Function at 0x4c90fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x4c9105
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.004054dc
lea edi, [ebp - 0xa7]
xor eax, eax
push ebp
push 0x4c9c5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x35], 0
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 0xc0], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x200], 1
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 4]
call fcn.0040acd4
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x10]
add eax, 0x158
mov ecx, 0x4c9c7c
call fcn.00405338
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x158]
mov eax, dword [ebp - 0x10]
call fcn.004c8010
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x15c], al
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x150], 0xffffffff
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1c0], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1e4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x1ac
mov edx, dword [ebp - 4]
call fcn.0040507c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
call fcn.004c3e3c
xor ecx, ecx
push ebp
push 0x4c9b03
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x2800
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4c90dc]
call fcn.00406770
add esp, 4
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0040ad8c
cmp dword [ebp - 0xb0], 0
jne 0x4c926d
lea eax, [ebp - 0xb4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004c3408
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x14]
call fcn.0040507c
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jne 0x4c92a7
push 1
mov ecx, 0x2b13
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
jmp 0x4c92a7
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x1a4], 0
sete dl
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004c01d4
lea ecx, [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, 0x4c9c88
call fcn.0040ac0c
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
call fcn.0040507c
push 0
lea ecx, [ebp - 0x4b]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x1ac]
mov eax, dword [ebp - 0x10]
call fcn.004c788c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x4c92ec
mov eax, dword [ebp - 0x10]
call fcn.004c3e78
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x200], 0
mov dword [ebp - 0x18], 0xfffffff7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9c16
cmp dword [ebp - 0x18], 0
jle 0x4c930a
push 1
mov ecx, 0x2aff
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov dword [ebp - 0xbc], ebx
mov eax, dword [ebp - 0xbc]
call fcn.004054ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ecx, dword [ebp - 0x10]
mov edx, eax
mov dword [ecx + 0x1c4], edx
inc edx
jne 0x4c935e
push 1
mov ecx, 0x2b01
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
call fcn.0040a9c8
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x138], eax
movzx eax, word [ebp - 0x47]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1fc], eax
movzx eax, word [ebp - 0x45]
cmp ax, word [ebp - 0x47]
je 0x4c9397
movzx edx, ax
mov eax, dword [ebp - 0x10]
call fcn.004c7e4c
mov eax, dword [ebp - 0x3b]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
xor edx, edx
call fcn.004bfe4c
cmp edx, 0xffffffff
jne 0x4c93d0
cmp eax, 0xffffffff
jne 0x4c93d0
push 1
mov ecx, 0x2b00
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
movzx ecx, word [ebp - 0x41]
mov dl, 1
mov eax, dword [0x4c50d0]
call fcn.004c5138
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0x37]
add eax, dword [ebp - 0x3f]
add eax, 0x16
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
movzx esi, word [ebp - 0x41]
dec esi
test esi, esi
jl 0x4c955f
inc esi
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xbd], 0
je 0x4c946b
push 0
mov ecx, 0x2aff
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
jmp 0x4c946b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x150]
movzx edx, word [ebp - 0x47]
cmp eax, edx
jl 0x4c9459
push 1
mov ecx, 0x2b05
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x150]
inc edx
mov eax, dword [ebp - 0x10]
call fcn.004c7e4c
mov edx, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov ecx, 0x2e
call fcn.0040a8d8
cmp eax, 0x2e
jne 0x4c9430
cmp dword [edi], 0x2014b50
je 0x4c94a5
push 1
mov ecx, 0x2b07
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
push 0x2b09
movzx ecx, word [edi + 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c90a0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
call fcn.0041bcfc
mov ebx, eax
movzx eax, word [edi + 0x1c]
mov word [ebx + 0x10], ax
movzx ecx, word [edi + 0x1c]
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x12]
call fcn.0040b280
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x118], eax
movzx eax, word [edi + 0x1c]
add eax, 0x1e
movzx ebx, word [edi + 0x1e]
add eax, ebx
add eax, dword [edi + 0x14]
xor edx, edx
add dword [ebp - 0x20], eax
adc dword [ebp - 0x1c], edx
movzx eax, word [edi + 8]
and ax, 8
cmp ax, 8
jne 0x4c9514
add dword [ebp - 0x20], 0x10
adc dword [ebp - 0x1c], 0
mov eax, ebx
movzx edx, word [edi + 0x20]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 1
call fcn.004bfe4c
cmp edx, 0xffffffff
jne 0x4c9555
cmp eax, 0xffffffff
jne 0x4c9555
push 1
mov ecx, 0x2b00
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
inc dword [ebp - 0x24]
dec esi
jne 0x4c940a
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004c7e4c
cmp byte [ebp + 8], 0
je 0x4c95a7
lea edx, [ebp - 0xc0]
mov eax, 0x2c92
call fcn.004c1404
mov eax, dword [ebp - 0xc0]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, 0xa
mov dl, 0xf
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1e4], 2
jmp 0x4c95e6
push 0
movzx eax, word [ebp - 0x41]
inc eax
xor edx, edx
push edx
push eax
mov ecx, 6
mov dl, 5
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, 6
mov dl, 6
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1e4], 1
mov byte [ebp - 0x35], 1
push 0x2b17
lea edx, [ebp - 0x28]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.004c90a0
cmp dword [ebp - 0x28], 0x8074b50
je 0x4c961c
push 1
mov ecx, 0x2b17
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
movzx esi, word [ebp - 0x41]
dec esi
test esi, esi
jl 0x4c98aa
inc esi
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xbd], 0
je 0x4c96bb
push 0
mov ecx, 0x2aff
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
jmp 0x4c96bb
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 1
call fcn.004bfe4c
push edx
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 2
call fcn.004bfe4c
cmp edx, dword [esp + 4]
jne 0x4c968d
cmp eax, dword [esp]
pop edx
pop eax
je 0x4c96a9
push 1
mov ecx, 0x2b04
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x150]
inc edx
mov eax, dword [ebp - 0x10]
call fcn.004c7e4c
lea edx, [ebp - 0x69]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov ecx, 0x1e
call fcn.0040a8d8
cmp eax, 0x1e
jne 0x4c9654
cmp dword [ebp - 0x69], 0x4034b50
je 0x4c96fb
push 1
mov ecx, 0x2b06
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
push 0x2b08
movzx ecx, word [ebp - 0x4f]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c90a0
lea eax, [ebp - 0xc4]
push eax
movzx ecx, word [ebp - 0x4f]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c8a30
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x34]
call fcn.004c523c
mov edx, eax
mov eax, dword [ebp - 0x34]
call fcn.0041bcfc
mov ebx, eax
mov word [ebx], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c4]
mov edx, 1
call fcn.004bfe4c
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
lea eax, [ebp - 0xcc]
lea edx, [ebx + 0x12]
mov ecx, 0xff
call fcn.00405298
mov eax, dword [ebp - 0xcc]
lea ecx, [ebp - 0xc8]
xor edx, edx
call fcn.004bff94
mov eax, dword [ebp - 0xc8]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0x2779
call fcn.004c1404
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 8]
pop ecx
call fcn.00405338
mov eax, dword [ebp - 8]
push eax
push 0
push 0
xor ecx, ecx
mov dl, 4
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
movzx eax, word [ebp - 0x4f]
add eax, 0x1e
movzx edx, word [ebp - 0x4d]
add eax, edx
add eax, dword [ebp - 0x57]
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
movzx eax, word [ebp - 0x63]
and ax, 8
cmp ax, 8
jne 0x4c97ef
add dword [ebp - 0x30], 0x10
adc dword [ebp - 0x2c], 0
cmp byte [ebp + 8], 0
jne 0x4c9821
lea eax, [ebp - 0xd4]
lea edx, [ebx + 0x12]
mov ecx, 0xff
call fcn.00405298
mov eax, dword [ebp - 0xd4]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
push 0x2b14
lea edx, [ebp - 0x69]
mov ecx, 0x1e
mov eax, dword [ebp - 0x10]
call fcn.004ca448
push 0x2b14
movzx ecx, word [ebp - 0x4f]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004ca448
push 0x2b0a
movzx ecx, word [ebp - 0x4d]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
cmp dword [ebp - 0x57], 0
jne 0x4c986d
mov eax, dword [ebx + 0x118]
mov dword [ebp - 0x57], eax
push 0x2b0d
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x57]
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
movzx eax, word [ebp - 0x63]
and ax, 8
cmp ax, 8
jne 0x4c98a3
push 0x2b0c
lea edx, [ebp - 0x79]
mov ecx, 0x10
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
dec esi
jne 0x4c962a
cmp byte [ebp + 8], 0
jne 0x4c98dd
lea edx, [ebp - 0xd8]
mov eax, 0x2c8f
call fcn.004c1404
mov eax, dword [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x3f]
xor edx, edx
push edx
push eax
mov ecx, 7
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
movzx esi, word [ebp - 0x41]
dec esi
test esi, esi
jl 0x4c9a8b
inc esi
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xbd], 0
je 0x4c9983
push 0
mov ecx, 0x2aff
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
jmp 0x4c9983
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 1
call fcn.004bfe4c
push edx
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 2
call fcn.004bfe4c
cmp edx, dword [esp + 4]
jne 0x4c9955
cmp eax, dword [esp]
pop edx
pop eax
je 0x4c9971
push 1
mov ecx, 0x2b05
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x150]
inc edx
mov eax, dword [ebp - 0x10]
call fcn.004c7e4c
mov edx, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov ecx, 0x2e
call fcn.0040a8d8
cmp eax, 0x2e
jne 0x4c991c
cmp dword [edi], 0x2014b50
je 0x4c99c1
push 1
mov ecx, 0x2b07
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
push 0x2b09
movzx ecx, word [edi + 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c90a0
cmp dword [ebp - 0x24], 0
jne 0x4c99f5
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c4]
mov edx, 1
call fcn.004bfe4c
mov dword [ebp - 0x3b], eax
lea eax, [ebp - 0xdc]
push eax
movzx ecx, word [edi + 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c8a30
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x34]
call fcn.004c523c
mov edx, eax
mov eax, dword [ebp - 0x34]
call fcn.0041bcfc
mov ebx, eax
mov eax, dword [ebx + 8]
mov dword [edi + 0x2a], eax
mov word [edi + 0x22], 0
push 0x2b15
mov edx, edi
mov ecx, 0x2e
mov eax, dword [ebp - 0x10]
call fcn.004ca448
push 0x2b15
movzx ecx, word [edi + 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004ca448
push 0x2b0b
movzx ecx, word [edi + 0x1e]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
push 0x2b0e
movzx ecx, word [edi + 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
inc dword [ebp - 0x24]
dec esi
jne 0x4c98f2
mov word [ebp - 0x45], 0
mov word [ebp - 0x47], 0
push 0x2b16
lea edx, [ebp - 0x4b]
mov ecx, 0x16
mov eax, dword [ebp - 0x10]
call fcn.004ca448
push 0
push 0x16
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1a8]
mov edx, 1
call fcn.004bfe4c
cmp edx, 0xffffffff
jne 0x4c9ae5
cmp eax, 0xffffffff
jne 0x4c9ae5
push 1
mov ecx, 0x2b00
mov dl, 1
mov eax, dword [0x4c1604]
call fcn.004c1784
call fcn.00404a54
push 0x2b0f
movzx ecx, word [ebp - 0x37]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004c9c90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9b6b
lea eax, [ebp - 0xc]
mov edx, dword [0x4c90dc]
call fcn.0040677c
cmp byte [ebp - 0x35], 0
je 0x4c9b91
push 0
push 0
push 0
xor ecx, ecx
mov dl, 3
mov eax, dword [ebp - 0x10]
call fcn.004c35b4
cmp dword [ebp - 0x34], 0
je 0x4c9b9f
lea eax, [ebp - 0x34]
call fcn.0041061c
mov eax, dword [ebp - 0x10]
add eax, 0x1a8
call fcn.004c06c4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c4]
test eax, eax
jle 0x4c9c04
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x138]
call fcn.0040aa18
mov eax, dword [ebp - 0x10]
add eax, 0x1c4
call fcn.004c06c4
cmp dword [ebp - 0x18], 0
je 0x4c9c04
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx]
mov dword [ebp - 0xbc], ebx
mov eax, dword [ebp - 0xbc]
call fcn.004054ec
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0x14]
call fcn.00405028
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x200], 0
mov eax, dword [ebp - 0x10]
call fcn.004c3e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9c66
lea eax, [ebp - 0xdc]
mov edx, 8
call fcn.0040504c
lea eax, [ebp - 0xb8]
mov edx, 4
call fcn.0040504c
lea eax, [ebp - 0xc]
mov edx, dword [0x4c90dc]
call fcn.0040677c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040504c
ret