Function at 0x42eda0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b30
call fcn.00520130
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor al, al
push edi
mov dword [ebp - 0x1b24], ecx
mov dword [ebp - 0x1b2c], esi
mov dword [ebp - 0x1b28], ebx
mov byte [ebp - 0x1b1d], al
test esi, esi
je 0x42f266
cmp word [esi], 0
je 0x42f266
test ebx, ebx
je 0x42f266
mov eax, esi
call fcn.0042f560
mov edi, eax
cmp edi, 0x550
je 0x42ee28
cmp edi, 0x560
je 0x42ee28
cmp edi, 0x570
je 0x42ee28
cmp edi, 0x574
je 0x42ee28
cmp edi, 0x578
jne 0x42f280
mov eax, esi
mov esi, dword [ebp - 0x1b24]
call fcn.00440da0
test al, al
je 0x42f280
cmp edi, 0x550
jne 0x42eebe
mov ecx, edi
lea eax, [ebp - 0x1b1c]
lea ecx, [ecx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42ee50
mov edi, dword [ebp - 0x1b24]
mov esi, 0x550
lea edx, [ebp - 0x1b1c]
call fcn.00440e20
cmp eax, esi
jne 0x42f21e
mov ax, word [ebp - 0x1afc]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1b18]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x1af8]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov word [ebx + 0x20], ax
test edi, edi
je 0x42f217
lea ebx, [ebp - 0x19e4]
call fcn.0042f5d0
jmp 0x42f217
cmp edi, 0x560
jne 0x42ef64
mov ecx, edi
lea eax, [ebp - 0x15cc]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42eed2
mov edi, dword [ebp - 0x1b24]
mov esi, 0x560
lea edx, [ebp - 0x15cc]
call fcn.00440e20
cmp eax, esi
jne 0x42f21e
mov edx, dword [ebp - 0x15a8]
mov eax, dword [ebp - 0x15a4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x15c8]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x15ac]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x15a0]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x159c]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x1598]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov dword [ebx + 0x30], edx
test edi, edi
je 0x42f217
lea ebx, [ebp - 0x1484]
call fcn.0042f5d0
jmp 0x42f217
cmp edi, 0x570
jne 0x42f047
mov ecx, edi
lea eax, [ebp - 0x106c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42ef78
mov edi, dword [ebp - 0x1b24]
mov esi, 0x570
lea edx, [ebp - 0x106c]
call fcn.00440e20
cmp eax, esi
jne 0x42f21e
mov ax, word [ebp - 0x104c]
mov edx, dword [ebp - 0x1044]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x1068]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1048]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x103c]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x1040]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x1038]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
test edi, edi
je 0x42f007
lea ebx, [ebp - 0xf24]
call fcn.0042f5d0
mov ebx, dword [ebp - 0x1b28]
lea ecx, [ebx + 0xd88]
test ecx, ecx
je 0x42f01c
lea eax, [ebp - 0xb0c]
call fcn.0042f730
add ebx, 0xd98
je 0x42f217
mov dl, byte [ebp - 0xaff]
mov al, byte [ebp - 0xb00]
mov cl, byte [ebp - 0xafe]
mov byte [ebx + 1], dl
mov byte [ebx], al
mov byte [ebx + 2], cl
jmp 0x42f217
cmp edi, 0x574
jne 0x42f129
mov ecx, edi
lea eax, [ebp - 0x584]
jmp 0x42f060
mov byte [eax], 0
inc eax
dec ecx
jne 0x42f060
mov edi, dword [ebp - 0x1b24]
mov esi, 0x574
lea edx, [ebp - 0x584]
call fcn.00440e20
cmp eax, esi
jne 0x42f21e
mov eax, dword [ebp - 0x560]
mov dx, word [ebp - 0x564]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x580]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x55c]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x554]
mov dword [ebx + 0x28], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0x550]
mov word [ebx + 0x20], dx
mov edx, dword [ebp - 0x558]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
test edi, edi
je 0x42f0ef
lea ebx, [ebp - 0x43c]
call fcn.0042f680
mov ebx, dword [ebp - 0x1b28]
add ebx, 0xd98
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebx - 0x10], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebx - 0xc], edx
mov dword [ebx - 8], eax
mov dword [ebx - 4], ecx
je 0x42f217
mov dl, byte [ebp - 0x13]
mov al, byte [ebp - 0x14]
mov cl, byte [ebp - 0x12]
mov byte [ebx + 1], dl
mov byte [ebx], al
mov byte [ebx + 2], cl
jmp 0x42f217
cmp edi, 0x578
jne 0x42f21e
mov ecx, edi
lea eax, [ebp - 0xafc]
lea ecx, [ecx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x42f140
mov edi, dword [ebp - 0x1b24]
mov esi, 0x578
lea edx, [ebp - 0xafc]
call fcn.00440e20
cmp eax, esi
jne 0x42f21e
mov eax, dword [ebp - 0xad8]
mov dx, word [ebp - 0xadc]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0xaf8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xad4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xacc]
mov dword [ebx + 0x28], ecx
lea edi, [ebx + 0x34]
mov ecx, 0x45
lea esi, [ebp - 0xac8]
mov word [ebx + 0x20], dx
mov edx, dword [ebp - 0xad0]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x148]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
test edi, edi
je 0x42f1cf
lea ebx, [ebp - 0x9b4]
call fcn.0042f680
mov ebx, dword [ebp - 0x1b28]
mov ecx, dword [ebp - 0x59c]
mov edx, dword [ebp - 0x598]
mov eax, dword [ebp - 0x594]
mov dword [ebx + 0xd88], ecx
mov ecx, dword [ebp - 0x590]
mov dword [ebx + 0xd8c], edx
mov edx, dword [ebp - 0x58c]
mov dword [ebx + 0xd90], eax
mov eax, dword [ebp - 0x588]
mov dword [ebx + 0xd94], ecx
mov dword [ebx + 0xd98], edx
mov dword [ebx + 0xd9c], eax
mov byte [ebp - 0x1b1d], 1
mov esi, dword [ebp - 0x1b24]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x42f23a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov bl, byte [ebp - 0x1b1d]
test bl, bl
je 0x42f251
mov ecx, dword [ebp - 0x1b2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x1b1d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513498
mov esp, ebp
pop ebp
ret 4