Function at 0x4cdc47
Capabilities:
Check if file exists
Move file

Disassembly:
push 0x70
mov eax, 0x58774c
call fcn.004fb967
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00432a3a
mov byte [ebp - 4], 3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, str.2345
push esi
call fcn.0043479c
mov byte [ebp - 4], 4
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x34]
call fcn.0049bc11
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.0049be74
mov byte [ebp - 4], 6
push dword [ebp - 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x4cdcf9
lea ecx, [ebp - 0x7c]
call fcn.0049ac95
mov byte [ebp - 4], 7
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004b8169
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00433c20
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00499e4e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7c]
call fcn.0049acc5
call fcn.0049d8d4
push ecx
mov ecx, esp
cmp eax, 0x17
jl 0x4cdd49
mov dword [ebp - 0x18], esp
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar2345
call fcn.0043479c
mov byte [ebp - 4], 8
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
lea ecx, [ebp - 0x34]
call fcn.0049bb8c
mov byte [ebp - 4], 9
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0049be74
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x10]
call fcn.00433c20
jmp 0x4cdd8a
mov dword [ebp - 0x1c], esp
push str.MicrosoftInternet_ExplorerQuick_Launch2345
call fcn.0043479c
mov byte [ebp - 4], 0xc
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x34]
call fcn.0049bb8c
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0049be74
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x10]
call fcn.00433c20
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004310e3
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4cddde
lea ecx, [ebp - 0x7c]
call fcn.0049ac95
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004b8169
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00433c20
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00499e4e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7c]
call fcn.0049acc5
call fcn.0049d8d4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
cmp eax, 0x17
jl 0x4cde2e
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu2345
call fcn.0043479c
mov byte [ebp - 4], 0x11
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x34]
call fcn.0049bb8c
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0049be74
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x10]
call fcn.00433c20
jmp 0x4cde68
push esi
call fcn.0043479c
mov byte [ebp - 4], 0x15
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
lea ecx, [ebp - 0x34]
call fcn.004bab29
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0049be74
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x10]
call fcn.00433c20
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004310e3
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4cdebc
lea ecx, [ebp - 0x7c]
call fcn.0049ac95
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004b8169
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00433c20
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00499e4e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7c]
call fcn.0049acc5
lea ecx, [ebp - 0x4c]
call fcn.00432a3a
mov byte [ebp - 4], 0x1a
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall2345.com
call fcn.0043479c
mov byte [ebp - 4], 0x1b
push SysReAllocString
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4c]
call fcn.00434682
test eax, eax
je 0x4cdf69
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5acbb8
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.0043a8de
mov byte [ebp - 4], 0x1c
add esp, 8
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DisplayIcon
call fcn.0043479c
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4c]
call fcn.0043c86d
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push str._uninstall
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.0043a8de
mov byte [ebp - 4], 0x1e
add esp, 8
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.UninstallString
call fcn.0043479c
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4c]
call fcn.0043c86d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
call fcn.00432a92
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00432a92
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
call fcn.004fba3f
ret