebp - 0x194]
mov edx, 0x1a
xor eax, eax
call fcn.0052cfb8
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.00482dcc
push dword [ebp - 0x190]
push 0x657dec
lea eax, [ebp - 0x198]
mov edx, dword [ebp - 8]
call fcn.00406f3c
push dword [ebp - 0x198]
push 0x657dd0
lea eax, [ebp - 0x18c]
mov edx, 4
call fcn.00407348
mov edx, dword [ebp - 0x18c]
lea eax, [ebp - 0x20]
call fcn.0040700c
lea eax, [ebp - 0x19c]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x19c]
call fcn.0047a474
test al, al
je 0x657c96
lea eax, [ebp - 0x1a0]
mov edx, dword [ebp - 0x20]
call fcn.00406ff8
mov eax, dword [ebp - 0x1a0]
call fcn.00406e0c
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x657c96
mov dword [ebp - 0x10], 0xfffffffc
cmp dword [ebp - 0x10], 0
jne 0x657cc0
cmp dword [ebp - 0xc], 0
jne 0x657cc0
lea eax, [ebp - 0x1a4]
mov edx, dword [ebp - 8]
call fcn.00406f3c
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebp - 0x21]
call fcn.00656930
jmp 0x657cd3
cmp dword [ebp - 0x10], 0
jne 0x657cd3
cmp dword [ebp - 0xc], 2
jmp 0x657cd3
mov dword [ebp - 0x10], 0xfffffffe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657d2d
lea eax, [ebp - 0x1a4]
mov edx, 0xd
call fcn.00406d78
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.004066dc
lea eax, [ebp - 0x164]
mov edx, 0xb
call fcn.00406d78
lea eax, [ebp - 0x20]
call fcn.004066c4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00406d78
ret