Function at 0x4a89ae
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov eax, 0x50160e
call fcn.00500754
sub esp, 0xd8
push ebx
push esi
push edi
mov edi, 0x65b940
mov esi, 0x659578
xor ebx, ebx
mov ecx, esi
push edi
mov dword [ebp - 0x68], ebx
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x57], bl
push 0x7e
pop ecx
div ecx
mov ecx, ebx
inc dl
mov al, dl
mov byte [ebp - 0x5f], dl
xor al, 0x43
mov byte [ebp - 0x5e], al
mov al, dl
xor al, 0x6f
mov byte [ebp - 0x5d], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x5c], al
mov al, dl
xor al, 0x66
mov byte [ebp - 0x5b], al
mov al, dl
xor al, 0x69
mov byte [ebp - 0x5a], al
mov al, dl
xor al, 0x67
mov byte [ebp - 0x59], al
mov al, dl
xor al, 0x20
mov byte [ebp - 0x58], al
mov al, byte [ebp + ecx - 0x5e]
xor al, dl
mov byte [ecx + 0x65e128], al
inc ecx
cmp ecx, 7
jb 0x4a8a1a
mov ecx, 0x65e128
mov byte [0x65e12f], bl
call fcn.004e311c
call fcn.004c739e
push edi
mov ecx, esi
call fcn.004a64ab
mov ecx, 0x65e13f
mov byte [0x65e13f], bl
call fcn.004e311c
push dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x35]
call fcn.004aa5f5
mov edx, ebx
mov cl, byte [edx + eax + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e1ac], cl
inc edx
cmp edx, 0xf
jb 0x4a8a67
push ecx
push ecx
push ebx
mov esi, 0x65b668
mov byte [0x65e1bb], bl
push 0x80
mov edx, esi
mov ecx, 0x65e1ac
call fcn.004e50b2
and dword [ebp - 0x1c], ebx
add esp, 0x10
and dword [ebp - 0x18], ebx
push dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x33]
call fcn.004aa67d
mov edx, ebx
mov cl, byte [edx + eax + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e108], cl
inc edx
cmp edx, 0xd
jb 0x4a8aaf
push ecx
lea edx, [ebp - 0x1c]
mov byte [0x65e115], bl
mov ecx, 0x65e108
call fcn.004e136c
pop ecx
test al, al
je 0x4a8b45
push dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2d]
call fcn.004aa6fa
mov edx, ebx
mov cl, byte [edx + eax + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e1bc], cl
inc edx
cmp edx, 7
jb 0x4a8ae8
push esi
lea ecx, [ebp - 0x54]
mov byte [0x65e1c3], bl
call fcn.004a2965
push 0x65e1bc
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x8c]
call fcn.004a3083
pop ecx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.004a2890
lea ecx, [ebp - 0x8c]
call fcn.004ab858
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004a2890
push edi
mov ecx, 0x659578
call fcn.004a64ab
mov ecx, 0x65e1fe
mov byte [0x65e1fe], bl
call fcn.004e311c
lea ecx, [ebp - 0xcc]
call fcn.004a83f8
mov dword [ebp - 4], 3
mov ecx, eax
cmp dword [eax + 0x14], 7
jbe 0x4a8b7c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push ecx
call fcn.004fed96
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.004ab790
add esp, 0xc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 5
call fcn.004a2dca
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x65e1e8]
cmp eax, dword [ecx + 4]
jle 0x4a8be1
mov esi, 0x65e1e8
push esi
call fcn.004ff417
cmp dword [0x65e1e8], 0xffffffff
pop ecx
jne 0x4a8be1
push 0x502b80
call fcn.004ff6e7
pop ecx
push esi
call fcn.004ff3c6
pop ecx
mov esi, dword [0x65b6e8]
mov edi, dword [0x65b6ec]
push 0x18
pop ebx
mov dword [ebp - 0x24], ebx
cmp esi, edi
je 0x4a8c0e
mov ecx, esi
call fcn.004a2890
add esi, ebx
cmp esi, edi
jne 0x4a8bf7
mov eax, dword [0x65b6e8]
mov dword [0x65b6ec], eax
cmp dword [ebp - 0x98], 0xf
lea eax, [ebp - 0xac]
push dword [ebp - 0x9c]
cmova eax, dword [ebp - 0xac]
push eax
call fcn.004fed96
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.004a75a5
mov ebx, 0x7c00
and dword [ebp - 0x74], 0
and dword [ebp - 0x70], 0
add esp, 4
mov byte [ebp - 4], 7
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x74]
call fcn.004aa318
pop ecx
test eax, eax
jne 0x4a930e
lea ecx, [ebp - 0x54]
call fcn.004a2dca
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004a9326
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004a9326
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
call fcn.004a9e3b
mov byte [ebp - 4], 0xb
test esi, esi
je 0x4a8eb3
lea eax, [ebp - 0x60]
mov ecx, esi
push eax
call fcn.004a8097
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x68], eax
cmp ecx, 2
jne 0x4a8da5
push 0x65b940
mov ecx, 0x659578
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x25], 0
push 0x7e
pop ecx
div ecx
inc dl
mov al, dl
mov byte [ebp - 0x2d], dl
xor al, 0x2e
mov byte [ebp - 0x2c], al
mov al, dl
xor al, 0x63
mov byte [ebp - 0x2b], al
mov al, dl
xor al, 0x6f
mov byte [ebp - 0x2a], al
mov al, dl
xor al, 0x6e
mov byte [ebp - 0x29], al
mov al, dl
xor al, 0x66
mov byte [ebp - 0x28], al
mov al, dl
xor al, 0x69
mov byte [ebp - 0x27], al
mov al, dl
xor al, 0x67
xor ecx, ecx
mov byte [ebp - 0x26], al
mov al, byte [ebp + ecx - 0x2c]
xor al, dl
mov byte [ecx + 0x65e0ec], al
inc ecx
cmp ecx, 7
jb 0x4a8d24
mov ecx, 0x65e0ec
mov byte [0x65e0f3], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8d45
sub ecx, edx
push ecx
push 0x65e0ec
call fcn.004fed96
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.004a75a5
pop ecx
pop ecx
or ebx, 0x300
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0xc
or ebx, 1
lea ecx, [esi + 0x20]
push eax
mov dword [ebp - 0x68], ebx
call fcn.004a7ad6
push dword [ebp - 0x44]
or ebx, 2
lea ecx, [ebp - 0x54]
cmp dword [ebp - 0x40], 7
cmova ecx, dword [ebp - 0x54]
push ecx
mov ecx, eax
call fcn.004a793d
mov byte [ebp - 0x1d], 1
test eax, eax
je 0x4a8da9
mov byte [ebp - 0x1d], 0
test bl, 2
je 0x4a8dbc
lea ecx, [ebp - 0x8c]
and ebx, 0xfffffffd
call fcn.004a2dca
mov dword [ebp - 4], 0xb
test bl, 1
je 0x4a8dd3
lea ecx, [ebp - 0x54]
and ebx, 0xfffffffe
call fcn.004a2dca
cmp byte [ebp - 0x1d], 0
je 0x4a8e95
cmp dword [esi + 0x34], 7
lea ecx, [esi + 0x20]
jbe 0x4a8de9
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x30]
lea esi, [ecx + eax*2]
mov edx, esi
call fcn.004a7726
mov ecx, eax
lea edi, [ebp - 0x54]
xor eax, eax
sub esi, ecx
stosd dword es:[edi], eax
sar esi, 1
push esi
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
call fcn.004ab11f
or ebx, 0x1c
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 7
push dword [ebp - 0x44]
cmova eax, dword [ebp - 0x54]
push eax
push ecx
call fcn.004fed96
mov edx, eax
lea ecx, [ebp - 0x8c]
call fcn.004ab790
add esp, 0xc
or ebx, 0xe0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x8c]
mov eax, dword [0x65b6ec]
push ecx
cmp eax, dword [0x65b6f0]
je 0x4a8e73
mov ecx, eax
call fcn.004a28b3
push 0x18
pop eax
add dword [0x65b6ec], eax
jmp 0x4a8e7e
push eax
mov ecx, 0x65b6e8
call fcn.004ab5b2
lea ecx, [ebp - 0x8c]
call fcn.004a2890
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xb
call fcn.004a2dca
lea ecx, [ebp - 0x94]
call fcn.004a8135
test eax, eax
jne 0x4a931e
mov esi, dword [ebp - 0x94]
jmp 0x4a8cae
lea ecx, [ebp - 0x1c]
call fcn.004a9e3b
lea ecx, [ebp - 0x94]
call fcn.004a9e3b
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.004a9e3b
mov eax, dword [0x65b6ec]
xor ebx, ebx
mov edi, dword [0x65b6e8]
mov esi, ebx
sub eax, edi
push 0x18
pop ecx
cdq
idiv ecx
mov ecx, dword [0x6590c0]
test eax, eax
je 0x4a8f46
and dword [ebp - 0x1c], ebx
and dword [ebp - 0x18], ebx
cmp ecx, esi
lea ecx, [edi + ebx]
sete dl
cmp dword [ecx + 0x14], 0xf
jbe 0x4a8f09
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
push ecx
call fcn.004ecbfa
pop ecx
pop ecx
test al, al
je 0x4a8f23
mov ecx, esi
mov dword [0x6590c0], ecx
jmp 0x4a8f29
mov ecx, dword [0x6590c0]
mov edi, dword [0x65b6e8]
inc esi
push 0x18
pop eax
add ebx, eax
mov eax, dword [0x65b6ec]
sub eax, edi
cdq
idiv dword [ebp - 0x24]
cmp esi, eax
jb 0x4a8ef9
xor ebx, ebx
cmp ecx, 0xffffffff
je 0x4a8f8b
imul esi, ecx, 0x18
add esi, edi
cmp dword [esi + 0x14], 0xf
jbe 0x4a8f58
mov esi, dword [esi]
push dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x39]
call fcn.004aa751
mov edx, ebx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e1d4], cl
inc edx
cmp edx, 0x13
jb 0x4a8f66
push esi
push 0x65e1d4
mov byte [0x65e1e7], bl
call fcn.004e0ca4
pop ecx
pop ecx
push dword [ebp - 0x24]
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
push ecx
lea ecx, [ebp - 0x33]
call fcn.004aa7f2
mov edx, ebx
mov cl, byte [edx + eax + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e1f0], cl
inc edx
cmp edx, 0xd
jb 0x4a8fa1
push ecx
lea edx, [ebp - 0x1c]
mov byte [0x65e1fd], bl
mov ecx, 0x65e1f0
call fcn.004e136c
pop ecx
push 0x18
pop edi
test al, al
je 0x4a9009
mov ecx, dword [0x6590c0]
test ecx, ecx
js 0x4a9009
mov eax, dword [0x65b6ec]
mov esi, dword [0x65b6e8]
sub eax, esi
cdq
idiv edi
cmp ecx, eax
jae 0x4a9009
imul eax, ecx, 0x18
lea ecx, [ebp - 0x8c]
add eax, esi
push eax
call fcn.004a299c
lea ecx, [ebp - 0x8c]
call fcn.004a2890
and dword [ebp - 0x1c], 0
mov ecx, 0x659578
and dword [ebp - 0x18], 0
push 0x65b940
call fcn.004a64ab
xor edx, edx
mov byte [ebp - 0x25], bl
push 0x7e
pop ecx
div ecx
inc dl
mov al, dl
mov byte [ebp - 0x33], dl
xor al, 0x53
mov cl, dl
mov byte [ebp - 0x32], al
xor cl, 0x65
mov al, dl
mov byte [ebp - 0x2c], cl
xor al, 0x61
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x31], al
mov al, dl
xor al, 0x76
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x30], al
mov ecx, ebx
mov al, dl
xor al, 0x65
mov byte [ebp - 0x2f], al
mov al, dl
xor al, 0x20
mov byte [ebp - 0x2e], al
mov al, dl
xor al, 0x53
mov byte [ebp - 0x2d], al
mov al, dl
xor al, 0x6c
mov byte [ebp - 0x2b], al
mov al, dl
xor al, 0x63
mov byte [ebp - 0x29], al
mov al, dl
xor al, 0x74
mov byte [ebp - 0x28], al
mov al, dl
xor al, 0x64
mov byte [ebp - 0x26], al
mov al, byte [ebp + ecx - 0x32]
xor al, dl
mov byte [ecx + 0x65e118], al
inc ecx
cmp ecx, 0xd
jb 0x4a9085
push ecx
lea edx, [ebp - 0x1c]
mov byte [0x65e125], bl
mov ecx, 0x65e118
call fcn.004e136c
pop ecx
test al, al
je 0x4a90fd
mov ecx, dword [0x6590c0]
test ecx, ecx
js 0x4a90fd
mov eax, dword [0x65b6ec]
mov esi, dword [0x65b6e8]
sub eax, esi
cdq
idiv edi
cmp ecx, eax
jae 0x4a90fd
imul eax, ecx, 0x18
lea ecx, [ebp - 0x8c]
add eax, esi
push eax
call fcn.004a299c
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xf
call fcn.004ab858
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 5
call fcn.004a2890
push 0x65b940
mov ecx, 0x659578
call fcn.004a64ab
mov ecx, 0x65e15e
mov byte [0x65e15e], bl
call fcn.004e311c
push dword [ebp - 0x24]
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
push ecx
lea ecx, [ebp - 0x35]
call fcn.004aa86c
mov edx, ebx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e218], cl
inc edx
cmp edx, 0xf
jb 0x4a9132
push ecx
lea edx, [ebp - 0x1c]
mov byte [0x65e227], bl
mov ecx, 0x65e218
call fcn.004e136c
pop ecx
test al, al
je 0x4a9249
mov ecx, dword [0x6590c0]
test ecx, ecx
js 0x4a9249
mov eax, dword [0x65b6ec]
mov esi, dword [0x65b6e8]
sub eax, esi
cdq
idiv edi
cmp ecx, eax
jae 0x4a9249
imul eax, ecx, 0x18
lea ecx, [ebp - 0x8c]
add eax, esi
push eax
call fcn.004a299c
push 0x50ae4c
lea edx, [ebp - 0xac]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3c]
call fcn.004aa22a
pop ecx
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x11
push ecx
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.004a30b7
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.004a2890
cmp dword [ebp - 0x40], 0xf
lea eax, [ebp - 0x54]
cmova eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
test eax, eax
jne 0x4a9232
imul ebx, dword [0x6590c0], 0x18
mov edi, dword [0x65b6ec]
add ebx, dword [0x65b6e8]
lea esi, [ebx + 0x18]
cmp esi, edi
je 0x4a9218
push esi
mov ecx, ebx
call fcn.004aa1e1
push 0x18
pop eax
add esi, eax
add ebx, eax
cmp esi, edi
jne 0x4a91ff
mov edi, dword [0x65b6ec]
lea ecx, [edi - 0x18]
call fcn.004a2890
or dword [0x6590c0], 0xffffffff
push 0x18
pop eax
sub dword [0x65b6ec], eax
xor ebx, ebx
lea ecx, [ebp - 0x54]
call fcn.004a2890
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 5
call fcn.004a2890
push dword [ebp - 0x24]
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
push ecx
lea ecx, [ebp - 0x36]
call fcn.004aa8e6
mov edx, ebx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x65e160], cl
inc edx
cmp edx, 0x10
jb 0x4a925f
push ecx
lea edx, [ebp - 0x1c]
mov byte [0x65e170], bl
mov ecx, 0x65e160
call fcn.004e136c
pop ecx
test al, al
je 0x4a928f
call fcn.004a9c62
push 0x65b940
mov ecx, 0x659578
call fcn.004a64ab
mov ecx, 0x65e1a8
mov byte [0x65e1a8], bl
call fcn.004e311c
push dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x64]
call fcn.004a351c
lea ecx, [ebp - 0xe4]
push ecx
mov ecx, eax
call fcn.004a2622
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 0xf
jbe 0x4a92d4
mov eax, dword [eax]
push 0x6590c8
push eax
call fcn.004f10f5
lea ecx, [ebp - 0xe4]
call fcn.004a2890
call fcn.004c73f2
call fcn.004ed3d5
lea ecx, [ebp - 0xac]
call fcn.004a2890
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp - 0x54]
mov edx, eax
push ecx
mov ecx, str.directory_iterator::directory_iterator
call fcn.004a7f73
mov edx, eax
call fcn.004a7eae
int3