Function at 0x438887
Capabilities:
Delete file
Resolve path using msvcrt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x457904]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x46fec0], 1
push ebx
push esi
push edi
jae 0x4388be
cmp byte [0x45e9c2], 0
jne 0x4388be
cmp byte [0x45e9ff], 0
jne 0x4388be
call fcn.004385cb
mov ecx, dword [0x46fdac]
xor edi, edi
test ecx, ecx
je 0x4388d5
call fcn.004409c5
mov dword [0x46fdac], edi
mov ecx, dword [0x45fa7c]
test ecx, ecx
je 0x4388ea
call fcn.004409c5
mov dword [0x45fa7c], edi
mov ecx, dword [0x46fed4]
test ecx, ecx
je 0x4388ff
call fcn.004409c5
mov dword [0x46fed4], edi
mov ecx, dword [0x4713ac]
test ecx, ecx
je 0x438916
mov esi, dword [ecx]
call fcn.004409c5
mov ecx, esi
test esi, esi
jne 0x438909
mov edx, 0x428c6a
xor cl, cl
call fcn.0044080e
mov dword [0x45e64c], eax
mov eax, dword [0x45fa10]
test eax, eax
jne 0x438938
mov eax, dword [0x45e9e4]
add eax, 4
push 0x428bec
mov ecx, eax
call fcn.00438725
mov edx, eax
mov ecx, 0x45e9cc
call fcn.004375e1
mov ecx, 0x428bf8
mov dword [0x45e9cc], eax
call fcn.004387ca
cmp byte [0x45e532], 0
je 0x438972
mov ecx, 0x428bfc
call fcn.004387ca
mov edx, dword [0x45fa0c]
test edx, edx
je 0x438986
mov ecx, 0x428c10
call fcn.00438817
cmp dword [0x45fa18], edi
setne al
or byte [0x45fa58], al
je 0x4389bf
mov ecx, dword [0x45e9cc]
push 0x428c1c
call fcn.00438725
mov edx, eax
mov ecx, 0x45fa18
call fcn.004375e1
mov edx, eax
mov ecx, 0x428c28
call fcn.00438817
mov edx, dword [0x45e9cc]
mov ecx, 0x428c34
call fcn.00438817
cmp dword [0x45fa08], edi
je 0x4389f6
mov ecx, 0x428c40
call fcn.004387ca
mov ecx, dword [0x45fa08]
call fcn.004387ca
mov ecx, 0x428be4
call fcn.004387ca
mov esi, dword [0x45e9e4]
mov ebx, 0x428980
jmp 0x438a0f
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00438817
mov esi, dword [esi]
test esi, esi
jne 0x438a03
mov esi, dword [0x45e9dc]
jmp 0x438a27
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00438817
mov esi, dword [esi]
test esi, esi
jne 0x438a1b
mov ecx, dword [0x45e64c]
call fcn.004409c5
mov eax, dword [0x45fa04]
mov esi, 0x4282cc
mov dword [0x45e64c], edi
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], 0x428c68
mov dword [ebp - 0x418], edi
test eax, eax
je 0x438a6a
lea ecx, [ebp - 0x420]
push ecx
push eax
jmp 0x438ada
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
push edi
push edi
push edi
push edi
push 0x100
lea ecx, [ebp - 0x414]
push ecx
push 3
lea ecx, [ebp - 0xc]
push ecx
push dword [eax]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
push 0x428bec
lea eax, [ebp - 0x414]
push esi
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x214]
call fcn.00438b9a
lea eax, [ebp - 0x214]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
add esp, 0x38
test eax, eax
lea eax, [ebp - 0x420]
push eax
jne 0x438ad5
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnv]
jmp 0x438ae1
push 0x428c54
push edi
call dword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnvp]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x438b08
cmp esi, 0xffffffff
jne 0x438afc
push edi
xor edx, edx
mov ecx, 0x3fc
call fcn.0043b396
push 0x428c6a
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
pop ecx
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3