Function at 0x5e6bc878
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
nop
call 0x5e6b160c
test esi, esi
je 0x5e6b527f
push esi
mov eax, eax
call fcn.5e6d68f8
pop ecx
push 0
call fcn.5e70d57d
int3
aaa
sub byte [ebp + 0x496951f3], bh
in al, 0x55
mov byte [edx - 0x5c11d503], bl
sub al, 0xf1
jp 0x5e6b526c
xchg bh, dl
push cs
popal
mov dword [ecx + 0x10c], eax
pop ebp
ret 4
push ebp
mov ebp, esp
mov eax, eax
push ecx
cmp dword [0x610a5ad4], 0xe44de74
jns 0x5e6bc8ab
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
inc edi
jno 0x5e6bc894
clc
ja 0x5e6bc8e7
mov edx, 0xa90eab95
inc ebx
fucompi st(2)
sahf
stosd dword es:[edi], eax
push cs
test eax, 0x9eeadf43
push 0xffffffffffffffab
dec edx
lds eax, [eax + 0x4e]
mov esi, 0xb70e962e
in eax, dx
dec esp
cmpsb byte [esi], byte es:[edi]
or byte [ecx + 0x56], dl
push ecx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push 0x10
nop
push 0x610e01e4
push dword [ebp + 0xc]
test dword [0x61084149], 0x549389a9
jno 0x5e6bc906
jo 0x5e6bc91b
lcall 0xc406, 0xf6d5b93d
dec eax
hlt
pop esp
cwde
test byte [eax - 0x73], 0x57
int1
sub esi, 0xffffff87
test al, 0xf4
dec edx
push ss
jp 0x5e6bc894
and esp, ebx
ror byte [ebp - 0x57], 0xc9
xor dh, ch
hlt
mov dword [esi], eax
mov byte [ebp + 0x10], al
mov byte [ebp - 4], al
nop
nop
nop
call int.5e70e3ca
add esp, 0xc
push ebx
mov ebx, eax
and ebx, eax
pop ebx
je 0x5e6bc96d
fsub dword [ebx]
fcomp dword [ebx + 0x74]
dec esp
push 0x10
mov ecx, ecx
push 0x610e044c
push dword [ebp + 0xc]
call int.5e70e3ca
mov eax, eax
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ebp + 0x10], al
jne 0x5e6bc96d
nop
nop
push 0x10
push 0x610e0204
push dword [ebp + 0xc]
call int.5e70e3ca
nop
nop
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ebp - 4], al
jne 0x5e6bc96d
mov eax, 0x80004002
jmp 0x5e6bca1e
lea eax, [ebp + 0xc]
mov eax, eax
push eax
mov ecx, ecx
lea eax, [ebp - 8]
cmp dword [0x610c4709], 0x2a4b4bd2
js 0x5e729daa
push eax
push dword [ebp + 0x10]
cmp word [0x6107d09f], 0x4268
js 0x5e706c3a
push dword [ebp - 4]
nop
nop
nop
push dword [ebp + 8]
test dword [0x6106083a], 0x30ae9763
jne 0x5e6bc9ed
out 0x34, eax
in eax, dx
sub dword [edi - 0x17], eax
inc ebx
mov bl, 0x22
retf 0x6e3b
call fcn.5e6bc6e7
add esp, 0x14
test eax, eax
jne 0x5e6bca1e
push edx
mov edx, dword [ebp + 0xc]
sub edx, eax
pop edx
jge 0x5e6bca0d
nop
nop
mov eax, 0x80040111
nop
nop
jmp 0x5e6bca1e
push esi
push dword [ebp - 8]
push dword [ebp + 0xc]
mov eax, eax
call fcn.5e6bc58c
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 0xc
int 0x1c
cmp eax, 0x846a7b31
mov ch, 0x4a
dec edx
push ebx
mov byte [0xdc6f1ca0], al
push esp
into
invalid
pop ebp
pop esi
nop
jmp fcn.5e6e9180
jne 0x5e6e9ff8
test al, 1
je 0x5e6e9ff8
add byte [ebx + 0x5090fee0], al
and eax, 0xfffffffe
nop
push eax
cmp dword [0x61091dd7], 0x19ff7818
jns 0x5e6e9fab
and cl, byte [ebx]
and edx, ebx
adc ebp, edi
dec edi
fisttp word [ebp + 0x6d34b7ee]
push ebx
jp 0x5e6e9f5c
and dh, dh
wait
mov ah, 0xbd
push ds
pop ss
dec esp
mov byte [0x18f62a2c], al
in eax, 9
retf
push dword [ebp + 8]
call fcn.5e6ea0ba
pop ecx
test byte [0x61002739], 0xec
jne 0x5e6e9fed
jno 0x5e6e9ff7
dec ecx
pop ds
mov eax, 0x1842dad9
mov ecx, 0x7cb93a8b
jae 0x5e6e9ff9
popfd
mov al, 0xa4
mov edi, 0xe32f3ce2
push edi
adc esp, dword [edx + edx*2]
outsd dx, dword [esi]
mov ah, 0x6a
imul edx, esi, 0xa14e2b94
rcr dword [edi + ebx - 6], cl
invalid
pop ecx
push ebx
mov bl, al
and bl, al
pop ebx
jne 0x5e6e9ff8
pop ebp
ret
push dword [ebp + 8]
jne 0x5e6ea003
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, eax
and ecx, eax
pop ecx
enter 0xffffffffffffc823, 0x59
setne al
pop ebp
ret
call fcn.5e6d68f8
pop ecx
pop ecx
mov ecx, ecx
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.5e6ecc8b
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x18]
call fcn.5e6ecac7
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov ecx, ecx
ret
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x24]
cmp dword [esi + 0x28], eax
jne 0x5e6fd7be
and dword [esi + 0x28], 0
mov ecx, dword [esi + 0x28]
xor edx, edx
test byte [0x610c406b], 0x73
js 0x5e71767a
push dword [ebp + 0x20]
nop
nop
sub eax, ecx
mov dword [ebp - 8], ecx
cmp eax, edi
cmovae edx, dword [ebp + 0x1c]
cmovae eax, edi
push edx
nop
nop
nop
lea edx, [ebp + 8]
mov eax, eax
add eax, ecx
push edx
push dword [ebp + 0x14]
push eax
mov ecx, ecx
push esi
nop
nop
call fcn.5e6fd96a
mov ecx, dword [ebp + 8]
add dword [ebx], ecx
add dword [ebp + 0x14], ecx
sub dword [ebp - 4], ecx
nop
mov ebx, dword [esi + 0x28]
nop
mov ecx, dword [esi + 0x20]
sub ebx, dword [ebp - 8]
add ecx, dword [ebp - 8]
push ebx
cmp word [0x61016636], 0xd5cc
jne 0x5e6b52b7
push ecx
mov eax, eax
push dword [ebp + 0xc]
nop
mov dword [ebp - 0xc], eax
call fcn.5e710a24
cmp word [0x61086911], 0xf9b3
je 0x5e6fd87b
pop ecx
insb byte es:[edi], dx
jae 0x5e6fd855
outsb dx, byte [esi]
xlatb
div ebx
add al, 0x64
mov eax, dword [ebp + 0x10]
cmp dword [0x60fe04b7], 0x8c6a8f9
jns 0x5e6fd8c2
invalid
xlatb
mov dword [edi - 0x2d], eax
or edx, edx
cwde
sub byte [edx + 0x284a620e], ch
test dword [ebp + 0x76], 0x8ad7dc0b
jns 0x5e6fd8a9
or byte [ebx + 0x6b], ch
sub byte [ecx + edi*4], dh
mov bh, 0x39
aaa
not dword ss:[edx - 0x17e51ef6]
invalid
push esp
aad 0x2e
cmp bl, bh
add esp, 0x24
cmp dword [0x6109d74c], 0x571d2bc5
jns 0x5e6fd8fe
pop esi
mov esi, 0xedc00c90
std
push ecx
mov byte [0x953b752b], al
and dword [eax - 0x55], ebp
out 0xa5, eax
scasd eax, dword es:[edi]
push eax
xchg ebp, eax
jg 0x5e6fd93d
dec eax
jbe 0x5e6fd94a
dec esp
adc dword [edi], esp
or dl, byte [edi - 0x61]
mov bl, 0xb
das
dec ecx
sti
cmp al, 0x99
in al, 0x86
loop 0x5e6fd882
in eax, 0x73
add dword [ebp + 0xc], ebx
sub edi, ebx
test word [0x60fd5d79], 0x6af7
jns 0x5e6fd939
sti
inc sp
pushfd
sub al, 0x7d
inc eax
shr dword [esi], 0x6e
jp 0x3aa4d5a0
cmp dword [esi + ebx*8], 0xd30e58f
dec edx
inc esp
or ah, byte [edi]
and al, byte [ebx]
fmul st(7), st(0)
or eax, 0xb727c150
inc ecx
mov bh, 0xc5
adc dl, dh
add dword fs:[eax], ebx
add dword [eax], ebx
mov ecx, ecx
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, eax
and ebx, eax
pop ebx
jne 0x5e6fd960
push ecx
mov ecx, ebx
and ecx, ebx
pop ecx
je 0x5e6fd95e
retf
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
test edi, edi
jne 0x5e6fd7af
xor eax, eax
pop edi
pop esi
pop ebx
mov eax, eax
mov esp, ebp
pop ebp
nop
ret
mov dword [ebp - 0x24], eax
push ebx
mov ebx, eax
and ebx, eax
pop ebx
jns 0x5e706c4f
mov ebx, 0x80070057
jmp 0x5e706f84
mov cl, byte [esi + 0x60]
nop
mov edi, dword [esi + 0x14]
test cl, cl
je 0x5e706c62
mov edi, dword [edi + eax*8 + 4]
nop
nop
jmp 0x5e706c66
nop
mov edi, dword [edi + eax*8]
test cl, cl
jne 0x5e706c71
nop
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + edi*4]
mov eax, dword [esi + 0x6c]
mov ecx, edi
shl ecx, 2
mov dword [ebp - 0x1c], ecx
cmp dword [0x6102284d], 0xdd246566
js 0x5e6fd8bd
mov eax, dword [ecx + eax]
mov dword [ebp + 0xc], eax
mov ecx, dword [eax]
test ecx, ecx
jne 0x5e706c9b
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
nop
push edx
push 0x610e0124
push ecx
call dword [eax]
push ebx
mov ebx, dword [ebp - 0x14]
sub ebx, 0
pop ebx
je 0x5e706f7d
mov al, byte [esi + 0x60]
mov ecx, dword [ebp + 0xc]
push ecx
mov cl, al
and cl, al
pop ecx
je 0x5e706ccb
mov edx, dword [ecx + 8]
jmp 0x5e706cd2
mov eax, eax
xor edx, edx
mov eax, eax
inc edx
cmp dword [0x6107903e], 0x9bb15b11
js 0x5e711bb4
mov dword [ebp - 0x20], edx
test al, al
je 0x5e706cf2
mov eax, dword [esi + 0x30]
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi + eax]
mov byte [ebp + 0xf], bl
push ebx
mov ebx, edx
sub ebx, 1
pop ebx
jne 0x5e706eaf
mov dword [ebp - 0x18], ebx
mov eax, dword [ecx]
mov eax, eax
mov byte [ebp - 4], dl
lea edx, [ebp - 0x18]
test dword [0x6106fd66], 0x1aa343ab
jo 0x5e72991b
push edx
push 0x610e03ec
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5e706e57
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
cmp byte [0x61000beb], 0xdc
je 0x5e706d7f
inc esi
dec edi
sbb al, 0x3e
sal dword [edx], cl
invalid
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.5e706b14
nop
nop
mov edi, eax
push ebx
mov ebx, edi
and ebx, edi
pop ebx
jne 0x5e706dbd
test dword [0x6106a094], 0x618ec987
js 0x5e6ecb95
mov eax, dword [ebp - 0x18]
nop
nop
push dword [ebp - 0x1c]
nop
nop
nop
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
je 0x5e706e2e
mov eax, dword [ebp - 0x1c]
nop
nop
mov byte [ebp - 4], 1
test eax, eax
je 0x5e706dd2
mov ecx, dword [eax]
mov eax, eax
push eax
call dword [ecx + 8]
test byte [0x61000f56], 0x68
jo 0x5e6de7eb
mov eax, dword [ebp - 0x18]
test word [0x610230d5], 0x2d31
jne 0x5e706e16
xor al, 0x96
xchg ebp, eax
xchg byte [ebx + 1], cl
dec edx
movsd dword es:[edi], dword [esi]
and al, 0x47
out dx, eax
cmp eax, 0xc4cf00b1
ret
mov byte [ebp - 4], bl
push edx
mov edx, eax
and edx, eax
pop edx
je 0x5e706e27
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, edi
jmp 0x5e706f84
mov eax, dword [ebp - 0x1c]
mov byte [ebp + 0xf], 1
test word [0x6100017a], 0x3fa8
jo 0x5e6c917c
mov byte [ebp - 4], 1
test eax, eax
je 0x5e706e54
mov ecx, dword [eax]
push eax
mov ecx, ecx
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
cmp word [0x610d387c], 0xf60c
jns 0x5e706e95
push esp
ja 0x5e706def
mov eax, dword [0xcb5b5564]
test dword [ebp + 0x69d1f46c], esi
dec esp
sahf
stosb byte es:[edi], al
jns 0x5e706e23
test byte cs:[eax + esi*2], ch
inc ebx
sub eax, 0x231d6b73
cmpsb byte gs:[esi], byte es:[edi]
push ds
test al, 0xbe
mov ch, byte [ecx + 0x17]
pop ss
sub di, word [edi + 0x21]
mov al, 0x95
fidiv dword [edi]
dec edi
push ds
xchg edx, eax
push 0xffffffffffffff88
pop ebp
cld
mov byte [ebp - 4], bl
test eax, eax
je 0x5e706ea6
mov eax, eax
mov ecx, dword [eax]
mov eax, eax
push eax
call dword [ecx + 8]
cmp byte [ebp + 0xf], 0
jne 0x5e706ebb
mov edx, dword [ebp - 0x20]
push ebx
mov ebx, edx
and ebx, edx
pop ebx
jne 0x5e706f7d
mov edi, dword [ebp - 0x24]
cmp dword [esi + 0x7c], edi
ja 0x5e706ed2
lea ecx, [esi + 0x78]
call fcn.5e7046ba
cmp dword [esi + 0x7c], edi
jbe 0x5e706ec3
xor ebx, ebx
cmp byte [0x6100713c], 0xfc
jns 0x5e706efd
rol ecx, 0x64
arpl word [ebp + 0x27], dx
pop ebx
xchg esi, eax
and al, byte [edi - 0x41]
pop ds
mov bh, 0xb2
insd dword es:[edi], dx
fdivr qword [edi + 0x755214af]
adc byte [ebx], ch
xor al, 0x1b
xor dword [ebp + ebp*8 - 0x1e6e775f], 0x78468b96
mov eax, dword [esi + 0x78]
mov edi, dword [eax + edi*4]
cmp dword [edi + 8], 0
jne 0x5e706f7d
push ecx
mov ecx, dword [edi + 4]
sub ecx, ebx
pop ecx
jne 0x5e706f7d
mov ecx, ecx
push 0x18
test byte [0x610a02d3], 4
jo 0x5e6ed117
call fcn.5e6bacbc
pop ecx
test eax, eax
je 0x5e706f3b
mov ecx, eax
call fcn.5e70426f
mov esi, eax
nop
nop
nop
jmp 0x5e706f3d
mov esi, ebx
push esi
lea ecx, [edi + 8]
call fcn.5e6f25df
mov dword [edi + 4], esi
lea ecx, [esi + 0xc]
push dword [ebp - 0x14]
call fcn.5e6f25df
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
push dword [edi + 4]
nop
nop
mov ebx, 0x80004001
pop eax
je 0x5e7177da
push edx
mov edx, ebx
sub edx, 0xfde9
pop edx
je 0x5e7177da
movzx eax, bx
push eax
test byte [0x610a35e9], 0xf4
jns 0x5e6bb3e3
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5e7177da
lea eax, [ebp - 0x18]
test byte [0x6103d507], 0x1a
je 0x5e6e9f4f
push eax
mov ecx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
je 0x5e7177c5
push 0x101
test byte [0x61044e2a], 0xaf
jb 0x5e6e74b8
lea eax, [esi + 0x18]
push edi
push eax
call fcn.5e711c80
mov dword [esi + 4], ebx
cmp word [0x61034340], 0x493d
jns 0x5e71a6c0
add esp, 0xc
xor ebx, ebx
mov dword [esi + 0x21c], edi
inc ebx
push edx
mov edx, dword [ebp - 0x18]
sub edx, ebx
pop edx
jbe 0x5e7177b4
cmp byte [ebp - 0x12], 0
lea eax, [ebp - 0x12]
je 0x5e71778a
nop
mov dword [esi + 8], edi
cmp dword [0x610ecffa], edi
je 0x5e7177da
nop
nop
push esi
call fcn.5e716fbd
jmp 0x5e7178a1
mov ecx, ecx
or eax, 0xffffffff
jmp 0x5e7178a7
push dword [ebp + 8]
mov eax, eax
push 0
push dword [0x610ed00a]
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov ecx, ecx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
nop
nop
nop
mov eax, 0x5e730438
jmp fcn.5e711bbd