Function at 0x401000
Capabilities:
Delete file
Terminate process

Disassembly:
push 0x3000
push 0x400000
call dword [sym.imp.KERNEL32.dll_VirtualLock]
call fcn.00403a13
push 0x50000
call fcn.00401a6a
test eax, eax
jne 0x40102b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, eax
mov ebp, edi
add edi, 0x1000
push 0x1000
push 0x402a13
push ebp
call fcn.004018db
xor ebx, ebx
mov eax, 0x6f
xor byte [ebp + ebx], al
cmp byte [ebp + ebx], 9
je 0x401065
add eax, 0x93
inc ebx
cmp ebx, 0x1000
jl 0x40104c
mov ebx, edi
add ebx, 0x400
mov dword [0x4042d7], ebx
add ebx, 0x80
mov dword [0x4042db], ebx
add ebx, 0x80
mov dword [0x4042df], ebx
add ebx, 0x80
mov dword [0x4042e3], ebx
add ebx, 0x80
mov dword [0x4042eb], ebx
add ebx, 0x80
mov dword [0x4042ef], ebx
add ebx, 0x80
mov dword [0x4042f3], ebx
add ebx, 0x80
mov dword [0x4042f7], ebx
xor ebx, ebx
mov al, byte [ebp + ebx]
cmp al, 1
jne 0x4010e2
push ebp
push ebx
push dword [0x4042d7]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 2
jne 0x4010f7
push ebp
push ebx
push dword [0x4042db]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 3
jne 0x40110c
push ebp
push ebx
push dword [0x4042df]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 4
jne 0x401121
push ebp
push ebx
push dword [0x4042e3]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 5
jne 0x401179
push ebx
call fcn.00401642
test eax, eax
jne 0x401173
mov ebx, edi
add ebx, 0x20400
push dword [0x4042df]
push dword [0x4042db]
push dword [0x4042d7]
push 0x1fc00
push ebx
call fcn.004021ff
pop ebx
test eax, eax
jne 0x4013c1
cmp dword [0x4042fb], 0xf4240
jl 0x40116e
call fcn.004016c7
jmp 0x4012d4
pop ebx
jmp 0x4012d4
cmp al, 6
jne 0x401191
push ebx
push dword [ebp + ebx + 1]
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebx
add ebx, 4
jmp 0x4012d4
cmp al, 7
jne 0x4011a7
mov edx, dword [ebp + ebx + 1]
mov dword [0x4042e7], edx
add ebx, 4
jmp 0x4012d4
cmp al, 8
jne 0x401202
mov edx, dword [ebp + ebx + 1]
mov ecx, dword [ebp + ebx + 5]
add edx, edi
add edx, 0x400
push ebx
push edx
push ecx
push 0x200
push edi
call fcn.00401a38
push 0x401773
push edi
call fcn.00401996
pop ecx
pop edx
push 0
push 0
push ecx
push edx
push edi
call fcn.00401a82
push 0x1b7740
push 0
push edi
call fcn.00401b18
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
add ebx, 8
jmp 0x4012d4
cmp al, 0xa
jne 0x401222
mov edx, dword [ebp + ebx + 1]
mov dword [0x4042fb], edx
mov edx, dword [ebp + ebx + 5]
mov dword [0x4042ff], edx
add ebx, 8
jmp 0x4012d4
cmp al, 0x14
jne 0x40123a
push ebp
push ebx
push dword [0x4042ef]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 0x15
jne 0x401252
push ebp
push ebx
push dword [0x4042f3]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
cmp al, 0x16
jne 0x40128f
push ebx
call fcn.00401642
test eax, eax
jne 0x40128c
mov ebx, edi
add ebx, 0x20400
push dword [0x4042df]
push dword [0x4042db]
push dword [0x4042d7]
push 0x1fc00
push ebx
call fcn.004021ff
pop ebx
test eax, eax
jne 0x4012e9
jmp 0x4012d4
pop ebx
jmp 0x4012d4
cmp al, 0x17
jne 0x4012b4
push ebp
push ebx
push dword [0x4042eb]
call fcn.004015bd
mov ebx, eax
push ebx
push dword [0x4042eb]
call fcn.00401487
pop ebx
jmp 0x4010c9
cmp al, 0x18
jne 0x4012cc
push ebp
push ebx
push dword [0x4042f7]
call fcn.004015bd
mov ebx, eax
jmp 0x4010c9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
inc ebx
cmp ebx, 0x1000
jl 0x4010c9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call fcn.004016c7
mov esi, edi
add esi, 0x800
push 0x40177f
push esi
call fcn.0040191a
push dword [0x4042ef]
push esi
call fcn.00401996
push 0x401845
push esi
call fcn.00401996
push dword [0x4042f3]
push esi
call fcn.00401996
push 0x401863
push esi
call fcn.00401996
push dword [0x4042e3]
push esi
call fcn.00401996
push 0x401887
push esi
call fcn.00401996
push dword [0x4042e3]
push esi
call fcn.00401996
push 0x40188a
push esi
call fcn.00401996
push esi
call fcn.00401487
push dword [0x4042f7]
push esi
call fcn.0040191a
cmp byte [esi], 0
je 0x4013b6
push 0x4018d9
push esi
call fcn.00401996
push dword [0x4042d7]
push esi
call fcn.00401996
push 0x4018d9
push esi
call fcn.00401996
push dword [0x4042db]
push esi
call fcn.00401996
mov eax, edi
add eax, 0x1000
push 0x200
push eax
push esi
call fcn.00401c07
call fcn.00401438
pop ebx
jmp 0x4012d4
call fcn.004016c7
push dword [0x4042e3]
call fcn.00401487
mov esi, edi
add esi, 0x800
push dword [0x4042f7]
push esi
call fcn.0040191a
cmp byte [esi], 0
je 0x40142b
push 0x4018d9
push esi
call fcn.00401996
push dword [0x4042d7]
push esi
call fcn.00401996
push 0x4018d9
push esi
call fcn.00401996
push dword [0x4042db]
push esi
call fcn.00401996
mov eax, edi
add eax, 0x1000
push 0x200
push eax
push esi
call fcn.00401c07
call fcn.00401438
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]