Function at 0x484a00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5631a1
mov eax, dword fs:[0]
push eax
sub esp, 0x56c
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x568], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x580]
mov dword fs:[0], eax
mov eax, dword [esp + 0x598]
mov edi, dword [esp + 0x590]
mov ebp, dword [esp + 0x594]
mov esi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x33c]
xor ebx, ebx
cmp eax, ebx
je 0x484a6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x33c], ebx
call fcn.005089db
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x484a89
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x588], ebx
cmp edi, ebx
je 0x484b60
mov ecx, dword [edi + 0x628]
mov dword [esi + 0xf8], ecx
mov edx, dword [edi + 0x608]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004061d0
mov edx, dword [0x5ec7b8]
mov ecx, dword [edx - 0xc]
add esp, 8
cmp ecx, ebx
jle 0x484b25
mov eax, dword [edi + 0x660]
cmp dword [eax - 0xc], ebx
jge 0x484aea
push 0x80070057
call fcn.00401340
movzx eax, word [eax]
cmp ax, 0x2f
je 0x484b25
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00401fb0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
jle 0x484b25
dec eax
push eax
lea ecx, [esp + 0x18]
call fcn.004132f0
cmp ax, 0x2f
je 0x484b25
push 0x2f
lea ecx, [esp + 0x18]
call fcn.00406090
mov eax, dword [edi + 0x660]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401fb0
mov eax, dword [esp + 0x14]
push 0x3a
push eax
mov dword [esp + 0x20], eax
call fcn.00540922
add esp, 8
lea ebp, [eax + 2]
cmp eax, ebx
jne 0x484b58
mov ebp, 0x57bc10
mov ebx, dword [edi + 0x608]
jmp 0x484b67
mov ebx, dword [esp + 0x59c]
lea edi, [esi + 0x338]
push edi
call fcn.0047b540
mov edx, dword [esi + 0xb0]
mov eax, dword [edi]
add esp, 4
push 1
push 0
push 0
push eax
mov ecx, esi
mov dword [esp + 0x2c], edx
mov dword [esi + 0xb0], 1
call fcn.004823e0
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xb0], ecx
test eax, eax
je 0x484c92
mov eax, dword [edi]
push ebp
push ebx
push eax
call fcn.00471090
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x20]
mov dword [esi + 0x2ac], eax
mov dword [esi + 0x2a8], eax
mov dword [esi + 0x2f4], eax
call fcn.00450760
mov ecx, dword [esi + 0x2f4]
mov edx, dword [esi + 0x2a8]
mov eax, dword [esi + 0x2ac]
mov dword [esp + 0x24], ecx
push edi
lea ecx, [esp + 0x34]
mov byte [esp + 0x58c], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call fcn.004060b0
xor ebx, ebx
cmp ebp, ebx
jne 0x484c14
xor eax, eax
jmp 0x484c2f
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x484c20
sub eax, edx
sar eax, 1
push eax
push ebp
lea ecx, [esp + 0x3c]
call fcn.00401e40
push ebx
lea ecx, [esp + 0x40]
call fcn.004457a0
push ebx
push 1
push ebx
push ebx
push 1
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
mov byte [esp + 0x5a0], 2
call fcn.004456d0
mov ebp, eax
cmp dword [0x5ed7dc], ebx
jne 0x484c74
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebp, ebx
jne 0x484ce5
lea ecx, [esp + 0x3c]
mov byte [esp + 0x588], 1
call fcn.004458d0
lea ecx, [esp + 0x20]
call fcn.00450850
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x588], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x484cb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x580]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x568]
xor ecx, esp
call fcn.0053f73f
add esp, 0x578
ret 0x10
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x18]
mov dword [esi + 0x2a8], ecx
push 0x208
lea ecx, [esp + 0x170]
push ecx
push ebp
mov dword [esi + 0x2ac], edx
mov dword [esi + 0x2f4], eax
mov dword [esi + 0xb0], 1
call fcn.00407250
add esp, 0xc
test eax, eax
je 0x484d34
lea edx, [esp + 0x16c]
mov ebp, edx
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
push 1
push ebp
mov ecx, esi
call edx
mov ecx, esi
call fcn.004748c0
cmp dword [esi + 0x60], ebx
je 0x484d9a
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
call edx
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call edx
cmp eax, ebx
je 0x484d9a
mov ecx, eax
call fcn.00504314
mov edi, eax
cmp edi, ebx
je 0x484d9a
mov eax, dword [esi]
mov edx, dword [eax + 0x58]
mov ecx, esi
call edx
mov ecx, dword [0x5ed0c0]
neg eax
sbb eax, eax
neg eax
push eax
push edi
add ecx, 0x15d4
call fcn.004cd810
mov dword [esi + 0x64], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x60], ebx
cmp dword [esi + 0xc0], ebx
je 0x484db9
push ebx
push 1
push ebp
mov ecx, esi
call fcn.00484980
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
call edx
mov dword [esp + 0x38], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call edx
cmp eax, ebx
je 0x484df8
mov ecx, dword [esi + 0xf8]
mov edx, dword [esi + 0xf4]
push ebx
push 0xffffffffffffffff
push ecx
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, eax
call fcn.0048b410
lea ecx, [esp + 0x3c]
mov byte [esp + 0x588], 1
call fcn.004458d0
lea ecx, [esp + 0x20]
call fcn.00450850
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x588], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x484e3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x484cbb