Function at 0x431afc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x431b04
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x431d97
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00431da4
mov edx, esi
mov eax, dword [0x4d2124]
call fcn.00430294
test al, al
je 0x431b44
lea eax, [ebx + 8]
mov edx, esi
call fcn.004052d4
jmp 0x431b59
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040a560
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.004052d4
lea eax, [ebx + 0x72]
xor ecx, ecx
mov edx, 0xc
call fcn.00403a38
lea eax, [ebx + 0x7e]
xor ecx, ecx
mov edx, 0x324
call fcn.00403a38
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x431b87
mov dword [ebx + 0x7e], 0x7fffffff
jmp 0x431b8a
mov dword [ebx + 0x7e], eax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x431b9d
mov dword [ebx + 0x82], 0x7fffffff
jmp 0x431ba3
mov dword [ebx + 0x82], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x86], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x8a], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x8e], eax
mov dword [ebx + 0x96], 1
movzx eax, word [ebx + 0x28]
mov word [ebx + 0x9e], ax
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x96]
mov eax, ebx
call fcn.0043174c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xa0]
call fcn.0040a7a8
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.0040a4e0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x1a0]
call fcn.0040a7a8
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 8]
call fcn.0040a3a0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x2a0]
call fcn.0040a7a8
mov byte [ebp - 1], 0
cmp word [ebx + 0x42], 0
je 0x431c49
push 0
lea eax, [ebp - 1]
push eax
lea ecx, [ebx + 0x7e]
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebp - 1], 0
jne 0x431d6f
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
cmp dword [ebp - 0x18], 0
je 0x431ca9
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040e69c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x2a0]
call fcn.0040a7a8
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
mov eax, dword [ebp - 0x24]
call fcn.0040a03c
lea eax, [ebp - 0x34]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea edx, [ebx + 0x1a0]
mov ecx, pe_nt_image_headers32
call fcn.004054f0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov edx, 1
call fcn.004307e8
mov eax, dword [ebp - 0x28]
call fcn.00405710
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [ebx + 0x3a2], eax
xor eax, eax
mov dword [ebx + 0x3a6], eax
xor eax, eax
mov dword [ebx + 0x3aa], eax
push ebx
lea eax, [ebx + 0x7e]
push eax
mov eax, 0x431000
push eax
mov eax, 0x430fd4
push eax
mov eax, 0x430fbc
push eax
mov eax, 0x430fac
push eax
mov eax, 0x430f94
push eax
mov eax, 0x430f7c
push eax
mov eax, 0x430f64
push eax
mov eax, 0x430f54
push eax
mov eax, 0x430f44
push eax
mov eax, 0x431010
push eax
lea eax, [ebx + 0x72]
push eax
call fcn.00427998
add esp, 0x34
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
setne dl
mov eax, ebx
call fcn.00431598
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431d9e
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004052a4
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.004052a4
ret