Function at 0x4aa018
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4aa020
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aac20
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x17c], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x4aabeb
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00409be0
cmp dword [ebp - 0x44], 0
jne 0x4aa083
mov eax, dword [ebp - 4]
cmp dword [eax + 0x130], 0
je 0x4aabeb
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0049e898
mov byte [ebp - 0x31], al
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x12c], edx
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
je 0x4aa0be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x20], eax
jmp 0x4aa0db
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
test eax, eax
je 0x4aa0db
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x114]
je 0x4aa0db
call fcn.004042fc
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x38]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x49]
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x49], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x114]
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 7
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049e8a8
mov byte [ebp - 0x3d], al
xor edx, edx
push ebp
push 0x4aabe1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x4aa145
mov dl, 1
mov eax, dword [0x419b68]
call fcn.004042cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4aa180
mov eax, dword [ebp - 4]
cmp byte [eax + 0x184], 0
jne 0x4aa180
mov eax, dword [ebp - 4]
cmp byte [eax + 0x185], 0
jne 0x4aa180
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4aa180
mov eax, dword [ebp - 4]
call fcn.004a86b4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4aa212
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4aa212
mov byte [ebp - 0x23], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0x1fa], 0
je 0x4aa1eb
mov eax, dword [ebp - 4]
push dword [eax + 0x1b4]
push dword [eax + 0x1b0]
mov eax, dword [ebp - 4]
add eax, 0x2a0
push eax
lea eax, [ebp - 0x23]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, eax
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1fc]
call dword [ebx + 0x1f8]
cmp byte [ebp - 0x23], 0
je 0x4aa212
lea edx, [ebp - 0x4c]
mov eax, 0xbb
call fcn.0040a50c
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x4980f8]
call fcn.0040e960
call fcn.00404bb0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4aa22a
mov eax, dword [ebp - 4]
call fcn.0049fcb0
test eax, eax
jg 0x4aa250
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 0x50]
call fcn.00494cf4
test al, al
je 0x4aa2a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
jne 0x4aa2a5
mov eax, dword [ebp - 4]
mov byte [eax + 0x270], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aa28c
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 4]
call fcn.004acf48
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.004952a0
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
add eax, 0x2a8
call fcn.00405270
mov eax, dword [ebp - 4]
call fcn.004aac54
mov eax, dword [ebp - 4]
call fcn.0049e8b8
push ebp
call fcn.004a9718
pop ecx
jmp 0x4aa2de
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aa2cc
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 4]
add eax, 0x2a8
call fcn.00405270
mov eax, dword [ebp - 4]
mov byte [eax + 0x270], 0
mov eax, dword [ebp - 4]
call fcn.004aac54
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1d8]
cmp byte [ebx + 0x21], 0
je 0x4aa3dd
cmp byte [ebx + 0x20], 0
je 0x4aa3dd
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x26c]
mov eax, dword [eax + 0x268]
add eax, 0x2e
adc edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
cdq
call fcn.00406280
add eax, dword [ebx + 0x18]
adc edx, dword [ebx + 0x1c]
add eax, 0x16
adc edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, word [eax + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x800
adc edx, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4aa3dd
xor eax, eax
push ebp
push 0x4aa3b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040ac0c
lea eax, [ebp - 0x60]
mov edx, 0x4aac3c
call fcn.004054e8
mov eax, dword [ebp - 0x60]
call fcn.004a6e78
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aa3c4
mov eax, ebx
xor edx, edx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
add eax, dword [ecx + 0x18]
adc edx, dword [ecx + 0x1c]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d8]
movzx eax, byte [ecx + 0x21]
cmp al, 1
jne 0x4aa416
mov eax, dword [ebp - 4]
call fcn.004aaedc
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
jmp 0x4aa467
cmp al, 2
jne 0x4aa467
cmp dword [ecx + 0x14], 0
jne 0x4aa443
cmp dword [ecx + 0x10], 0
jne 0x4aa443
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
jmp 0x4aa467
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4aa4ac
mov eax, dword [ebp - 4]
fild qword [eax + 0x1b0]
fmul dword [0x4aac40]
mov eax, dword [ebp - 4]
fistp qword [eax + 0x1b0]
wait
mov dword [ebp - 0x38], 0x8074b50
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
mov ecx, 4
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4aa5b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4aa5b4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x184], 0
jne 0x4aa506
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4aa5b4
inc ebx
xor esi, esi
push ebp
mov eax, esi
call fcn.004a9f2c
pop ecx
inc esi
dec ebx
jne 0x4aa4f4
jmp 0x4aa5b4
push ebp
xor eax, eax
call fcn.004a9f2c
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x280], 0
je 0x4aa529
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x180]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x180], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x252], 0
je 0x4aa5a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x18]
call fcn.0040521c
mov eax, dword [ebp - 4]
cmp word [eax + 0x252], 0
je 0x4aa580
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x180]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x254]
call dword [ebx + 0x250]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x180]
test eax, eax
je 0x4aa5a4
push 0
push 0
call fcn.0041e954
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x180], 0
jne 0x4aa506
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0041e934
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.00497804
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.0049765c
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004977c8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ebx, dword [eax + 0xc]
dec ebx
test ebx, ebx
jl 0x4aa731
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov edx, esi
call fcn.00492a1c
mov edx, dword [0x495718]
call fcn.004044ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x2a4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4aa6e4
mov eax, dword [ebp - 4]
call fcn.004aaf64
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a4]
call fcn.00496ebc
cdq
cmp edx, dword [esp + 4]
jne 0x4aa679
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4aa6e4
jmp 0x4aa67d
pop edx
pop eax
jle 0x4aa6e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0041e934
sub eax, dword [ebp - 0x30]
add dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 4]
call fcn.004ab078
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
xor edx, edx
call fcn.004976a0
test esi, esi
jne 0x4aa6e4
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.00497804
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.0049765c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x270]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x130]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x284]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a4]
call fcn.00496674
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x2a0]
mov eax, edi
call fcn.00497684
mov edx, eax
inc edx
mov eax, edi
call fcn.004976a0
inc esi
dec ebx
jne 0x4aa61a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0041e934
sub eax, dword [ebp - 0x30]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.00497778
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4aa79c
mov eax, dword [ebp - 4]
call fcn.004aaf64
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004975f4
cdq
cmp edx, dword [esp + 4]
jne 0x4aa790
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4aa79c
jmp 0x4aa794
pop edx
pop eax
jle 0x4aa79c
mov eax, dword [ebp - 4]
call fcn.004ab078
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.00497618
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x284]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.00497214
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4aa7e1
mov eax, dword [ebp - 4]
call fcn.004aafa0
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aabeb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aa86a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4aa851
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
call fcn.00497844
cmp eax, 1
jne 0x4aa851
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebp - 0x3c], 0x30304b50
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
mov ecx, 4
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x284], edx
cmp byte [ebp - 0x19], 0
je 0x4aab25
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aa897
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aa897
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aa8b7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x270], 0
je 0x4aa8b7
mov eax, dword [ebp - 4]
call fcn.0049ec98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 2
jne 0x4aa92f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.004052b4
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x12c]
inc ecx
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0049fefc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov ebx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ebx
mov eax, dword [ebp - 0x6c]
call fcn.004056ac
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.004056ac
push eax
call sub.kernel32.dll_MoveFileA_1
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4aa952
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aa952
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aa952
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x270], 0
je 0x4aa968
mov eax, dword [ebp - 4]
call fcn.004ac8f4
jmp 0x4aa97f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4aa97f
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x284], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x4aa992
push ebp
call fcn.004a9490
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aa9d9
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x114], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 7
jmp 0x4aa9fe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x29c], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x118], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4aaa33
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aaa33
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 0x70]
call fcn.00494b88
mov eax, dword [ebp - 4]
fstp qword [eax + 0x120]
wait
cmp byte [ebp - 0x21], 0
je 0x4aaa53
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aaa53
movzx edx, byte [ebp - 0x21]
mov eax, dword [ebp - 4]
call fcn.0049fbf8
jmp 0x4aaa7c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4aaa7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x298], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
inc edx
mov eax, dword [ebp - 4]
call fcn.0049e79c
mov eax, dword [ebp - 4]
cmp word [eax + 0xca], 0
je 0x4aaab2
mov ebx, dword [ebp - 4]
mov ecx, 0x64
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xcc]
call dword [ebx + 0xc8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1d8]
cmp byte [ebx + 0x21], 0
je 0x4aab52
cmp byte [ebx + 0x20], 0
je 0x4aab52
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
call fcn.004975fc
test eax, eax
jbe 0x4aab52
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4aaafd
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0049e964
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
call fcn.0049ddd0
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x74]
mov edx, 0x4aac4c
call fcn.0040aaf0
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.004aca84
jmp 0x4aab52
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x29c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [ebp - 4]
movzx edx, byte [ebp - 0x21]
mov byte [eax + 0x38], dl
mov eax, dword [ebp - 4]
movzx edx, byte [ebp - 0x22]
mov byte [eax + 0x49], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x298], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004042fc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2a0], edx
mov eax, dword [ebp - 4]
call fcn.0049e93c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4aabbd
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x130]
mov eax, dword [ebp - 4]
call fcn.0049f2f0
movzx edx, byte [ebp - 0x31]
mov eax, dword [ebp - 4]
call fcn.0049e898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx edx, byte [ebp - 0x3d]
mov eax, dword [ebp - 4]
call fcn.0049e8a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aac27
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.00405240
lea eax, [ebp - 0x68]
mov edx, 0xa
call fcn.00405240
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405240
ret