Function at 0x4d7a11
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov dword [ebp - 0x608], 0
push 0x5b7eb4
lea eax, [ebp - 0x80c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.InfIereset.inf
lea ecx, [ebp - 0x80c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7eb4
lea edx, [ebp - 0x604]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.InfIereset.tmp
lea eax, [ebp - 0x604]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x595af0
lea ecx, [ebp - 0x80c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0
jne 0x4d7a9d
jmp 0x4d7d7a
push 0x595af4
lea edx, [ebp - 0x604]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d7adf
push str.No_ha_sido_posible_crear_IERESET.TMP_n
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x4d7d7a
mov dword [0x5b84b8], 0
jmp 0x4d7afa
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0x200
jge 0x4d7b23
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x204], 0
mov eax, dword [0x5b84b8]
mov byte [ebp + eax - 0x404], 0
jmp 0x4d7aeb
mov ecx, dword [ebp - 0x60c]
push ecx
push 0x200
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
mov eax, dword [ebp - 0x60c]
mov ecx, dword [eax + 0xc]
and ecx, 0x10
test ecx, ecx
je 0x4d7b54
jmp 0x4d7d0c
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x404]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x404]
push ecx
call fcn.00401fca
add esp, 4
push str.START_PAGE_URL_
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d7bd7
movsx eax, byte [ebp - 0x404]
cmp eax, 0x53
jne 0x4d7bd7
push 0x595b34
lea ecx, [ebp - 0x404]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4d7bd2
mov edx, dword [ebp - 4]
push edx
push str.START_PAGE_URL_http:__www.microsoft.com_isapi_redir.dll_prdiepver6armsnhome__n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov dword [ebp - 0x608], 1
jmp 0x4d7cff
push str.MS_START_PAGE_URL_
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d7c35
movsx ecx, byte [ebp - 0x404]
cmp ecx, 0x4d
jne 0x4d7c35
push 0x595bf0
lea edx, [ebp - 0x404]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4d7c30
mov eax, dword [ebp - 4]
push eax
push str.MS_START_PAGE_URL_http:__www.microsoft.com_isapi_redir.dll_prdiepver6armsnhome__n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov dword [ebp - 0x608], 1
jmp 0x4d7cff
push str.SEARCH_PAGE_URL_
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d7c90
movsx edx, byte [ebp - 0x404]
cmp edx, 0x53
jne 0x4d7c90
push 0x595cb4
lea eax, [ebp - 0x404]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4d7c8e
mov ecx, dword [ebp - 4]
push ecx
push str.SEARCH_PAGE_URL_http:__www.microsoft.com_isapi_redir.dll_prdieariesearch__n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov dword [ebp - 0x608], 1
jmp 0x4d7cff
push str.SAFESITE_VALUE_
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4d7ceb
movsx eax, byte [ebp - 0x404]
cmp eax, 0x53
jne 0x4d7ceb
push 0x595d68
lea ecx, [ebp - 0x404]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4d7ce9
mov edx, dword [ebp - 4]
push edx
push str.SAFESITE_VALUE_ie.search.msn.com__n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov dword [ebp - 0x608], 1
jmp 0x4d7cff
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov edx, 1
test edx, edx
jne 0x4d7adf
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebp - 0x608], 0
je 0x4d7d6a
lea edx, [ebp - 0x80c]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0x604]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
push str.Restaurado_fichero_de_Configuraci
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4d7d7a
lea edx, [ebp - 0x604]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret