Function at 0x4ddb3c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x158]
mov esi, ecx
push ebx
xor ebx, ebx
sub esp, 0x16c
mov dword [esp], edi
call fcn.004a88ce
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], 0x527abf
mov dword [ebp - 0x144], 0
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x148], eax
test eax, eax
je 0x4dddc1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4ddc47
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x148]
xor ebx, ebx
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x4011f00d
call fcn.0050c474
push ecx
push ecx
test al, al
jne 0x4ddbd1
mov dword [esp + 4], str.ERROR:_could_not_write_magic
jmp 0x4ddc0f
call sub.msvcrt.dll_rand
lea edx, [ebp - 0x140]
mov dword [edx + ebx*4], eax
inc ebx
cmp ebx, 4
jne 0x4ddbd1
mov dword [esp], edx
lea ecx, [ebp - 0x148]
mov dword [esp + 4], 0x20
call fcn.0050c474
test al, al
push edx
push edx
lea edx, [ebp - 0x140]
jne 0x4ddc28
mov dword [esp + 4], str.ERROR:_could_not_write_nonce
mov dword [esp], 0x5694e0
call fcn.004c8905
mov dword [esp], eax
call fcn.004c8cf3
jmp 0x4ddd77
lea eax, [esi + 0x54]
mov dword [esp], edx
lea ebx, [ebp - 0x120]
mov dword [esp + 4], eax
mov ecx, ebx
call fcn.0050a950
mov dword [ebp - 0x144], ebx
push eax
push eax
lea eax, [ebp - 0x154]
lea ecx, [ebp - 0x148]
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [ebp - 0x154], 0xc01df00d
call fcn.0050c474
mov ebx, eax
push ecx
push ecx
test al, al
jne 0x4ddc96
mov dword [esp + 4], str.ERROR:_could_not_write_magic
mov dword [esp], 0x5694e0
call fcn.004c8905
mov dword [esp], eax
call fcn.004c8cf3
jmp 0x4dddc1
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
lea edx, [esi + 0x10]
cmp eax, edx
mov dword [ebp - 0x15c], eax
je 0x4ddd7b
lea ebx, [ebp - 0x140]
mov ecx, ebx
call fcn.004c7198
mov eax, dword [ebp - 0x15c]
mov dword [esp], ebx
lea ecx, [eax + 0x10]
call fcn.00428320
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], 4
mov dword [esp], eax
call fcn.0050c474
push edx
push edx
test al, al
jne 0x4ddd13
mov dword [esp + 4], str.ERROR:_could_not_write_size
jmp 0x4ddd3f
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call fcn.0050c474
push edx
push edx
test al, al
jne 0x4ddd60
mov dword [esp + 4], str.ERROR:_could_not_write_msg
mov dword [esp], 0x5694e0
call fcn.004c8905
mov dword [esp], eax
call fcn.004c8cf3
lea ecx, [ebp - 0x140]
call fcn.004c71a6
jmp 0x4ddd77
mov ecx, ebx
call fcn.004c71a6
lea ecx, [ebp - 0x150]
call fcn.004c76ee
jmp 0x4ddc9f
xor ebx, ebx
jmp 0x4dddc1
mov eax, dword [ebp - 0x148]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp + 8]
mov dword [esp + 8], 3
mov dword [ebp - 0x148], 0
mov eax, dword [eax]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
sub esp, 0xc
test eax, eax
setne bl
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x4dddd3
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, edi
call fcn.004c616a
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8