Function at 0x4d52b2
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x7263a2
call fcn.006db31c
sub esp, 0x668
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xd0]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4d52d6
mov eax, dword [esi]
lea ecx, [ebp - 0x324]
push ecx
push 1
push 0x72ddc0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4d530a
cmp byte [0x7ed364], al
je 0x4d5348
lea ecx, [ebp + 0xb]
call fcn.004cff1e
mov esi, eax
mov ecx, esi
call fcn.004ba5b3
jmp 0x4d5341
lea eax, [edi + 0x40]
cmp dword [eax + 0x14], 8
jb 0x4d5315
mov eax, dword [eax]
lea ecx, [ebp - 0x324]
push ecx
push eax
mov ecx, edi
call fcn.004d40a5
test al, al
jne 0x4d534f
cmp byte [0x7ed364], al
je 0x4d5348
lea ecx, [ebp + 0xb]
call fcn.004d18cd
mov esi, eax
mov ecx, esi
call fcn.004cc15a
push esi
call fcn.004cbae5
pop ecx
xor al, al
jmp 0x4d5543
push ebx
lea ecx, [ebp - 0x674]
call fcn.004cdde8
xor ebx, ebx
lea ecx, [ebp - 0x674]
push ebx
push 0xffffffffffffffff
push 0x4d4cca
mov dword [ebp - 4], ebx
call fcn.004bd7e4
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x94]
push 3
lea eax, [ebp - 0x324]
push eax
call fcn.004c7a39
push ebx
push ebx
push 2
push dword [ebp - 0x94]
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 1
call fcn.004bd5a7
test eax, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x90]
setne al
mov byte [ebp - 0xd], al
cmp dword [ebp - 0x94], ecx
je 0x4d53d4
push dword [ebp - 0x94]
call fcn.006e60fe
mov al, byte [ebp - 0xd]
pop ecx
test al, al
je 0x4d5409
cmp byte [0x7ed364], 0
je 0x4d5535
lea ecx, [ebp + 0xb]
call fcn.004d0339
mov esi, eax
mov ecx, esi
call fcn.004cc15a
lea eax, [ebp - 0x324]
push eax
push esi
call fcn.004cbae5
pop ecx
jmp 0x4d5534
cmp dword [esi + 0x14], 8
jb 0x4d5411
mov esi, dword [esi]
push 3
lea eax, [ebp - 0x114]
push esi
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], eax
call fcn.004c7a39
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
call fcn.004c7a39
push ebx
push dword [ebp - 0x118]
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 3
push dword [ebp - 0x94]
call fcn.004bd305
test eax, eax
lea eax, [ebp - 0x90]
setne byte [ebp - 0xd]
cmp dword [ebp - 0x94], eax
je 0x4d5487
push dword [ebp - 0x94]
call fcn.006e60fe
pop ecx
lea eax, [ebp - 0x114]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x118], eax
je 0x4d54a4
push dword [ebp - 0x118]
call fcn.006e60fe
pop ecx
cmp byte [ebp - 0xd], 0
je 0x4d54d1
cmp byte [0x7ed364], 0
je 0x4d54d4
lea ecx, [ebp - 0xd]
call fcn.004d1090
mov esi, eax
mov ecx, esi
call fcn.004d5fc8
push dword [ebp + 8]
push esi
call fcn.004cbae5
pop ecx
pop ecx
jmp 0x4d54d4
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x674]
call fcn.004bccc3
test eax, eax
je 0x4d5504
cmp byte [0x7ed364], 0
je 0x4d5504
lea ecx, [ebp + 0xb]
call fcn.004cf8f3
mov esi, eax
mov ecx, esi
call fcn.004ba51b
push esi
call fcn.004cbae5
pop ecx
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4d5535
cmp byte [0x7ed364], al
je 0x4d5535
lea ecx, [ebp + 0xb]
call fcn.004d1de9
mov esi, eax
mov ecx, esi
call fcn.004ba5ff
push esi
call fcn.004cbae5
pop ecx
lea ecx, [ebp - 0x674]
call fcn.00452f74
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4