Function at 0x4041b0
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bfbe
mov eax, dword fs:[0]
push eax
mov eax, 0x1ac0
call fcn.0041b920
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push edi
push edi
push edi
push 0x4036aa
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00403a90
push 0x9b0
lea eax, [ebp - 0x1acc]
push edi
push eax
call fcn.00406f80
add esp, 0xc
lea ecx, [ebp - 0x1acc]
call fcn.00402ac4
sub esp, 0x18
mov dword [ebp - 4], edi
mov ecx, esp
push str.946BF47DD6895BA1EC92523D60021DB669C89AB6B59B70ACBB821534618525ED
call fcn.0040307c
lea ecx, [ebp - 0x1acc]
call fcn.0040269b
push 0xff
lea eax, [ebp - 0x110]
mov dword [ebp - 0x1ac8], 6
push edi
push eax
mov dword [ebp - 0x1ac4], edi
mov dword [ebp - 0x1ac0], edi
call fcn.00406f80
push 2
push edi
xor ebx, ebx
lea eax, [ebp - 0x110]
inc ebx
mov esi, str._d._d._d
push ebx
push esi
push eax
call fcn.004025fe
lea eax, [ebp - 0x10e4]
mov dword [ebp - 0x10ec], edi
push eax
lea eax, [ebp - 0x10e8]
mov dword [ebp - 0x10e8], edi
push eax
lea eax, [ebp - 0x10ec]
mov dword [ebp - 0x10e4], edi
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00402631
add esp, 0x34
cmp eax, 3
jne 0x4042d7
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x1abc], eax
mov eax, dword [ebp - 0x10e8]
mov dword [ebp - 0x1ab8], eax
mov eax, dword [ebp - 0x10e4]
mov dword [ebp - 0x1ab4], eax
mov esi, 0xfd0
lea eax, [ebp - 0x10e0]
push esi
push edi
push eax
call fcn.00406f80
add esp, 0xc
mov dword [ebp - 0x10e4], 0x4e91
lea eax, [ebp - 0x10e0]
push esi
push eax
sub esp, 0x18
lea eax, [ebp - 0x1134]
mov ecx, esp
lea esi, [ebp - 0x10e4]
push eax
call fcn.00401dd8
push 4
pop edx
mov ecx, esi
call fcn.00402a40
add esp, 0x20
or esi, 0xffffffff
test eax, eax
jle 0x40434a
lea eax, [ebp - 0x10e0]
push eax
call fcn.0040fd44
pop ecx
test eax, eax
jle 0x404350
lea eax, [ebp - 0x10e0]
push eax
call fcn.0040fd44
pop ecx
jmp 0x40434c
mov eax, esi
test eax, eax
jg 0x404390
lea ecx, [ebp - 0x1acc]
call fcn.00402c5a
mov esi, 0x5357b8
mov ecx, esi
call fcn.004033e8
mov ecx, esi
call fcn.00403319
push ecx
push ecx
call fcn.0040390d
pop ecx
pop ecx
test eax, eax
js 0x404389
call fcn.0040407d
test eax, eax
js 0x404389
call fcn.00403498
mov esi, ebx
jmp 0x404456
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1acc]
call fcn.00402e1c
lea eax, [ebp - 0x111c]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x1acc]
call fcn.00402f0a
lea ecx, [ebp - 0x1acc]
mov byte [ebp - 4], 2
call fcn.00402da8
cmp eax, 0x14
jle 0x40443a
lea ecx, [ebp - 0x1acc]
call fcn.00402c5a
cmp dword [ebp - 0x10f0], 8
lea ecx, [ebp - 0x1104]
cmovae ecx, dword [ebp - 0x1104]
call fcn.004033e8
cmp dword [ebp - 0x10f0], 8
lea ecx, [ebp - 0x1104]
cmovae ecx, dword [ebp - 0x1104]
call fcn.00403319
cmp dword [ebp - 0x1108], 8
lea eax, [ebp - 0x111c]
cmovae eax, dword [ebp - 0x111c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push ecx
call fcn.0040390d
pop ecx
pop ecx
call fcn.0040407d
test eax, eax
js 0x40443c
call fcn.00403498
mov esi, ebx
push edi
push ebx
lea ecx, [ebp - 0x111c]
call fcn.00401dfe
push edi
push ebx
lea ecx, [ebp - 0x1104]
call fcn.00401dfe
lea ecx, [ebp - 0x1acc]
call fcn.00402bf2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004044ac
mov esp, ebp
pop ebp
ret