Function at 0x4525e0
Capabilities:
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp qword [rbx + 0xad8], rdi
jne 0x45263e
lea rdx, [0x0047b0a0]
mov ecx, 0x34f8
call fcn.00422668
test rax, rax
je 0x452634
mov rcx, rax
call fcn.00451db4
jmp 0x452637
mov rax, rdi
mov qword [rbx + 0xad8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0xad8]
test rcx, rcx
je 0x452dd5
mov rax, qword [rcx]
call qword [rax + 0x60]
mov al, byte [rbx + 0xaf9]
mov esi, 0xc8
test al, al
jne 0x4529ff
mov rcx, qword [rbx + 0xad8]
lea rdx, str.https:__download.mql5.com_cdn_dns_dns.dat
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp eax, esi
jne 0x4529ff
mov rcx, qword [rbx + 0xad8]
lea rdx, [rbp + 0x330]
mov qword [rbp + 0x330], rdi
mov rax, qword [rcx]
call qword [rax + RegisterTypeLib]
mov r14, qword [rbp + 0x330]
mov qword [rbp + 0x338], rax
test rax, rax
je 0x452dc8
lea r13d, [rsi + 0x30]
cmp r14, r13
jb 0x452dc8
lea r12, [rbx + 0x120]
cmp word [r12], di
je 0x452dc8
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [rax + 0x10]
lea r15d, [rsi - 0x48]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
add rcx, r15
movups xmm0, xmmword [rax + 0x70]
add rax, r15
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
mov rax, qword [rax + 0x70]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov qword [rcx + 0x70], rax
cmp dword [rsp + 0x40], 2
jne 0x452dc8
lea ecx, [r15 - 0x77]
mov rdx, rdi
lea r8, str.Copyright
movzx eax, word [rdx + r8]
cmp word [rsp + rdx + 0x44], ax
jne 0x452dc8
add rdx, 2
sub rcx, 1
jne 0x452784
lea rdx, [0x004902a8]
lea rcx, [rbp - 0x3c]
call fcn.004373a8
test eax, eax
jne 0x452dc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or rsi, 0xffffffffffffffff
xor eax, eax
mov qword [rbp + 0x328], rsi
mov rdi, rsi
test r12, r12
je 0x4528ad
mov qword [rsp + 0x30], rax
lea r8d, [rsi + 4]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x328], rax
mov rdi, rax
cmp rax, rsi
je 0x4528ad
mov rbx, qword [rbp + 0x338]
xor esi, esi
mov r15d, esi
mov r12, r14
mov r13d, 0xfffffff
mov r8d, r12d
mov dword [rbp + 0x328], esi
cmp r12, r13
mov qword [rsp + 0x20], rsi
lea rdx, [r15 + rbx]
mov rcx, rdi
cmova r8d, r13d
lea r9, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x452862
mov eax, dword [rbp + 0x328]
add r15, rax
sub r12, rax
jne 0x452827
mov rbx, qword [rbp + 0x320]
mov rsi, 0xffffffffffffffff
mov r13d, 0xf8
mov rcx, rdi
cmp r15, r14
je 0x45289d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x120]
mov qword [rbp + 0x328], rsi
mov rdi, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4528ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rbp + 0x328], rsi
xor ecx, ecx
call fcn.004370d4
add qword [rbp + 0x338], 0xf8
mov r15, rax
mov qword [rbp + 0x320], rax
sub r14, r13
xor eax, eax
mov r12d, 0x288
mov dword [rbx + 0x550], eax
cmp r14, r12
jbe 0x452db1
mov rsi, qword [rbp + 0x338]
add r14, 0xfffffffffffffd77
movabs rax, 0x948b0fcd6e9e0653
mov r13d, 0x80
mul r14
sub r14, rdx
shr r14, 1
add r14, rdx
shr r14, 9
inc r14
xor edi, edi
mov rax, rsi
lea rcx, [rbp + 0x40]
mov edx, 5
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r13
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x452922
mov rax, qword [rax]
lea r8, [0x00489ec0]
mov qword [rcx], rax
mov edx, r12d
lea rcx, [rbp + 0x40]
call fcn.00460eb8
cmp word [rbp + 0x40], di
je 0x4529ed
cmp word [rbp + 0xc0], di
jne 0x45299d
cmp word [rbp + 0x1c0], di
je 0x4529ed
mov rax, qword [rbp + 0x2c0]
test rax, rax
je 0x4529ae
cmp rax, r15
jle 0x4529ed
lea r15, [rbx + 0x538]
mov edx, dword [r15 + 0x18]
mov rcx, r15
inc edx
call fcn.00403cbc
test al, al
je 0x4529e6
mov eax, dword [r15 + 0x20]
lea rdx, [rbp + 0x40]
mov r8d, eax
imul eax, dword [r15 + 0x18]
mov ecx, eax
add rcx, qword [r15 + 0x10]
call fcn.00424180
inc dword [r15 + 0x18]
mov r15, qword [rbp + 0x320]
add rsi, r12
sub r14, 1
jne 0x452916
jmp 0x452da6
mov rcx, qword [rbx + 0xad8]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov al, byte [rbx + 0xaf9]
test al, al
jne 0x452dc8
mov rcx, qword [rbx + 0xad8]
lea rdx, str.https:__download.metatrader.com_cdn_dns_dns.dat
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp eax, esi
jne 0x452dc8
mov rcx, qword [rbx + 0xad8]
lea rdx, [rbp + 0x330]
mov qword [rbp + 0x330], rdi
mov rax, qword [rcx]
call qword [rax + RegisterTypeLib]
mov r14, qword [rbp + 0x330]
mov qword [rbp + 0x338], rax
test rax, rax
je 0x452dc8
mov r13d, 0xf8
cmp r14, r13
jb 0x452dc8
lea r12, [rbx + 0x120]
cmp word [r12], di
je 0x452dc8
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [rax + 0x10]
lea r15d, [r13 - 0x78]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
add rcx, r15
movups xmm0, xmmword [rax + 0x70]
add rax, r15
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
mov rax, qword [rax + 0x70]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov qword [rcx + 0x70], rax
cmp dword [rsp + 0x40], 2
jne 0x452dc8
lea ecx, [r15 - 0x77]
mov rdx, rdi
lea r8, str.Copyright
movzx eax, word [rdx + r8]
cmp word [rsp + rdx + 0x44], ax
jne 0x452dc8
add rdx, 2
sub rcx, 1
jne 0x452b30
lea rdx, [0x004902a8]
lea rcx, [rbp - 0x3c]
call fcn.004373a8
test eax, eax
jne 0x452dc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or rsi, 0xffffffffffffffff
xor eax, eax
mov qword [rbp + 0x328], rsi
mov rdi, rsi
test r12, r12
je 0x452c59
mov qword [rsp + 0x30], rax
lea r8d, [rsi + 4]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x328], rax
mov rdi, rax
cmp rax, rsi
je 0x452c59
mov rbx, qword [rbp + 0x338]
xor esi, esi
mov r15d, esi
mov r12, r14
mov r13d, 0xfffffff
mov r8d, r12d
mov dword [rbp + 0x328], esi
cmp r12, r13
mov qword [rsp + 0x20], rsi
lea rdx, [r15 + rbx]
mov rcx, rdi
cmova r8d, r13d
lea r9, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x452c0e
mov eax, dword [rbp + 0x328]
add r15, rax
sub r12, rax
jne 0x452bd3
mov rbx, qword [rbp + 0x320]
mov rsi, 0xffffffffffffffff
mov r13d, 0xf8
mov rcx, rdi
cmp r15, r14
je 0x452c49
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x120]
mov qword [rbp + 0x328], rsi
mov rdi, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x452c59
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, rsi
mov qword [rbp + 0x328], rsi
xor ecx, ecx
call fcn.004370d4
add qword [rbp + 0x338], 0xf8
mov r15, rax
mov qword [rbp + 0x320], rax
sub r14, r13
xor eax, eax
mov r12d, 0x288
mov dword [rbx + 0x550], eax
cmp r14, r12
jbe 0x452db1
mov rsi, qword [rbp + 0x338]
add r14, 0xfffffffffffffd77
movabs rax, 0x948b0fcd6e9e0653
mov r13d, 0x80
mul r14
sub r14, rdx
shr r14, 1
add r14, rdx
shr r14, 9
inc r14
xor edi, edi
mov rax, rsi
lea rcx, [rbp + 0x40]
mov edx, 5
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r13
movups xmmword [rcx + 0x60], xmm0
add rcx, r13
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x452cce
mov rax, qword [rax]
lea r8, [0x00489ec0]
mov qword [rcx], rax
mov edx, r12d
lea rcx, [rbp + 0x40]
call fcn.00460eb8
cmp word [rbp + 0x40], di
je 0x452d99
cmp word [rbp + 0xc0], di
jne 0x452d49
cmp word [rbp + 0x1c0], di
je 0x452d99
mov rax, qword [rbp + 0x2c0]
test rax, rax
je 0x452d5a
cmp rax, r15
jle 0x452d99
lea r15, [rbx + 0x538]
mov edx, dword [r15 + 0x18]
mov rcx, r15
inc edx
call fcn.00403cbc
test al, al
je 0x452d92
mov eax, dword [r15 + 0x20]
lea rdx, [rbp + 0x40]
mov r8d, eax
imul eax, dword [r15 + 0x18]
mov ecx, eax
add rcx, qword [r15 + 0x10]
call fcn.00424180
inc dword [r15 + 0x18]
mov r15, qword [rbp + 0x320]
add rsi, r12
sub r14, 1
jne 0x452cc2
mov rdi, qword [rbp + 0x328]
or rsi, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, rsi
je 0x452dc8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xad8]
mov rax, qword [rcx]
call qword [rax + 0x18]
add rsp, 0x3d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret