Function at 0x403a10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4708d6
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0x4cc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0x4e4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4f4]
lea ecx, [esp + 0x30]
call fcn.00405790
lea ecx, [esp + 0x134]
mov dword [esp + 0x4ec], 0
call fcn.00405790
lea ecx, [esp + 0x134]
mov byte [esp + 0x4ec], 1
call fcn.00405880
push esi
lea ecx, [esp + 0x34]
call fcn.00405970
push 0x96
call fcn.0045cd98
push 0x96
mov edi, eax
call fcn.0045cd98
push 0x96
mov ebp, eax
call fcn.0045cd98
push 0x96
mov ebx, eax
call fcn.0045cd98
add esp, 0x10
push 0
push str.UseRegistry
push str.admin
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.00405d70
push eax
push str.UseRegistry
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.MSLogonRequired
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push eax
push str.MSLogonRequired
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.NewMSLogon
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push eax
push str.NewMSLogon
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0x96
push edi
push str.group1
push str.admin_auth
lea ecx, [esp + 0x40]
call fcn.00405d90
push 0x96
push ebp
push str.group2
push str.admin_auth
lea ecx, [esp + 0x40]
call fcn.00405d90
push 0x96
push ebx
push str.group3
push str.admin_auth
lea ecx, [esp + 0x40]
call fcn.00405d90
push edi
push str.group1
push str.admin_auth
lea ecx, [esp + 0x140]
call fcn.00405cf0
push ebp
push str.group2
push str.admin_auth
lea ecx, [esp + 0x140]
call fcn.00405cf0
push ebx
push str.group3
push str.admin_auth
lea ecx, [esp + 0x140]
call fcn.00405cf0
push 0
push str.locdom1
push str.admin_auth
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.locdom2
push str.admin_auth
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 0
push str.locdom3
push str.admin_auth
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push edi
push str.locdom1
push str.admin_auth
lea ecx, [esp + 0x140]
mov ebp, eax
call fcn.00405d10
push ebx
push str.locdom2
push str.admin_auth
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.locdom3
push str.admin_auth
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.DebugMode
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.Avilog
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 0x200
mov ebx, eax
lea eax, [esp + 0x2e4]
push eax
push str.path
push str.admin
lea ecx, [esp + 0x40]
call fcn.00405d90
push 0
push str.DebugLevel
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push 0x475cd8
push str.admin
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push 0
push 0x475cc8
push str.admin
lea ecx, [esp + 0x3c]
mov dword [esp + 0x28], eax
call fcn.00405d70
push edi
mov dword [esp + 0x18], eax
push str.DebugMode
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebx
push str.Avilog
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
lea ecx, [esp + 0x2e0]
push ecx
push str.path
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405cf0
push ebp
push str.DebugLevel
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x1c]
push edx
push 0x475cd8
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov eax, dword [esp + 0x14]
push eax
push 0x475cc8
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.UseDSMPlugin
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.AllowLoopback
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 1
push str.AuthRequired
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push 0
push str.ConnectPriority
push str.admin
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push edi
push str.UseDSMPlugin
push str.admin
lea ecx, [esp + 0x140]
mov dword [esp + 0x20], eax
call fcn.00405d10
push ebx
push str.AllowLoopback
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.AuthRequired
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x14]
push ecx
push str.ConnectPriority
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0x80
lea edx, [esp + 0x264]
push edx
push str.DSMPlugin
push str.admin
lea ecx, [esp + 0x40]
call fcn.00405d90
mov edi, dword [esp + 0x18]
push 0x96
push edi
push str.AuthHosts
push str.admin
lea ecx, [esp + 0x40]
call fcn.00405d90
lea eax, [esp + 0x260]
push eax
push str.DSMPlugin
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405cf0
push edi
push str.AuthHosts
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405cf0
push 1
push str.AllowShutdown
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 1
push str.AllowProperties
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 1
push str.AllowEditClients
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push edi
push str.AllowShutdown
push str.admin
lea ecx, [esp + 0x140]
mov ebp, eax
call fcn.00405d10
push ebx
push str.AllowProperties
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.AllowEditClients
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 1
push str.FileTransferEnabled
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 1
push str.FTUserImpersonation
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 1
push str.BlankMonitorEnabled
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push 1
push str.DefaultScale
push str.admin
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push 0
push str.CaptureAlphaBlending
mov dword [esp + 0x20], eax
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.BlackAlphaBlending
push str.admin
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], eax
call fcn.00405d70
push edi
push str.FileTransferEnabled
push str.admin
lea ecx, [esp + 0x140]
mov dword [esp + 0x28], eax
call fcn.00405d10
push ebx
push str.FTUserImpersonation
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.BlankMonitorEnabled
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x18]
push ecx
push str.DefaultScale
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x14]
push edx
push str.CaptureAlphaBlending
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov eax, dword [esp + 0x1c]
push eax
push str.BlackAlphaBlending
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 1
push str.SocketConnect
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 1
push str.HTTPConnect
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 1
push str.XDMCPConnect
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push 1
push str.AutoPortSelect
push str.admin
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push 0
push str.PortNumber
push str.admin
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.00405d70
push 0
push str.HTTPPortNumber
push str.admin
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], eax
call fcn.00405d70
push 0
push str.IdleTimeout
mov dword [esp + 0x24], eax
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push edi
push str.SocketConnect
push str.admin
lea ecx, [esp + 0x140]
mov dword [esp + 0x2c], eax
call fcn.00405d10
push ebx
push str.HTTPConnect
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.XDMCPConnect
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x18]
push ecx
push str.AutoPortSelect
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x14]
push edx
push str.PortNumber
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov eax, dword [esp + 0x1c]
push eax
push str.HTTPPortNumber
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x20]
push ecx
push str.IdleTimeout
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.RemoveWallpaper
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.RemoveAero
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push edi
push str.RemoveWallpaper
push str.admin
lea ecx, [esp + 0x140]
mov ebx, eax
call fcn.00405d10
push ebx
push str.RemoveAero
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.QuerySetting
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.QueryTimeout
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 0
push str.QueryAccept
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
mov ebp, eax
push 0
push str.QueryIfNoLogon
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push edi
push str.QuerySetting
push str.admin
lea ecx, [esp + 0x140]
mov dword [esp + 0x2c], eax
call fcn.00405d10
push ebx
push str.QueryTimeout
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.QueryAccept
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x20]
push edx
push str.QueryIfNoLogon
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 8
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x38]
call fcn.00405dc0
lea ecx, [esp + 0x238]
push ecx
lea ecx, [esp + 0x138]
call fcn.00405de0
push 0
push str.InputsEnabled
push str.admin
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.LockSetting
push str.admin
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 0
push str.LocalInputsDisabled
push str.admin
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push 0
push str.EnableJapInput
push str.admin
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push edi
push str.InputsEnabled
push str.admin
lea ecx, [esp + 0x140]
mov dword [esp + 0x2c], eax
call fcn.00405d10
push ebx
push str.LockSetting
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.LocalInputsDisabled
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x20]
push edx
push str.EnableJapInput
push str.admin
lea ecx, [esp + 0x140]
call fcn.00405d10
push 0
push str.TurboMode
push str.poll
lea ecx, [esp + 0x3c]
call fcn.00405d70
push 0
push str.PollUnderCursor
push str.poll
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00405d70
push 0
push str.PollForeground
push str.poll
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.00405d70
push 0
push str.PollFullScreen
push str.poll
lea ecx, [esp + 0x3c]
mov ebp, eax
call fcn.00405d70
push 0
push str.OnlyPollConsole
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], eax
call fcn.00405d70
push 0
push str.OnlyPollOnEvent
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.00405d70
push 0
push str.EnableDriver
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x20], eax
call fcn.00405d70
push 0
push str.EnableHook
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x28], eax
call fcn.00405d70
push 0
push str.EnableVirtual
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], eax
call fcn.00405d70
push 0
push str.SingleWindow
push str.poll
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], eax
call fcn.00405d70
push 0x20
mov dword [esp + 0x28], eax
lea eax, [esp + 0x244]
push eax
push str.SingleWindowName
push str.poll
lea ecx, [esp + 0x40]
call fcn.00405d90
push edi
push str.TurboMode
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebx
push str.PollUnderCursor
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
push ebp
push str.PollForeground
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x20]
push ecx
push str.PollFullScreen
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x18]
push edx
push str.OnlyPollConsole
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov eax, dword [esp + 0x14]
push eax
push str.OnlyPollOnEvent
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x1c]
push ecx
push str.EnableDriver
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov edx, dword [esp + 0x28]
push edx
push str.EnableHook
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov eax, dword [esp + 0x2c]
push eax
push str.EnableVirtual
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
mov ecx, dword [esp + 0x24]
push ecx
push str.SingleWindow
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405d10
lea edx, [esp + 0x240]
push edx
push str.SingleWindowName
push str.poll
lea ecx, [esp + 0x140]
call fcn.00405cf0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x134]
mov byte [esp + 0x4ec], 0
call fcn.00437380
lea ecx, [esp + 0x30]
mov dword [esp + 0x4ec], 0xffffffff
call fcn.00437380
mov ecx, dword [esp + 0x4e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4cc]
xor ecx, esp
call fcn.0045c20d
add esp, 0x4dc
ret
jmp 0x403a10