Function at 0x4167e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x416bf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x416bc9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x418418]
sub eax, 1
jb 0x416827
je 0x416955
dec eax
je 0x4169bd
jmp 0x416b58
mov byte [0x419a58], 0
cmp dword [0x41841c], 0
jne 0x416b58
call fcn.0040bf7c
mov dword [0x41841c], eax
cmp dword [0x41841c], 0
je 0x416b58
call fcn.00416620
mov eax, dword [0x41841c]
mov eax, dword [eax + 0x374]
mov dword [0x419a68], eax
xor eax, eax
mov dword [0x419ae0], eax
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
push 0x416c10
call fcn.00414f68
mov al, 1
xor edx, edx
mov dword [0x419ae0], edx
test al, al
jne 0x4168a4
push 0x416c24
call fcn.00414f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416bdd
mov byte [0x419a58], 0
mov dword [0x418418], 1
mov eax, dword [0x41841c]
mov eax, dword [eax + 0x378]
mov dword [0x419a5c], eax
mov eax, dword [0x41841c]
mov eax, dword [eax + 0x37c]
mov dword [0x419a60], eax
call fcn.004130e8
push dword [0x419a64]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00406bb4
push dword [ebp - 0xc]
push 0x416c3c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403d5c
mov eax, dword [ebp - 8]
call fcn.00403e9c
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x10]
mov ecx, 0x416c4c
mov edx, dword [0x419a64]
call fcn.00403ce8
mov eax, dword [ebp - 0x10]
call fcn.00403e9c
push eax
call sub.kernel32.dll_DeleteFileA
push 0x416578
push 0xa
push 0x14
mov eax, dword [0x419a50]
push eax
call sub.user32.dll_SetTimer
push 0x416c60
call fcn.00414f68
jmp 0x416b58
cmp dword [0x418420], 0x82
jle 0x4169b2
mov dword [0x418418], 2
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
mov al, byte [edx + eax*8 + 0xb]
mov byte [0x419adc], al
cmp byte [0x419adc], 0
je 0x416996
push 0x416c78
call fcn.00414f68
jmp 0x4169a0
push 0x416c90
call fcn.00414f68
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
mov byte [edx + eax*8 + 9], 1
inc dword [0x418420]
jmp 0x416b58
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
cmp byte [edx + eax*8 + 9], 0
je 0x416ae9
mov edx, dword [0x41841c]
mov byte [edx + eax*8 + 9], 0
cmp byte [0x419a58], 0
je 0x4169f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416bdd
call fcn.004165a0
call fcn.00415fd0
call fcn.00415bb0
mov dl, 1
mov eax, dword [0x40f7c4]
call fcn.00402e70
mov dword [0x419ac8], eax
mov dl, 1
mov eax, dword [0x40f7c4]
call fcn.00402e70
mov dword [0x419acc], eax
call fcn.00416710
lea eax, [ebp - 4]
mov ecx, dword [0x419ae4]
mov edx, dword [0x419a64]
call fcn.00403ce8
lea eax, [ebp - 0x18]
call fcn.004146e4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x416ca8
call fcn.00403ce8
mov eax, dword [ebp - 0x14]
push eax
call fcn.00414f68
mov eax, dword [ebp - 4]
call fcn.00406fe0
test al, al
je 0x416a7a
mov edx, dword [ebp - 4]
mov eax, dword [0x419acc]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
mov dword [0x419a4c], eax
xor eax, eax
mov dword [0x419ae8], eax
xor eax, eax
mov dword [0x41842c], eax
mov dword [0x419a48], 1
xor eax, eax
mov dword [0x418430], eax
xor eax, eax
mov dword [0x419b10], eax
call sub.kernel32.dll_GetTickCount
mov dword [0x418428], eax
mov byte [0x419aec], 1
cmp byte [0x419adc], 0
jne 0x416add
lea eax, [ebp - 0x1c]
mov ecx, dword [0x419ae4]
mov edx, 0x416cbc
call fcn.00403ce8
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00414f68
call fcn.00412ad8
mov byte [0x419a58], 1
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
cmp byte [edx + eax*8 + 0xa], 0
je 0x416b58
mov edx, dword [0x41841c]
mov byte [edx + eax*8 + 0xa], 0
cmp byte [0x419a58], 0
jne 0x416b1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416bdd
mov byte [0x419a58], 0
call fcn.00412cf4
cmp dword [0x419ac8], 0
je 0x416b3d
mov eax, dword [0x419ac8]
call fcn.00402ea0
cmp dword [0x419acc], 0
je 0x416b50
mov eax, dword [0x419acc]
call fcn.00402ea0
mov eax, dword [0x418560]
mov byte [eax], 0
call fcn.004145e8
cmp dword [0x41841c], 0
je 0x416bbf
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
cmp byte [edx + eax*8 + 8], 0
je 0x416b85
mov edx, dword [0x41841c]
mov byte [edx + eax*8 + 8], 0
imul eax, dword [0x419ae0], 0x16
mov edx, dword [0x41841c]
cmp byte [edx + eax*8 + 0x28], 0
je 0x416bbf
mov edx, dword [0x41841c]
mov byte [edx + eax*8 + 0x28], 0
mov eax, dword [0x418514]
mov byte [eax], 0
mov eax, dword [0x4184f0]
mov dword [eax], 1
mov eax, dword [0x418560]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416bdd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416bff
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403a00
ret