Function at 0x4f646c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f6963
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1e], 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c5910]
call fcn.004c75b4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f6931
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
cmp dword [eax + 8], 0
jne 0x4f659a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
mov eax, dword [eax + 0x14]
mov edx, 0x4f697c
call fcn.004055f8
jne 0x4f6517
mov edx, 0x4f6988
mov eax, dword [ebp - 0xc]
call fcn.00511784
jmp 0x4f6524
mov edx, 0x4f69c4
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x270]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004c7424
test al, al
je 0x4f6560
mov edx, 0x4f6a08
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov byte [ebp - 0x1e], 1
jmp 0x4f671f
mov edx, 0x4f6a4c
mov eax, dword [ebp - 0xc]
call fcn.00511784
cmp dword [ebp - 0x24], 5
jne 0x4f6582
mov edx, 0x4f6a7c
mov eax, dword [ebp - 0xc]
call fcn.00511784
jmp 0x4f658c
push 0x1388
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 6
jne 0x4f652f
jmp 0x4f671f
push 0x4f6aac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f6ad0
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004c7364
sub al, 1
jb 0x4f661d
je 0x4f6694
dec al
je 0x4f665c
jmp 0x4f66ca
push 0x4f6adc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f6ad0
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov byte [ebp - 0x1e], 1
jmp 0x4f671f
push 0x4f6b20
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f6ad0
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
call fcn.00511784
jmp 0x4f66ca
push 0x4f6b50
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f6ad0
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
call fcn.00511784
cmp dword [ebp - 0x24], 5
jne 0x4f6708
push 0x4f6b80
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f6b98
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc]
call fcn.00511784
jmp 0x4f6712
push 0x1388
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 6
jne 0x4f65ef
cmp byte [ebp - 0x1e], 0
jne 0x4f672f
call fcn.00404be8
jmp 0x4f6938
mov byte [ebp - 0x1d], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x184]
lea eax, [ebp - 0x18]
mov ecx, 0x4f6bc0
call fcn.004054f8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
or ecx, 0xffffffff
mov edx, 0x4f6bdc
call fcn.004dc128
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x4f677f
call fcn.00404be8
jmp 0x4f6938
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 0x1c]
call fcn.004dbed0
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x28]
call fcn.00422ae8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
call fcn.00405280
push 0x4f6c08
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x24]
call fcn.00409cec
push dword [ebp - 0x50]
push 0x4f6c3c
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.0040556c
mov ecx, dword [ebp - 0x4c]
mov dx, 0x3e7
mov eax, dword [ebp - 0xc]
call fcn.005117ec
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x4fe27c
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004c6b90
sub al, 1
jb 0x4f68ff
je 0x4f681e
dec al
je 0x4f687d
jmp 0x4f690e
mov edx, 0x4f6c4c
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x25], 1
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x184]
lea eax, [ebp - 0x54]
mov ecx, 0x4f6c68
call fcn.004054f8
mov eax, dword [ebp - 0x54]
call fcn.0047b848
mov edx, eax
mov eax, dword [ebp - 0x2c]
call fcn.0047b7a0
push ebp
call fcn.004f615c
pop ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x4f690e
call fcn.00404be8
jmp 0x4f6938
mov eax, dword [ebp - 0xc]
call fcn.004fd7fc
add eax, 0x100000
adc edx, 0
cmp edx, dword [ebp - 4]
jne 0x4f6899
cmp eax, dword [ebp - 8]
ja 0x4f68cf
jmp 0x4f689b
jg 0x4f68cf
mov dword [ebp - 0x14], 5
mov eax, dword [ebp - 0xc]
add eax, 0x238
mov edx, 0x4f6c7c
call fcn.0040523c
mov edx, 0x4f6cc0
mov eax, dword [ebp - 0xc]
call fcn.00511784
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x25], 0
call fcn.00404be8
jmp 0x4f6938
inc dword [ebp - 0x14]
cmp dword [ebp - 0x24], 5
jge 0x4f68e5
mov edx, 0x4f6d18
mov eax, dword [ebp - 0xc]
call fcn.00511784
push 0x1388
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x2c]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4f690e
mov edx, 0x4f6d54
mov eax, dword [ebp - 0xc]
call fcn.00511784
jmp 0x4f691b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 6
jne 0x4f67a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6938
mov eax, dword [ebp - 0x10]
call fcn.004042c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f696a
lea eax, [ebp - 0x54]
mov edx, 8
call fcn.0040520c
lea eax, [ebp - 0x2c]
call fcn.004051e8
lea eax, [ebp - 0x18]
call fcn.004051e8
ret