Function at 0x47b5d0
Capabilities:
Delete file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64507d
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x6bc858]
xor eax, esp
mov dword [esp + 0x4a0], eax
push ebx
push esi
push edi
mov eax, dword [0x6bc858]
xor eax, esp
push eax
lea eax, [esp + 0x4b8]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x7c], ebx
push 8
mov dword [esp + 0x4c4], ebx
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bfe4
mov dword [esp + 0x7c], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x7c]
mov dword [ecx], eax
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
mov esi, eax
mov dword [esp + 0x4c0], 1
call fcn.004c4b60
push 7
push 0x675cf4
mov ecx, esi
call fcn.00412ae0
push 6
push str.AD.ini
mov ecx, esi
call fcn.00412ae0
mov edi, dword [ebp + 0x14]
movzx esi, di
push esi
lea edx, [esp + 0x198]
push 0x675d58
push edx
mov byte [esp + 0x1a0], bl
mov dword [esp + 0x1a1], ebx
mov dword [esp + 0x1a5], ebx
mov byte [esp + 0x1a9], bl
mov byte [esp + 0x1ac], bl
mov dword [esp + 0x1ad], ebx
mov dword [esp + 0x1b1], ebx
mov byte [esp + 0x1b5], bl
call fcn.005f1060
add esp, 0xc
shr edi, 0x10
push edi
lea eax, [esp + 0x1a4]
push 0x675d58
push eax
call fcn.005f1060
mov eax, dword [esp + 0x8c]
add esp, 0xc
cmp dword [esp + 0x94], 0x10
jae 0x47b714
lea eax, [esp + 0x80]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
lea ecx, [esp + 0x198]
push ecx
push str.template_type
push str.gateway
call edi
cmp dword [esp + 0x94], 0x10
mov eax, dword [esp + 0x80]
jae 0x47b747
lea eax, [esp + 0x80]
push eax
lea edx, [esp + 0x1a4]
push edx
push str.login_type
push str.gateway
call edi
mov dword [esp + 0x18], 1
mov dword [esp + 0x9c], ebx
push 8
mov byte [esp + 0x4c4], 2
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bfbb
mov dword [esp + 0x9c], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0x9c]
lea eax, [esp + 0x9c]
mov dword [ecx], eax
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
mov dword [esp + 0xbc], ebx
push 8
mov byte [esp + 0x4c4], 4
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bf92
mov dword [esp + 0xbc], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov eax, dword [esp + 0xbc]
lea edx, [esp + 0xbc]
mov dword [eax], edx
mov dword [esp + 0xd4], 0xf
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
mov dword [esp + 0xdc], ebx
push 8
mov byte [esp + 0x4c4], 6
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bf69
mov dword [esp + 0xdc], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esp + 0xdc]
lea ecx, [esp + 0xdc]
mov dword [edx], ecx
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
mov byte [esp + 0x4c0], 7
call fcn.0047e1b0
cmp esi, 1
je 0x47b956
add esi, 0xfffffffe
cmp esi, 2
ja 0x47b985
push 0x1fe
lea ecx, [esp + 0x2b2]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], 1
mov word [esp + 0x2b8], ax
call fcn.005ff630
add esp, 0xc
push 0xff
lea edx, [esp + 0x1b1]
push ebx
push edx
mov byte [esp + 0x1b8], bl
call fcn.005ff630
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [eax + 0x7c], 8
jb 0x47b8e2
mov eax, dword [eax + 0x68]
jmp 0x47b8e5
add eax, 0x68
push eax
lea eax, [esp + 0x2b0]
push str.http:___s:28
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ebx, [esp + 0x1ac]
lea esi, [esp + 0x2ac]
call fcn.004d1600
mov ecx, ebx
push ecx
lea ecx, [esp + 0xc0]
call fcn.004124a0
mov edx, ebx
push edx
lea ecx, [esp + 0xe0]
call fcn.004124a0
sub esp, 0x20
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6745b6
call fcn.00412330
mov esi, dword [esp + 0x34]
mov ecx, esi
call fcn.0047f090
mov ecx, esi
call fcn.0047d5d0
xor ebx, ebx
jmp 0x47b97f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x18]
lea edi, [esp + 0xbc]
call fcn.00485190
push 0xffffffffffffffff
push ebx
mov ecx, edi
push ecx
lea ecx, [esp + 0xe8]
call fcn.004126e0
mov dword [esp + 0x18], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x80]
mov esi, 0x10
cmp dword [esp + 0x94], esi
jae 0x47b9a1
lea ecx, [esp + 0x80]
mov eax, dword [esp + 0xc0]
cmp dword [esp + 0xd4], esi
jae 0x47b9b8
lea eax, [esp + 0xc0]
push ecx
push eax
push str.wifi_url
push str.gateway
call edi
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x94], esi
jae 0x47b9dd
lea ecx, [esp + 0x80]
mov eax, dword [esp + 0xe0]
cmp dword [esp + 0xf4], esi
jae 0x47b9f4
lea eax, [esp + 0xe0]
push ecx
push eax
push str.Preview_url
push str.gateway
call edi
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x9c]
push edx
call fcn.00485910
mov eax, dword [esp + 0xb0]
cmp eax, 0x80
jbe 0x47ba5b
cmp eax, 0x7f
ja 0x47ba40
push 0x5a1
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.00563e60
add esp, 0xc
cmp dword [esp + 0xb4], 0x10
mov eax, dword [esp + 0xa0]
jae 0x47ba58
lea eax, [esp + 0xa0]
mov byte [eax + 0x7f], bl
lea eax, [esp + 0x13c]
push eax
call fcn.00461600
mov byte [esp + 0x4c0], 8
call fcn.00461d20
test eax, eax
je 0x47bab0
mov ecx, dword [esp + 0x80]
mov eax, 0x10
cmp dword [esp + 0x94], eax
jae 0x47ba95
lea ecx, [esp + 0x80]
cmp dword [esp + 0xb4], eax
mov eax, dword [esp + 0xa0]
jae 0x47baac
lea eax, [esp + 0xa0]
push ecx
push eax
jmp 0x47bace
cmp dword [esp + 0x94], 0x10
mov eax, dword [esp + 0x80]
jae 0x47bac8
lea eax, [esp + 0x80]
push eax
push str.http:__www.wifibigdata.com
push str.jump_url
push str.gateway
call edi
mov ecx, 3
cmp cx, word [ebp + 0x14]
jne 0x47bcae
mov dword [esp + 0x11c], ebx
push 8
mov byte [esp + 0x4c4], 9
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bcfd
mov dword [esp + 0x11c], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x11c]
lea edx, [esp + 0x11c]
mov dword [eax], edx
mov dword [esp + 0x134], 7
mov dword [esp + 0x130], ebx
mov word [esp + 0x120], cx
mov byte [esp + 0x4c0], 0xa
mov esi, dword [esi + 0x18]
push edx
call fcn.004855d0
mov dword [esp + 0xfc], ebx
push 8
mov byte [esp + 0x4c4], 0xb
call fcn.005f0fe0
add esp, 4
cmp eax, ebx
je 0x47bcd4
mov dword [esp + 0xfc], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0xfc]
lea eax, [esp + 0xfc]
mov dword [ecx], eax
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
mov esi, eax
mov byte [esp + 0x4c0], 0xc
call fcn.004c4b60
mov esi, 0x10
push esi
push str.wwwUserFile.txt
lea ecx, [esp + 0x104]
call fcn.00412ae0
mov eax, dword [esp + 0x100]
cmp dword [esp + 0x114], esi
jae 0x47bbe8
lea eax, [esp + 0x100]
cmp eax, ebx
jne 0x47bbf3
call fcn.004c35a0
jmp 0x47bbfd
push ebx
push eax
call fcn.005fc7e0
add esp, 8
cmp eax, ebx
jne 0x47bc1f
mov eax, dword [esp + 0x100]
cmp dword [esp + 0x114], esi
jae 0x47bc18
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x100]
cmp dword [esp + 0x114], esi
jae 0x47bc36
lea eax, [esp + 0x100]
push str.w__ccsUNICODE
push eax
call fcn.005f5530
add esp, 8
cmp dword [esp + 0x134], 8
mov esi, eax
mov eax, dword [esp + 0x120]
jae 0x47bc5e
lea eax, [esp + 0x120]
mov edx, dword [esp + 0x130]
push esi
lea ecx, [edx + edx + 2]
push ecx
push 1
push eax
call fcn.005f5d70
push esi
call fcn.005f64a0
add esp, 0x14
lea ecx, [esp + 0xfc]
mov byte [esp + 0x4c0], 0xa
call fcn.00412410
lea ecx, [esp + 0x11c]
mov byte [esp + 0x4c0], 8
call fcn.004125f0
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
cmp dword [esp + 0x18], ebx
je 0x47bd26
cmp dword [esp + 0x94], 0x10
jae 0x47bccc
lea eax, [esp + 0x80]
push eax
push 0x675d18
jmp 0x47bd3d
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x68]
mov dword [esp + 0x28], ebx
call fcn.005f41f0
push 0x6a361c
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], vtable.std::bad_alloc.0
call fcn.006009e0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], ebx
call fcn.005f41f0
push 0x6a361c
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x48], vtable.std::bad_alloc.0
call fcn.006009e0
cmp dword [esp + 0x94], 0x10
jae 0x47bd37
lea eax, [esp + 0x80]
push eax
push 0x686e68
push str.local_ad
push str.gateway
call edi
call fcn.0047f650
cmp dword [esi + 0xd4], ebx
jne 0x47bd68
push ebx
push 0x675f6c
push 0x687c9c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi]
mov edx, dword [eax + 0x148]
push ebx
mov ecx, esi
call edx
lea eax, [esp + 0x13c]
push eax
mov byte [esp + 0x4c4], 7
call fcn.004616f0
mov esi, 0x10
cmp dword [esp + 0xf4], esi
jb 0x47bda8
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.005f0cb0
add esp, 4
mov edi, 0xf
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
lea ecx, [esp + 0xdc]
mov byte [esp + 0x4c0], 0xd
call fcn.0040ed70
mov edx, dword [esp + 0xdc]
push edx
call fcn.005f0cb0
add esp, 4
lea ecx, [esp + 0xdc]
mov dword [esp + 0xdc], ebx
mov byte [esp + 0x4c0], 5
call fcn.0040ed70
cmp dword [esp + 0xd4], esi
jb 0x47be1a
mov eax, dword [esp + 0xc0]
push eax
call fcn.005f0cb0
add esp, 4
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
lea ecx, [esp + 0xbc]
mov byte [esp + 0x4c0], 0xe
call fcn.0040ed70
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.005f0cb0
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0xbc], ebx
mov byte [esp + 0x4c0], 3
call fcn.0040ed70
cmp dword [esp + 0xb4], esi
jb 0x47be87
mov edx, dword [esp + 0xa0]
push edx
call fcn.005f0cb0
add esp, 4
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
lea ecx, [esp + 0x9c]
mov byte [esp + 0x4c0], 0xf
call fcn.0040ed70
mov eax, dword [esp + 0x9c]
push eax
call fcn.005f0cb0
add esp, 4
lea ecx, [esp + 0x9c]
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x4c0], 1
call fcn.0040ed70
cmp dword [esp + 0x94], esi
jb 0x47bef4
mov ecx, dword [esp + 0x80]
push ecx
call fcn.005f0cb0
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
lea ecx, [esp + 0x7c]
mov dword [esp + 0x4c0], esi
call fcn.0040ed70
mov edx, dword [esp + 0x7c]
push edx
call fcn.005f0cb0
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x4c0], 0xffffffff
call fcn.0040ed70
mov eax, 1
mov ecx, dword [esp + 0x4b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4a0]
xor ecx, esp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], ebx
call fcn.005f41f0
push 0x6a361c
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], vtable.std::bad_alloc.0
call fcn.006009e0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x24], ebx
call fcn.005f41f0
push 0x6a361c
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x60], vtable.std::bad_alloc.0
call fcn.006009e0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x2c], ebx
call fcn.005f41f0
push 0x6a361c
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x78], vtable.std::bad_alloc.0
call fcn.006009e0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x34], ebx
call fcn.005f41f0
push 0x6a361c
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x54], vtable.std::bad_alloc.0
call fcn.006009e0
int3