Function at 0x429300
Capabilities:
Delete file
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x160], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x150], edx
mov edx, dword [ebp + 0x10]
lea ecx, [eax + eax*8]
shl ecx, 4
push ebx
mov dword [ebp - 0x14c], edx
mov edx, dword [ecx + 0x443ae4]
push esi
push edi
mov dword [ebp - 0x12c], ecx
cmp edx, dword [ecx + 0x443ae0]
jl 0x429367
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004391bc
mov esp, ebp
pop ebp
ret
lea edx, [eax*8]
sub edx, eax
mov eax, dword [0x448c78]
mov ebx, dword [eax + edx*8]
mov edx, dword [ecx + 0x443aec]
mov eax, dword [ecx + 0x443af4]
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x154], eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x144], eax
cmp dx, word [ecx + 0x443ae8]
jge 0x429983
mov edi, dword [sym.imp.MSVCR100.dll_fread]
lea esp, [esp]
cmp dword [ebp - 0x134], 1
je 0x42997d
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x443af8], 7
jle 0x429576
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp - 0x130]
movzx esi, byte [ecx + edx]
lea eax, [esi - 0xfb]
cmp eax, 4
ja case.default.0x4293ff
jmp dword [eax*4 + 0x4299a0]
push ebx
push 1
lea eax, [ebp - 0x10d]
push 1
push eax
call edi
add esp, 0x10
lea ecx, [eax - 1]
mov al, byte [ebp - 0x10d]
neg ecx
sbb ecx, ecx
inc ecx
cmp al, 0x64
jg 0x42954d
movsx edx, al
mov dword [ebp - 0x118], edx
fild dword [ebp - 0x118]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
lea eax, [ebp - 0x120]
push 2
push eax
call edi
add esp, 0x10
lea ecx, [eax - 1]
mov ax, word [ebp - 0x120]
neg ecx
sbb ecx, ecx
mov edx, 0x7fe4
inc ecx
cmp ax, dx
jle 0x429482
fld qword [0x4596d0]
fst qword [ebp - 0x11c]
jmp 0x4296ac
cwde
mov dword [ebp - 0x118], eax
fild dword [ebp - 0x118]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
lea ecx, [ebp - 0x128]
push 4
push ecx
call edi
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x128], 0x7fffffe4
jle 0x42966b
fld qword [0x4596d0]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
lea edx, [ebp - 0x138]
push 4
push edx
call edi
fld dword [ebp - 0x138]
fcom qword [0x441b20]
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
fnstsw ax
inc ecx
test ah, 0x41
jne 0x4295e3
fstp st(0)
fld qword [0x4596d0]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
push 8
lea eax, [ebp - 0x15c]
push eax
call edi
fld qword [0x441b18]
fld qword [ebp - 0x15c]
add esp, 0x10
fcom st(1)
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4295e3
fstp st(0)
fld qword [0x4596d0]
fst qword [ebp - 0x11c]
jmp 0x4296ac
test esi, esi
je 0x429699
push ebx
push 1
push esi
lea ecx, [ebp - 0x10c]
push ecx
jmp 0x42968b
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x130]
movzx eax, byte [edx + eax]
lea ecx, [eax - 0x62]
cmp ecx, 0xa
ja case.0x429599.99
movzx ecx, byte [ecx + 0x4299cc]
jmp dword [ecx*4 + 0x4299b4]
push ebx
push 1
lea edx, [ebp - 0x10d]
push 1
push edx
call edi
add esp, 0x10
lea ecx, [eax - 1]
mov al, byte [ebp - 0x10d]
neg ecx
sbb ecx, ecx
inc ecx
cmp al, 0x7f
jne 0x4295d4
fld qword [0x4596d0]
fst qword [ebp - 0x11c]
jmp 0x4296ac
movsx eax, al
mov dword [ebp - 0x118], eax
fild dword [ebp - 0x118]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
push 8
lea ecx, [ebp - 0x15c]
push ecx
jmp 0x429523
push ebx
push 1
lea eax, [ebp - 0x120]
push 2
push eax
call edi
add esp, 0x10
lea ecx, [eax - 1]
mov ax, word [ebp - 0x120]
neg ecx
sbb ecx, ecx
mov edx, 0x7fff
inc ecx
cmp ax, dx
je 0x42954d
cwde
mov dword [ebp - 0x118], eax
fild dword [ebp - 0x118]
fst qword [ebp - 0x11c]
jmp 0x4296ac
push ebx
push 1
lea ecx, [ebp - 0x128]
push 4
push ecx
call edi
add esp, 0x10
lea ecx, [eax - 1]
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x128], 0x7fffffff
je 0x42954d
fild dword [ebp - 0x128]
fst qword [ebp - 0x11c]
jmp 0x4296ac
lea esi, [eax - 0x7f]
test esi, esi
je 0x429699
push ebx
push 1
push esi
lea edx, [ebp - 0x10c]
push edx
call edi
add esp, 0x10
cmp eax, 1
je 0x429699
xor ecx, ecx
jmp 0x42969e
mov ecx, 1
fld qword [ebp - 0x11c]
mov byte [ebp + esi - 0x10c], 0
test ecx, ecx
jne 0x4296ba
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 0x154]
mov esi, dword [ebp - 0x124]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x429863
jns 0x4297c5
cmp dword [0x448520], 0
je 0x42974b
fld qword [0x448680]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x429888
cmp ecx, 0xfffffffd
je 0x42971e
cmp ecx, 0xfffffffe
je 0x429710
cmp ecx, 0xffffffff
jne 0x42972a
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x140], ecx
jmp 0x42972a
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x140], edx
jmp 0x42972a
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x140], eax
fadd qword [0x441a90]
sub esp, 8
fstp qword [esp]
call sub.MSVCR100.dll_floor
mov ecx, dword [ebp - 0x140]
fstp qword [ecx]
add esp, 8
jmp 0x429865
lea eax, [ebp - 0x10c]
fstp st(0)
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x429756
sub eax, esi
cmp eax, 0xc
ja 0x4298da
cmp ecx, 0xfffffffd
je 0x429793
cmp ecx, 0xfffffffe
je 0x429785
cmp ecx, 0xffffffff
jne 0x42979f
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x13c], edx
jmp 0x42979f
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x13c], eax
jmp 0x42979f
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x13c], ecx
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x10c]
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4297b0
mov esi, dword [ebp - 0x124]
jmp 0x429865
cmp ecx, 1
jne 0x429863
mov edx, dword [ebp - 0x12c]
cmp dword [edx + 0x443af8], 7
jle 0x42983b
mov eax, dword [ebp - 0x130]
cmp byte [esi + eax], 0xfb
jae 0x42984b
push str.mdm_variables_must_be_numeric__n
fstp st(0)
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], 1
call esi
mov ecx, dword [0x448bc8]
add esp, 4
push ecx
call esi
add esp, 4
cmp dword [0x443e58], 0
je 0x429833
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [ebp - 0x130]
cmp byte [esi + ecx], 0x80
jae 0x42992b
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x160]
fstp qword [edx + eax*8]
inc eax
mov dword [ebp - 0x144], eax
jmp 0x429865
fstp st(0)
mov eax, dword [ebp - 0x12c]
movsx ecx, word [eax + 0x443ae8]
inc esi
mov dword [ebp - 0x124], esi
cmp esi, ecx
jl 0x4293c0
mov ecx, eax
jmp 0x429983
push str.ID_must_be_no_more_than_12_digits_long_n
fstp st(0)
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00406fe0
mov edx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push edx
mov dword [0x443e58], 1
call esi
mov eax, dword [0x448bc8]
add esp, 4
push eax
call esi
add esp, 4
cmp dword [0x443e58], 0
je 0x4298d2
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
push str.Your_ID_variable_is_longer_than_12_characters._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00406fe0
mov ecx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push ecx
mov dword [0x443e58], 1
call esi
mov edx, dword [0x448bc8]
add esp, 4
push edx
call esi
add esp, 4
cmp dword [0x443e58], 0
je 0x429923
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
push str.mdm_variables_must_be_numeric__n
fstp st(0)
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00406fe0
mov edx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push edx
mov dword [0x443e58], 1
call esi
mov eax, dword [0x448bc8]
add esp, 4
push eax
call esi
add esp, 4
cmp dword [0x443e58], 0
je 0x429975
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [ebp - 0x12c]
inc dword [ecx + 0x443ae4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x134]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret