Function at 0x44fd9c
Capabilities:
Delete file
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x30], ebx
test dl, dl
je 0x44fdbf
add esp, 0xfffffff0
call fcn.00403178
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4504bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00402ed4
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 1
mov eax, dword [ebp - 4]
add eax, 4
mov edx, ebx
call fcn.00403a80
mov eax, dword [esi + 0x28]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov al, byte [esi + 0x2c]
mov edx, dword [ebp - 4]
mov byte [edx + 0x2c], al
mov eax, esi
call fcn.00450838
mov ebx, eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp byte [ebx + 0x14], 0
je 0x44fe69
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
test edi, edi
je 0x44ff61
xor edx, edx
mov eax, edi
call fcn.00442ecc
mov edx, 2
mov eax, edi
call fcn.00442ed8
mov edx, 1
mov eax, edi
call fcn.00442ee8
jmp 0x44ff61
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004499d4
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00449904
push eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00449904
pop edx
sub edx, eax
mov dword [ebp - 0x28], edx
mov eax, dword [esi + 0x14]
add eax, dword [ebp - 0x28]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
test edi, edi
je 0x44fed3
xor edx, edx
mov eax, edi
call fcn.00442ecc
mov eax, dword [esi + 0x1c]
movzx edx, word [eax + 6]
inc edx
mov eax, edi
call fcn.00442ed8
mov edx, 1
mov eax, edi
call fcn.00442ee8
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x4504e8
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00449904
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00449904
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x68]
mov ecx, 3
mov eax, 0x450510
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004074c4
test al, al
je 0x44ffaa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403e6c
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x44ffaa
push 0x450558
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x450578
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00403d68
mov eax, dword [ebp - 0x38]
call fcn.0044f9a8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
push ebp
push 0x450469
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403e6c
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x450027
push 0x450584
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x45059c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x6c]
call fcn.00407290
push dword [ebp - 0x6c]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00403d68
mov eax, dword [ebp - 0x38]
call fcn.0044f9a8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
push 0
push 4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x450076
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x6c]
call fcn.00407290
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x38]
mov edx, 0x4505b0
call fcn.00403cf4
mov eax, dword [ebp - 0x38]
call fcn.0044f9a8
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x4500a3
mov eax, 0x4505dc
call fcn.0044f9a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [esi + 0x18]
add eax, dword [edx + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x10]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
cmp byte [ebx + 0x14], 0
je 0x450125
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004063a4
mov eax, esi
call fcn.00450838
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x448fe8]
call fcn.00449a20
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
jmp 0x450408
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x54]
mov edx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004063a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00449904
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x20]
call fcn.00449904
sub ebx, eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00449904
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x20]
call fcn.00449904
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0
lea edx, [ebp - 0x84]
mov ecx, 2
mov eax, 0x4505fc
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x450638
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 8]
add dword [eax + 0x50], edx
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0
lea edx, [ebp - 0x8c]
xor ecx, ecx
mov eax, 0x450664
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x28]
add dword [eax + 0x20], edx
cmp dword [ebp - 8], 0
je 0x450251
push ebp
call fcn.0044fc08
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ebx, eax
add ebx, 0xf8
movzx eax, word [eax + 6]
test eax, eax
jle 0x450408
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 1
test edi, edi
je 0x450283
mov edx, dword [ebp - 0x2c]
mov eax, edi
call fcn.00442ee8
mov edx, 0x450678
mov eax, ebx
mov ecx, 8
call fcn.00407a98
test eax, eax
jne 0x45035c
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x450688
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
mov eax, esi
call fcn.00450838
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00449904
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x448fe8]
call fcn.00449a20
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00449904
mov dword [ebx + 0x10], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00449904
mov dword [ebx + 8], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x4506c8
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
jmp 0x4503f9
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00449904
mov ecx, eax
mov eax, dword [ebx + 0x14]
add eax, dword [esi + 0x10]
push eax
mov eax, dword [ebx + 0x14]
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x10]
add eax, dword [ebp - 0x24]
pop edx
call fcn.004063a4
mov edx, ebx
lea eax, [ebp - 0x30]
mov ecx, 8
call fcn.00403b10
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x30]
call fcn.00403e6c
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 6
mov eax, dword [ebx + 0x14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00449904
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
lea edx, [ebp - 0x68]
mov ecx, 3
mov eax, 0x450708
call fcn.00407ff4
mov eax, dword [ebp - 0x38]
call fcn.00446d80
cmp dword [ebp - 0x24], 0
je 0x4503f9
mov eax, dword [ebp - 0x24]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0xc], eax
add ebx, 0x28
inc dword [ebp - 0x2c]
dec dword [ebp - 0x34]
jne 0x450275
mov eax, dword [ebp - 4]
mov bl, byte [eax + 0x2c]
test bl, bl
je 0x45041c
mov eax, dword [ebp - 4]
call fcn.004508e0
mov byte [eax], bl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_FlushViewOfFile
test eax, eax
jne 0x45043d
mov eax, 0x450738
call fcn.0044f9a8
test edi, edi
je 0x450451
mov eax, edi
call fcn.00442d50
mov edx, eax
mov eax, edi
call fcn.00442ee8
mov eax, dword [ebp - 4]
call fcn.00450838
mov edx, dword [ebp - 4]
mov dword [eax + 0x2c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x450495
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4504c2
lea eax, [ebp - 0x6c]
call fcn.00403a2c
lea eax, [ebp - 0x38]
call fcn.00403a2c
lea eax, [ebp - 0x30]
call fcn.00403a2c
ret