Function at 0x402b70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
call fcn.004097f0
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x402b95
mov dword [0x611db8], 0x10000
jmp 0x402bb3
cmp dword [ebx], 1
je 0x402ba6
mov dword [0x611db8], 0x80000
jmp 0x402bb3
mov esi, dword [ebx + 4]
call fcn.00408e50
mov dword [0x611db8], eax
xor eax, eax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], al
mov dword [ebp - 0x10], edi
cmp ebx, edi
jne 0x402bd4
mov dword [0x611db8], 0x10000
jmp 0x402c42
cmp dword [ebx], 1
je 0x402be5
mov dword [0x611db8], 0x80000
jmp 0x402c42
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x402bf9
mov ecx, 0x10000
jmp 0x402c3c
cmp dword [esi + 4], edx
je 0x402c0a
mov edi, ecx
call fcn.00408cc0
or edx, 0xffffffff
xor edi, edi
mov eax, dword [esi]
mov dword [esi + 4], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov dword [0x611db8], ecx
xor esi, esi
mov dword [ebp - 4], eax
cmp eax, edi
jle 0x402cc3
jmp 0x402c50
mov dword [ebp - 0x138], edi
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], edi
cmp ebx, edi
je 0x402c9c
cmp dword [ebx], 1
je 0x402c84
mov dword [0x611db8], 0x80000
cmp dword [ebx], 1
je 0x402ca8
mov dword [0x611db8], 0x80000
jmp 0x402cbd
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x138]
push ecx
push esi
push eax
call fcn.00408eb0
mov dword [0x611db8], eax
jmp 0x402c73
mov dword [0x611db8], 0x10000
jmp 0x402cbd
mov eax, dword [ebx + 4]
lea edx, [ebp - 0x134]
push edx
push esi
call fcn.00409510
mov dword [0x611db8], eax
inc esi
cmp esi, dword [ebp - 4]
jl 0x402c50
cmp ebx, edi
jne 0x402cd6
mov dword [0x611db8], 0x10000
jmp 0x402d9c
cmp dword [ebx], 1
je 0x402cea
mov dword [0x611db8], 0x80000
jmp 0x402d9c
mov esi, dword [ebx + 4]
cmp dword [esi + 4], 0xffffffff
je 0x402cfa
mov edi, dword [esi]
call fcn.00408cc0
mov edi, dword [esi]
mov dword [esi + 4], 0xffffffff
test edi, edi
je 0x402d40
cmp dword [edi + 0x7c], 0
je 0x402d12
call fcn.00408cc0
mov eax, dword [edi]
mov dword [ebp - 4], eax
test eax, eax
je 0x402d37
cmp byte [eax + 0x10], 0
je 0x402d2e
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call fcn.0040990e
add esp, 4
push edi
call fcn.004fc6d5
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x138]
mov dword [0x611db8], 0
test eax, eax
je 0x402d63
push eax
call fcn.0040990e
add esp, 4
mov eax, dword [esi + 0x13c]
mov dword [esi + 0x138], 0
test eax, eax
je 0x402d80
push eax
call fcn.0040990e
add esp, 4
push esi
mov dword [esi + 0x13c], 0
call fcn.0040990e
add esp, 4
push ebx
call fcn.0040990e
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:Program_Files__x86_Windows_Systemcvsd.xml
call esi
push str.C:Program_Files__x86_Windows_Systemdecvsd.xml
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret