Function at 0x40c820
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov eax, 0x2098
call fcn.0041a2f0
sub esp, eax
mov eax, dword [esp + 0x20a0]
mov dword [esp + 0x50], sym.___gxx_personality_sj0
mov dword [esp + 0x54], 0x4f142c
mov word [esp + 0x6c], ax
lea eax, [esp + 0x2090]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x5c], 0x40d02a
mov dword [esp + 0x60], esp
call dbg._Unwind_SjLj_Register
cmp word [esp + 0x6c], 0
jne 0x40c890
lea eax, [esp + 0x38]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
add esp, 0x2098
pop ebp
ret
lea eax, [esp + 0x1090]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 4], eax
lea eax, [esp + 0x20c8]
mov dword [esp], eax
call sym.GetProcessPath_char__char_
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x90]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x90]
mov dword [esp + 0x3c], 1
mov dword [esp], eax
call sym.WhiteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov byte [esp + 0x34], al
mov eax, dword [esp + 0x90]
lea edx, [esp + 0x98]
cmp eax, edx
je 0x40c900
mov dword [esp], eax
call sym.operator_delete_void_
cmp byte [esp + 0x34], 0
jne 0x40c874
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 2
mov dword [esp + 4], eax
lea eax, [esp + 0x90]
mov dword [esp], eax
call sym.calculate_file_sha256_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [esp + 0x20ac]
mov dword [esp + 0x28], str._nStart_process_the_virus_process...
mov dword [esp + 0x24], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1090]
mov dword [esp + 0x20], str._nProcess_id:
mov dword [esp + 0x18], str._nProcess_hash_code_SHA_256_:
mov dword [esp + 0x14], method.std.dec_std::ios_base_
mov dword [esp + 0xc], method.std.hex_std::ios_base_
mov dword [esp + 8], str._nRisk_level_code:
mov dword [esp + 4], eax
mov dword [esp], str.Detected_suspicious_program__nProgram_path:
mov dword [esp + 0x3c], 3
call sym.__Z3logIA44_cJA4096_cA19_cFRSt8ios_baseS4_EtS5_A30_cNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEA14_cmA36_cEEvRKT_DpRK
mov eax, dword [esp + 0x90]
lea edx, [esp + 0x98]
cmp eax, edx
je 0x40c9cf
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x80]
cmp eax, edx
je 0x40c9e6
mov dword [esp], eax
call sym.operator_delete_void_
movzx eax, word [esp + 0x6c]
cmp ax, 5
ja 0x40ca90
cmp ax, 2
ja 0x40cd38
test ax, ax
jne 0x40cc50
lea eax, [esp + 0x90]
mov dword [esp + 0xc], 0x1033
mov dword [esp + 8], 0x4f6c51
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
cmp eax, 6
je 0x40cc80
cmp eax, 7
je 0x40cd90
cmp eax, 2
jne 0x40c874
movzx eax, word [esp + 0x6c]
sub eax, 3
cmp ax, 2
ja 0x40c874
mov eax, dword [esp + 0x20ac]
mov dword [esp + 4], 0
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call sym.PauseProcess_unsigned_long__bool_
jmp 0x40c874
lea eax, [esp + 0x20c8]
lea ecx, [esp + 0x90]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x90]
mov dword [esp + 0x3c], 4
mov dword [esp], eax
call sym.KillProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov byte [esp + 0x34], al
mov eax, dword [esp + 0x90]
lea edx, [esp + 0x98]
cmp eax, edx
je 0x40cae6
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x40
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x90]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x90]
mov dword [esp + 0x3c], 5
mov dword [esp], eax
call sym.IsolateFile_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [esp + 0x90]
lea edx, [esp + 0x98]
cmp eax, edx
je 0x40cb48
mov dword [esp], eax
call sym.operator_delete_void_
movzx eax, word [esp + 0x6c]
mov dword [esp + 4], 0x4f6810
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1090]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp], eax
call sym.sprintf_char__char_const__..._
cmp byte [esp + 0x34], 0
jne 0x40ca08
movzx eax, word [esp + 0x6c]
cmp ax, 5
ja 0x40cdf0
cmp ax, 2
jbe 0x40c874
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1090]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], 0x4f6c58
mov dword [esp], eax
call sym.sprintf_char__char_const__..._
lea eax, [esp + 0x90]
mov dword [esp + 0xc], 0x1013
mov dword [esp + 8], 0x4f6c51
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
cmp eax, 6
je 0x40d018
cmp eax, 7
jne 0x40c874
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 7
mov dword [esp], eax
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea esi, [esi]
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x80]
cmp eax, edx
je 0x40c874
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x40c874
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1090]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], 0x4f6a5c
mov dword [esp], eax
call sym.sprintf_char__char_const__..._
jmp 0x40ca08
movzx eax, word [esp + 0x6c]
cmp ax, 5
ja 0x40ce98
cmp ax, 2
ja 0x40ceaa
test ax, ax
je 0x40c874
lea eax, [esp + 0x20c8]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xa
mov dword [esp], eax
call sym.KillProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x80]
cmp eax, edx
je 0x40cceb
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x40
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xb
mov dword [esp], eax
call sym.IsolateFile_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
mov eax, dword [esp + 0x20ac]
mov dword [esp + 4], 1
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call sym.PauseProcess_unsigned_long__bool_
mov dword [esp + 4], 0x4f6934
mov byte [esp + 0x34], al
movzx eax, word [esp + 0x6c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1090]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp], eax
call sym.sprintf_char__char_const__..._
jmp 0x40cb73
movzx eax, word [esp + 0x6c]
cmp ax, 5
ja 0x40cf3a
cmp ax, 2
ja 0x40cfca
test ax, ax
je 0x40c874
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xf
mov dword [esp], eax
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1090]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], 0x4f6b54
mov dword [esp], eax
call sym.sprintf_char__char_const__..._
lea eax, [esp + 0x90]
mov dword [esp + 0xc], 0x1013
mov dword [esp + 8], 0x4f6c51
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
cmp eax, 6
je 0x40d018
cmp eax, 7
jne 0x40c874
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 6
mov dword [esp], eax
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
mov eax, dword [0x50a040]
mov dword [esp], eax
call sym._remove
jmp 0x40c874
lea eax, [esp + 0x20c8]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 8
mov dword [esp], eax
call sym.KillProcess_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x80]
cmp eax, edx
je 0x40cef3
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x40
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 9
mov dword [esp], eax
call sym.IsolateFile_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xc
mov dword [esp], eax
call sym.ReleaseFile_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x80]
cmp eax, edx
je 0x40cf83
mov dword [esp], eax
call sym.operator_delete_void_
mov dword [esp], 0x64
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xd
mov dword [esp], eax
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
mov eax, dword [esp + 0x20ac]
mov dword [esp + 4], 0
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp], eax
call sym.PauseProcess_unsigned_long__bool_
lea eax, [esp + 0x1090]
lea ecx, [esp + 0x78]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [esp + 0x78]
mov dword [esp + 0x3c], 0xe
mov dword [esp], eax
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x40cc30
mov dword [esp + 0x3c], 0xffffffff
call sym.ShutdownSystem__
jmp 0x40c874