Function at 0x5b4cdc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x72c
push 0
push 0
dec ecx
jne 0x5b4ce4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x38e0]
mov ecx, 0xe36
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x38e4], eax
lea eax, [ebp - 0x38e0]
mov edx, dword [0x534884]
call fcn.00408544
xor eax, eax
push ebp
push 0x5b53ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x38e4]
cmp byte [eax + 0x34], 0
je 0x5b4d48
push 0
call sub.user32.dll_MessageBeep
push 0
call sub.user32.dll_MessageBeep
push 0
call sub.user32.dll_MessageBeep
jmp 0x5b539e
xor edx, edx
push ebp
push 0x5b5397
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x38e4]
mov byte [eax + 0x34], 1
mov byte [ebp - 0x38e5], 1
movzx eax, byte [ebp - 0x38dc]
mov byte [ebp - 0x38ed], al
cmp byte [ebp - 0x38ed], 0
je 0x5b4d91
mov cl, 1
movzx edx, byte [ebp - 0x38ed]
mov eax, dword [ebp - 0x38e4]
call fcn.005b5eac
mov eax, dword [ebp - 0x38e0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5b537f
inc ebx
mov dword [ebp - 0x38ec], 0
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x38ec]
mov eax, dword [ebp - 0x38e0]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x38f4]
mov ecx, dword [ebp - 4]
mov edx, 0x5b540c
call fcn.00407a4c
mov edx, dword [ebp - 0x38f4]
mov esi, dword [ebp - 0x38e4]
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b4e08
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5b4e08
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040693c
test eax, eax
je 0x5b4e11
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xe6
jl 0x5b4e49
mov byte [ebp - 0x38e5], 0
lea eax, [ebp - 0x38f8]
mov ecx, dword [ebp - 4]
mov edx, 0x5b542c
call fcn.00407a4c
mov edx, dword [ebp - 0x38f8]
mov esi, dword [ebp - 0x38e4]
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
jmp 0x5b5372
mov eax, dword [ebp - 4]
call fcn.00415640
test al, al
jne 0x5b4e86
mov byte [ebp - 0x38e5], 0
lea eax, [ebp - 0x38fc]
mov ecx, dword [ebp - 4]
mov edx, 0x5b5468
call fcn.00407a4c
mov edx, dword [ebp - 0x38fc]
mov esi, dword [ebp - 0x38e4]
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
jmp 0x5b5372
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 4]
call fcn.005a9088
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a9278
test al, al
je 0x5b501c
lea edx, [ebp - 0x3900]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a93f4
mov eax, dword [ebp - 0x3900]
call fcn.00415640
test al, al
jne 0x5b4feb
lea edx, [ebp - 0x3904]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a93f4
mov edx, dword [ebp - 0x3904]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00533a94
lea edx, [ebp - 0x3908]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a9348
mov esi, dword [ebp - 0x3908]
mov dword [ebp - 0x390c], esi
mov eax, dword [ebp - 0x390c]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x3914]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a95b0
push dword [ebp - 0x3914]
push 0x5b5490
push 0x5b54a0
lea eax, [ebp - 0x3910]
mov edx, 3
call fcn.00407b30
mov esi, dword [ebp - 0x3910]
mov dword [ebp - 0x390c], esi
mov eax, dword [ebp - 0x390c]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x391c]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a95b0
push dword [ebp - 0x391c]
push 0x5b5490
push 0x5b54c8
lea eax, [ebp - 0x3918]
mov edx, 3
call fcn.00407b30
mov esi, dword [ebp - 0x3918]
mov dword [ebp - 0x390c], esi
mov eax, dword [ebp - 0x390c]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a8f00
mov byte [ebp - 0x38e5], 0
lea eax, [ebp - 0x3920]
mov ecx, dword [ebp - 4]
mov edx, 0x5b54e8
call fcn.00407a4c
mov edx, dword [ebp - 0x3920]
mov esi, dword [ebp - 0x38e4]
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
jmp 0x5b5372
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a8da0
test al, al
jne 0x5b5059
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a8f00
mov byte [ebp - 0x38e5], 0
mov esi, dword [ebp - 0x38e4]
mov edx, 0x5b5518
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
jmp 0x5b5372
lea edx, [ebp - 0x3924]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a9348
mov eax, dword [ebp - 0x3924]
lea edx, [ebp - 0x38dc]
mov ecx, 0x3890
call fcn.005301bc
lea edx, [ebp - 0x392c]
mov eax, dword [0x642ae4]
mov eax, dword [eax]
call fcn.00503c28
mov eax, dword [ebp - 0x392c]
lea edx, [ebp - 0x3928]
call fcn.00415d14
mov ecx, dword [ebp - 0x3928]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 4]
call fcn.005a8be4
test al, al
jne 0x5b50e6
lea eax, [ebp - 0x3930]
mov ecx, dword [ebp - 4]
mov edx, 0x5b555c
call fcn.00407a4c
mov edx, dword [ebp - 0x3930]
mov esi, dword [ebp - 0x38e4]
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
lea eax, [ebp - 0x3934]
call fcn.0052f768
lea eax, [ebp - 0x3934]
mov edx, 0x5b5588
call fcn.0040798c
mov eax, dword [ebp - 0x3934]
push eax
push dword [ebp - 4]
push 0x5b5490
push 0x5b5588
lea eax, [ebp - 0x3938]
mov edx, 3
call fcn.00407b30
mov edx, dword [ebp - 0x3938]
pop eax
call fcn.00534284
lea eax, [ebp - 0x393c]
call fcn.0052f768
lea eax, [ebp - 0x393c]
mov edx, 0x5b55a4
call fcn.0040798c
mov eax, dword [ebp - 0x393c]
push eax
push dword [ebp - 4]
push 0x5b5490
push 0x5b55a4
lea eax, [ebp - 0x3940]
mov edx, 3
call fcn.00407b30
mov edx, dword [ebp - 0x3940]
pop eax
call fcn.00534284
push dword [ebp - 4]
push 0x5b5490
push 0x5b5588
lea eax, [ebp - 0x3944]
mov edx, 3
call fcn.00407b30
mov eax, dword [ebp - 0x3944]
mov edx, 7
call fcn.0041578c
push dword [ebp - 4]
push 0x5b5490
push 0x5b55a4
lea eax, [ebp - 0x3948]
mov edx, 3
call fcn.00407b30
mov eax, dword [ebp - 0x3948]
mov edx, 7
call fcn.0041578c
mov esi, dword [ebp - 0x38e4]
mov edx, 0x5b55c8
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
push dword [ebp - 4]
push 0x5b5490
push dword [ebp - 0x4c]
push 0x5b55ec
lea eax, [ebp - 8]
mov edx, 4
call fcn.00407b30
lea edx, [ebp - 0x394c]
mov eax, dword [0x642ae4]
mov eax, dword [eax]
call fcn.00503c28
mov eax, dword [ebp - 0x394c]
mov edx, dword [ebp - 8]
call fcn.00534284
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x38e4]
call fcn.005b615c
push dword [ebp - 4]
push 0x5b5490
push dword [ebp - 0x4c]
lea eax, [ebp - 0x3950]
mov edx, 3
call fcn.00407b30
mov eax, dword [ebp - 0x3950]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
push dword [ebp - 4]
push 0x5b5490
push dword [ebp - 0x4c]
lea eax, [ebp - 0x3954]
mov edx, 3
call fcn.00407b30
mov eax, dword [ebp - 0x3954]
call fcn.0040760c
push eax
mov eax, dword [ebp - 8]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp byte [ebp - 0x48], 0
je 0x5b52e1
cmp byte [ebp - 0x44], 0
je 0x5b52cd
cmp byte [ebp - 0x3c], 0
je 0x5b52cd
push 0x5b55fc
push 1
lea eax, [ebp - 0x3958]
lea edx, [ebp - 0x3c]
call fcn.004078dc
mov ecx, dword [ebp - 0x3958]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.005313c4
jmp 0x5b52e1
push 0x5b55fc
push 1
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005313c4
mov esi, dword [ebp - 0x38e4]
mov edx, 0x5b5618
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
mov dl, 1
mov eax, dword [0x42ff70]
call fcn.0043c560
mov esi, eax
lea eax, [ebp - 0x395c]
lea edx, [ebp - 0xb2]
call fcn.004078dc
mov edx, dword [ebp - 0x395c]
mov cx, 0x2c
mov eax, esi
call fcn.00532e20
mov eax, dword [ebp - 0x38e4]
mov edi, dword [eax + 0x58]
mov dword [edi + 0x10], esi
cmp byte [ebp - 0x38ed], 0
je 0x5b535a
lea edx, [ebp - 0x3960]
mov eax, dword [ebp - 0x38e4]
mov eax, dword [eax + 0x68]
call fcn.005a93f4
mov edx, dword [ebp - 0x3960]
mov eax, edi
mov cl, 1
call fcn.005a8388
mov eax, esi
call fcn.004054a4
mov esi, dword [ebp - 0x38e4]
mov edx, 0x5b5638
mov eax, dword [esi + 0x64]
call dword [esi + 0x60]
inc dword [ebp - 0x38ec]
dec ebx
jne 0x5b4db2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b539e
mov eax, dword [ebp - 0x38e4]
mov byte [eax + 0x34], 0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b53f1
lea eax, [ebp - 0x3960]
mov edx, 0x15
call fcn.00407578
lea eax, [ebp - 0x3908]
mov edx, 6
call fcn.00407578
lea eax, [ebp - 0x38e0]
mov edx, dword [0x534884]
call fcn.004083d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407578
ret