Function at 0x4027be
Capabilities:
Delete file

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
push 0x3c
lea eax, [esp + 0x34]
xor edi, edi
push 0x4027b8
push eax
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
call fcn.00403167
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x10], ebx
je 0x4027fa
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x5c
ret 0x10
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x70]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
add edx, 0x1f
mov dword [esp + 0x34], ecx
mov cl, byte [ebp + 0xc]
and edx, 0xfffffff0
add edx, eax
lea eax, [ebp + 0xc]
test cl, cl
mov dword [esp + 0x30], edx
je 0x402a0e
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.004015d3
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x402a0e
cmp byte [eax], 0
je 0x402984
mov esi, dword [esp + 0x7c]
cmp esi, 2
je 0x40287c
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00402c60
test eax, eax
je 0x40286e
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.00402fb0
jmp 0x402870
mov eax, esi
cmp eax, edi
jne 0x402984
mov eax, dword [esp + 0x14]
push 0
push 0x8000020
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4029f2
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40291c
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x40291c
mov ecx, dword [ebp + 8]
push 0
push ecx
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x402918
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x402911
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], eax
call fcn.0040317d
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x402977
mov edx, dword [ebp + 8]
push 0
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40293f
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x402943
xor edi, edi
jmp 0x402977
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x7c]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4029e7
jmp 0x4029bd
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402a4e
mov esi, eax
add esp, 4
cmp esi, edi
je 0x4029f2
mov edx, dword [ebp + 8]
lea eax, [esp + 0x30]
push edi
push eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], edx
call fcn.0040317d
push esi
mov dword [esp + 0x14], eax
call fcn.00402a6e
mov ebx, dword [esp + 0x14]
add esp, 4
xor edi, edi
cmp ebx, edi
je 0x4029cc
cmp ebx, 1
jne 0x4027ee
cmp dword [esp + 0x40], edi
jne 0x4029ff
add ebp, 0x100
mov cl, byte [ebp + 0xc]
lea eax, [ebp + 0xc]
test cl, cl
je 0x402a0e
jmp 0x402826
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x5c
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x5c
ret 0x10
lea edx, [esp + 0x30]
push edx
call fcn.00403042
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0x10