Function at 0x482388
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeec
mov byte [esp], al
lea esi, [esp + 0x10]
mov edi, dword [0x4bef50]
mov byte [esp + 1], 0
or ebp, 0xffffffff
mov dword [esp + 8], 0x2000
mov edx, dword [esp + 8]
mov eax, 0x40
call fcn.004066ec
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x4823e8
fild dword [esp + 8]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x48270b
mov eax, dword [esp + 4]
mov dword [esi], eax
mov edx, dword [0x4bebd8]
mov eax, dword [esi]
call fcn.004b81b0
add dword [esi], 0x20
mov eax, dword [edi]
lea edx, [eax + 0x108]
mov eax, dword [esi]
call fcn.004b81b0
add dword [esi], 0x40
mov eax, dword [edi]
cmp byte [eax + 0x160], 0
je 0x482427
mov edx, 1
mov eax, dword [esi]
call fcn.004aa478
mov edx, 2
mov eax, dword [esi]
call fcn.004aa478
mov eax, dword [edi]
cmp byte [eax + 0x161], 0
je 0x48244a
mov edx, 3
mov eax, dword [esi]
call fcn.004aa478
add dword [esi], 0xa0
add dword [esi], 0x300
mov eax, dword [esi]
mov word [eax], 4
add dword [esi], 2
mov eax, dword [edi]
mov eax, dword [eax + 0x158]
call fcn.004b8144
inc eax
mov edx, dword [esi]
mov dword [edx], eax
add dword [esi], 4
mov eax, dword [edi]
mov edx, dword [eax + 0x158]
mov eax, dword [esi]
call fcn.004b81b0
mov eax, dword [edi]
mov eax, dword [eax + 0x158]
call fcn.004b8144
inc eax
add dword [esi], eax
mov eax, dword [esi]
mov word [eax], 0xb
add dword [esi], 2
mov eax, dword [edi]
mov eax, dword [eax + 0x154]
call fcn.004b8144
inc eax
mov edx, dword [esi]
mov dword [edx], eax
add dword [esi], 4
mov eax, dword [edi]
mov edx, dword [eax + 0x154]
mov eax, dword [esi]
call fcn.004b81b0
mov eax, dword [edi]
mov eax, dword [eax + 0x154]
call fcn.004b8144
inc eax
add dword [esi], eax
mov eax, dword [esi]
mov word [eax], 0xd
add dword [esi], 2
mov eax, dword [esi]
mov dword [eax], 8
add dword [esi], 4
mov edx, dword [edi]
mov ecx, 8
mov eax, dword [esi]
call fcn.004066dc
add dword [esi], 8
mov eax, dword [edi]
cmp dword [eax + 0x150], 0
jle 0x48254e
mov eax, dword [edi]
lea ebx, [eax + 0x148]
mov eax, dword [ebx + 8]
add eax, 0x14
push eax
mov ecx, esi
lea edx, [esp + 0xc]
lea eax, [esp + 8]
call fcn.00481d8c
test al, al
je 0x48270b
mov eax, dword [esi]
mov word [eax], 0x10
add dword [esi], 2
mov eax, dword [ebx + 8]
mov edx, dword [esi]
mov dword [edx], eax
add dword [esi], 4
mov ecx, dword [ebx + 8]
mov edx, dword [ebx]
mov eax, dword [esi]
call fcn.004066dc
mov eax, dword [ebx + 8]
add dword [esi], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x164]
test ebx, ebx
je 0x482590
mov eax, dword [esi]
mov word [eax], 1
add dword [esi], 2
push esi
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
mov eax, ebx
call fcn.00481e30
test al, al
je 0x482670
mov eax, dword [esi]
mov word [eax], 0xffff
add dword [esi], 2
mov ebx, dword [ebx + 0x204]
test ebx, ebx
jne 0x48255a
mov eax, dword [esi]
mov word [eax], 0xffff
add dword [esi], 2
mov eax, dword [edi]
add eax, 8
call fcn.004b1914
test al, al
je 0x4825f8
mov eax, dword [edi]
lea edx, [eax + 8]
lea eax, [esp + 0x14]
call fcn.004b81b0
push 0x48271c
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_DeleteFileA_1
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi]
add eax, 8
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4825f8
lea edx, [esp + 0x14]
mov ax, 3
call fcn.004acdac
jmp 0x482670
push 0
mov eax, dword [edi]
add eax, 8
push eax
call sub.kernel32.dll__lcreat
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x48261c
mov eax, dword [edi]
lea edx, [eax + 8]
mov ax, 3
call fcn.004acdac
jmp 0x482670
mov eax, dword [esi]
sub eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push ebp
call sub.kernel32.dll__lwrite
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x14]
cdq
cmp edx, dword [esp + 4]
jne 0x48264e
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x482662
jmp 0x482652
pop edx
pop eax
jle 0x482662
mov eax, dword [edi]
lea edx, [eax + 8]
mov ax, 5
call fcn.004acdac
jmp 0x482670
mov byte [esp + 1], 1
mov eax, dword [edi]
mov byte [eax + 0x163], 0
cmp dword [esp + 4], 0
je 0x482680
mov eax, dword [esp + 4]
call fcn.004066fc
cmp ebp, 0xffffffff
je 0x48268b
push ebp
call sub.kernel32.dll_CloseHandle_1
cmp byte [esp + 1], 0
je 0x48270b
cmp byte [esp], 0
je 0x48270b
mov ax, 0x35d
call fcn.004aa600
mov edx, dword [edi]
add edx, 8
call fcn.004ae1b0
mov edx, dword [0x4bedb0]
mov eax, dword [0x4beb38]
call fcn.004b81b0
push 0x482724
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_lstrcatA
fild dword [esp + 0xc]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_lstrcatA
push 0x482728
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beb38]
mov edx, 4
call fcn.004b12a8
mov al, byte [esp + 1]
add esp, 0x114
pop ebp
pop edi
pop esi
pop ebx
ret