Function at 0x4b8c10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5338a4
mov eax, dword fs:[0]
push eax
mov eax, 0xa79c
call fcn.00520130
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0xa768], esi
cmp ecx, 0xa410
jge 0x4b8f1b
cmp ecx, 2
jne 0x4b8efc
lea ebx, [esi + 0x3610]
push ebx
call fcn.004c75b0
test al, al
je 0x4b8f2a
xor eax, eax
mov dword [ebp - 0xa7a4], eax
mov dword [ebp - method.CPipe.virtual_0], vtable.CPipe.0
mov dword [ebp - 0xa7a0], 0xffffffff
mov dword [ebp - 0xa79c], 0x400
mov dword [ebp - 0xa794], eax
mov dword [ebp - method.CEvent.virtual_0], vtable.CEvent.0
mov dword [ebp - 0xa790], eax
mov dword [ebp - 4], eax
call fcn.00508d00
push eax
lea eax, [ebp - 0xa7a8]
push eax
mov esi, str.ExeScanPostProcess
call fcn.004e8f50
mov ecx, dword [ebp - 0xa768]
mov byte [ecx + 0x360d], 1
xor edi, edi
mov dword [ebx + 0x20], 0xffffffff
cmp dword [ebx + 0xc], edi
jle 0x4b8d0e
mov edx, dword [ebx + 0x10]
cmp edx, dword [ebx + 0x14]
je 0x4b8d0e
mov ecx, dword [ebx + 0x14]
sub ecx, edx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jle 0x4b8d0e
mov dword [ebx + 0x20], edi
mov dword [ebp - 0xa774], edi
mov dword [ebp - 0xa770], edi
mov dword [ebp - 0xa76c], edi
mov dword [ebp - 0xa780], edi
mov dword [ebp - 0xa77c], edi
mov dword [ebp - 0xa778], edi
lea esi, [ebp - 0xa78c]
mov eax, ebx
mov byte [ebp - 4], 2
call fcn.0050e8f0
lea ecx, [ebp - 0xa774]
mov byte [ebp - 4], 3
call fcn.004fce50
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa78c]
cmp eax, edi
je 0x4b8d69
push eax
call fcn.005134a7
add esp, 4
lea eax, [ebp - 0xa780]
push eax
mov esi, ebx
call fcn.004c7920
mov ebx, dword [ebp - 0xa780]
cmp dword [ebp - 0xa770], edi
jle 0x4b8ec1
cmp dword [ebp - 0xa77c], edi
jle 0x4b8ec1
lea edx, [ebp - 0xa764]
call fcn.004e90a0
mov byte [ebp - 4], 4
call fcn.00508d00
lea ecx, [ebp - 0xa764]
call fcn.004e9960
cmp al, 1
jne 0x4b8e52
lea ecx, [ebp - 0xa764]
call fcn.004eae50
mov ecx, eax
cmp ecx, edi
je 0x4b8e52
mov esi, dword [ebp - 0xa768]
mov eax, dword [ecx + 8]
mov edi, dword [ecx + 4]
add esi, 0x2528
call fcn.004bcda0
mov ecx, ebx
test ebx, ebx
jne 0x4b8df3
mov ecx, 0x538640
mov eax, dword [ebp - 0xa774]
test eax, eax
jne 0x4b8e02
mov eax, 0x538640
push ecx
push eax
mov edi, esi
call fcn.004bce00
mov edi, dword [ebp - 0xa768]
push 0
lea ecx, [edi + 0x98c]
mov byte [edi + 0x3634], 1
call fcn.00503630
push 1
lea ecx, [edi + 0x98c]
call fcn.00503670
push 1
lea ecx, [edi + 0x98c]
call fcn.005036b0
mov edi, dword [edi + 0xc]
push 0
push 0
push 0x8370
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0xa774]
push ecx
lea ecx, [ebp - 0xa78c]
call fcn.004fc120
mov esi, 0x5388e8
lea eax, [ebp - 0xa78c]
mov byte [ebp - 4], 5
call fcn.004fcfb0
mov eax, dword [ebp - 0xa77c]
push ebx
lea edi, [ebp - 0xa78c]
call fcn.004fcc10
mov eax, dword [ebp - 0xa78c]
test eax, eax
jne 0x4b8e99
mov eax, 0x538640
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xa78c]
mov byte [ebp - 4], 4
call fcn.004fc190
lea edx, [ebp - 0xa764]
push edx
mov byte [ebp - 4], 2
call fcn.004e9510
xor edi, edi
mov byte [ebp - 4], 1
cmp ebx, edi
je 0x4b8ed2
push ebx
call fcn.005134a7
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xa774]
cmp eax, edi
je 0x4b8ee9
push eax
call fcn.005134a7
add esp, 4
lea esi, [ebp - 0xa7a8]
call fcn.004e8f10
mov esi, dword [ebp - 0xa768]
jmp 0x4b8f2a
cmp ecx, 1
jne 0x4b8f2a
mov byte [esi + 0x360d], 0
add esi, 0x3610
call fcn.004c7860
mov esi, dword [ebp - 0xa768]
jmp 0x4b8f2a
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00420ee0
call fcn.00448920
cmp byte [esi + 0x360d], 0
jne 0x4b8f38
call fcn.00448920
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 8