Function at 0x4a64e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x545726
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp + 0x54], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
mov dword [ebp + 0x1c], esi
mov eax, dword [0x59f554]
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x18], edi
test al, 1
jne 0x4a6554
or eax, 1
mov dword [0x59f554], eax
mov dword [ebp - 4], 0
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4a6569
cmp byte [eax + 0x19], 6
jb 0x4a6569
mov al, 1
jmp 0x4a656b
xor al, al
cmp byte [0x59f560], 0
jne 0x4a6585
cmp byte [0x59f561], 0
jne 0x4a6585
test al, al
je 0x4a66bb
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 2
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xc0
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b46c
mov ecx, eax
call fcn.0047f0b0
mov edx, str.CopyAtReboot
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 2
cmp dword [ebp + 0x50], 0x10
jb 0x4a6619
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6619
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x4a6636
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x4a6661
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 5
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 4
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x50], 0x10
jb 0x4a6684
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6684
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4a66b4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp + 0x38], 7
push 0xffffffffffffffff
push eax
xor ebx, ebx
mov word [ebp + 0x24], ax
push edi
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x34], ebx
call fcn.0047c390
push 1
push 0x57338c
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], 7
call fcn.004824e0
cmp dword [ebp + 0x38], 8
mov ecx, dword [ebp + 0x24]
jae 0x4a66fe
lea ecx, [ebp + 0x24]
cmp dword [edi + 0x14], 8
jb 0x4a670b
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
jmp 0x4a670e
mov dword [ebp + 0x10], edi
push 0x104
push ecx
lea ecx, [ebp + 8]
call fcn.00483c80
push 0x104
push dword [ebp + 0x10]
lea ecx, [ebp]
mov esi, dword [eax]
call fcn.00483c80
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp + 4]
mov esi, eax
test ecx, ecx
je 0x4a6749
push ecx
call fcn.00507b54
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a6759
push eax
call fcn.00507b54
add esp, 4
test esi, esi
je 0x4a67a2
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x4a6769
lea eax, [ebp + 0x24]
push 0x104
push eax
lea ecx, [ebp + 8]
call fcn.00483c80
push 4
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a6793
push eax
call fcn.00507b54
add esp, 4
mov ecx, dword [ebp + 0x1c]
mov edx, edi
call fcn.004a60b0
jmp 0x4a6aec
mov eax, dword [0x59f554]
test al, 1
jne 0x4a67cd
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 8
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4a67e2
cmp byte [eax + 0x19], 6
jb 0x4a67e2
mov al, 1
jmp 0x4a67e4
xor al, al
cmp byte [0x59f560], 0
jne 0x4a67fe
cmp byte [0x59f561], 0
jne 0x4a67fe
test al, al
je 0x4a6944
sub esp, 8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0xa
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xcb
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.MoveFile_failed_with_error_code
mov ecx, eax
call fcn.0047f0b0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0047b2d0
mov edx, str.__attempting_MoveFileEx
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0xa
cmp dword [ebp + 0x50], 0x10
jb 0x4a689f
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a689f
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4a68bc
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x4a68e7
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0xd
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0xc
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x50], 0x10
jb 0x4a690a
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a690a
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4a693d
mov dword [ebp - 4], 7
push 1
push 0x57338c
lea ecx, [ebp + 0x24]
call fcn.004824e0
mov ecx, dword [ebp + 0x1c]
lea edx, [ebp + 0x24]
call fcn.004a60b0
cmp dword [edi + 0x14], 8
jb 0x4a6966
mov edi, dword [edi]
cmp dword [ebp + 0x38], 8
mov ecx, dword [ebp + 0x24]
jae 0x4a6972
lea ecx, [ebp + 0x24]
push 5
mov edx, edi
call fcn.00483ed0
add esp, 4
test eax, eax
jne 0x4a6aec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x59f554]
mov dword [ebp + 0x20], ebx
test al, 1
jne 0x4a69bb
or dword [0x59f554], 1
mov byte [ebp - 4], 0xf
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4a69d0
cmp byte [eax + 0x19], 6
jb 0x4a69d0
mov al, 1
jmp 0x4a69d2
xor al, al
cmp byte [0x59f560], 0
jne 0x4a69ec
cmp byte [0x59f561], 0
jne 0x4a69ec
test al, al
je 0x4a6aec
sub esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x11
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xd0
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.MoveFileEx_failed_with_error_code
mov ecx, eax
call fcn.0047f0b0
push ebx
mov ecx, eax
call fcn.0047b2d0
mov byte [ebp - 4], 0x11
cmp dword [ebp + 0x50], 0x10
jb 0x4a6a79
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6a79
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x13
cmp dword [esi + 0x14], 0x10
jb 0x4a6a96
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
cmp dword [ebp + 0x50], 0x10
jb 0x4a6abb
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6abb
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x10
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4a6ae5
mov dword [ebp - 4], 7
mov eax, dword [0x59f554]
test al, 1
jne 0x4a6b16
or dword [0x59f554], 1
mov byte [ebp - 4], 0x15
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4a6b2b
cmp byte [eax + 0x19], 6
jb 0x4a6b2b
mov al, 1
jmp 0x4a6b2d
xor al, al
cmp byte [0x59f560], 0
jne 0x4a6b47
cmp byte [0x59f561], 0
jne 0x4a6b47
test al, al
je 0x4a6c6d
sub esp, 8
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x17
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xd3
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b498
mov ecx, eax
call fcn.0047f0b0
mov edx, str.CopyAtReboot
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0x17
cmp dword [ebp + 0x50], 0x10
jb 0x4a6bd8
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6bd8
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x19
cmp dword [esi + 0x14], 0x10
jb 0x4a6bf5
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x4a6c20
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x1a
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0x19
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x50], 0x10
jb 0x4a6c43
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6c43
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x16
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4a6c6d
cmp dword [ebp + 0x38], 8
jb 0x4a6c83
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4a6c83
push eax
call fcn.00507b54
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x54]
xor ecx, ebp
call fcn.005072fd
lea esp, [ebp + 0x58]
pop ebp
ret