Function at 0x410c64
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push dword [ebp + 8]
call fcn.004012e8
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410c97
pop ebx
leave
ret 8
push 8
push str.BINSTR00SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 8]
push eax
call fcn.0040195d
and eax, eax
jne 0x410cb0
pop ebx
leave
ret 8
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
je 0x410cce
cmp dword [ebp - 0x10], 0
je 0x410cd3
pop ebx
leave
ret 8
jmp 0x410f9f
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040137a
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410d07
jmp 0x410fa9
test dword [ebp - 0x18], 1
setne al
movzx eax, al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x14], 0
je 0x410d22
jmp 0x410fa9
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410d3f
jmp 0x410fa9
push dword [ebp - 0x50]
push dword [ebp + 8]
call fcn.004010d6
and eax, eax
jne 0x410d53
jmp 0x410fa9
push dword [ebp - 0x50]
call fcn.0040190d
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410d83
push dword [ebp - 0x4c]
call fcn.004018f6
jmp 0x410fa9
push dword [ebp - 0x4c]
call fcn.004018f6
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
je 0x410db5
cmp dword [ebp - 0x1c], 1
je 0x410dba
cmp dword [ebp - 0x1c], 0
je 0x410dba
cmp dword [ebp - 0x1c], 2
je 0x410dba
jmp 0x410fa9
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410dd7
jmp 0x410fa9
push dword [ebp - 0x24]
push dword [ebp + 8]
call fcn.004010d6
and eax, eax
jne 0x410deb
jmp 0x410fa9
cmp dword [ebp - 0x24], 0
jne 0x410df6
jmp 0x410f9f
push dword [ebp - 0x24]
call fcn.0040190d
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0040137a
cmp dword [ebp - 0xc], 0
jne 0x410e26
push dword [ebp - 0x20]
call fcn.004018f6
jmp 0x410fa9
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.004024d7
cmp dword [ebp - 0x38], 0
je 0x410e46
lea eax, [ebp - 0x34]
push eax
call fcn.00410c22
jmp 0x410e48
sub eax, eax
cmp dword [ebp - 0xc], 0
je 0x410f97
and eax, eax
jne 0x410e76
cmp dword [ebp - 0x1c], 1
jne 0x410e76
push dword [ebp - 0x20]
call fcn.00414677
and eax, eax
je 0x410e71
lea eax, [ebp - 0x34]
push eax
call fcn.00410be3
jmp 0x410f97
and eax, eax
jne 0x410ef4
cmp dword [ebp - 0x1c], 0
jne 0x410ef4
call fcn.00410b2d
and eax, eax
je 0x410eef
mov dword [ebp - 0x3c], eax
sub ebx, ebx
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x40], eax
inc eax
je 0x410ec3
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp - 0x40]
call fcn.00401460
mov ebx, eax
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_CloseHandle
and ebx, ebx
jne 0x410ecf
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_DeleteFileA
and ebx, ebx
je 0x410ee7
push dword [ebp + 0xc]
push dword [ebp - 0x3c]
call fcn.00402ee4
lea eax, [ebp - 0x34]
push eax
call fcn.00410be3
push dword [ebp - 0x3c]
call fcn.004018f6
jmp 0x410f97
cmp dword [ebp - 0x1c], 2
jne 0x410f97
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
call fcn.00404168
and eax, eax
je 0x410f97
cmp dword [ebp - 0x44], 0
je 0x410f97
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x44]
call fcn.004017c6
cmp dword [ebp - 0x38], 0
je 0x410f35
lea eax, [ebp - 0x34]
push eax
call fcn.00410c22
jmp 0x410f37
sub eax, eax
and eax, eax
jne 0x410f8f
push dword [ebp - 0x44]
call fcn.004012e8
mov dword [ebp - 0x48], 0
push 2
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x44]
call fcn.0040114c
call fcn.00410b2d
and eax, eax
je 0x410f8f
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x44]
call fcn.004014a1
and eax, eax
je 0x410f87
push dword [ebp + 0xc]
push dword [ebp - 0x3c]
call fcn.00402ee4
lea eax, [ebp - 0x34]
push eax
call fcn.00410be3
push dword [ebp - 0x3c]
call fcn.004018f6
push dword [ebp - 0x44]
call fcn.00401026
push dword [ebp - 0x20]
call fcn.004018f6
cmp dword [ebp - 0xc], 0
jne 0x410cd8
pop ebx
leave
ret 8