Function at 0x47fa1c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x31
push 0
push 0
dec ecx
jne 0x47fa24
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0x145]
xor eax, eax
push ebp
push 0x48034d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
or esi, 0xffffffff
mov eax, dword [ebp - 0x28]
mov byte [eax + 0x1d2], 0
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x61]
call fcn.00404878
mov eax, dword [ebp - 8]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47faa5
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x173], 0
jne 0x47faa5
xor ecx, ecx
mov edx, 0x2776
mov eax, dword [ebp - 0x28]
call fcn.0047a7e8
jmp 0x480322
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b1]
call fcn.00404aa0
mov edi, eax
add edi, 0xc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b9]
call fcn.00404aa0
add edi, eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b5]
call fcn.00404aa0
add edi, eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c1]
call fcn.00404aa0
add edi, eax
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x3c]
add eax, 3
test eax, eax
jns 0x47faf8
add eax, 3
sar eax, 2
add eax, eax
add eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b1]
call fcn.00404aa0
cmp eax, 0xff
jg 0x47fb56
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b9]
call fcn.00404aa0
cmp eax, 0xff
jg 0x47fb56
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b5]
call fcn.00404aa0
cmp eax, 0xff
jg 0x47fb56
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c1]
call fcn.00404aa0
cmp eax, 0xff
jle 0x47fb93
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 0x3c]
inc eax
call fcn.00409034
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 0x480368
call fcn.00404aec
mov ecx, dword [ebp - 0x160]
mov edx, 0x2a31
mov eax, dword [ebp - 0x28]
call fcn.0047a7e8
jmp 0x480322
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0xc]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c7]
mov ecx, 1
mov edx, 1
call fcn.00404d00
mov eax, dword [ebp - 0x168]
mov edx, 0x4803b0
call fcn.00404bec
jne 0x47fc48
lea edx, [ebp - 0x170]
xor eax, eax
call fcn.00402b10
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.0040991c
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x2c7]
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
call fcn.00404aec
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x10]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
mov edx, 0x4803bc
call fcn.00404834
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x14]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
lea edx, [ebp - 0x178]
xor eax, eax
call fcn.00402b10
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.0040991c
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
mov ecx, 0x4803bc
call fcn.00404aec
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x18]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
push 0x104
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x17c]
mov edx, ebx
mov ecx, 0x105
call fcn.00404a50
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
mov ecx, 0x4803d0
call fcn.00404aec
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x1c]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
push 0x104
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x180]
mov edx, ebx
mov ecx, 0x105
call fcn.00404a50
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
mov ecx, 0x4803d0
call fcn.00404aec
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x20]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x16e]
mov eax, dword [ebp - 0x28]
add eax, 0x2c7
mov ecx, 0x4803d0
call fcn.00404aec
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x16e], 0
je 0x47fdd2
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x2c7]
call fcn.00404878
mov eax, dword [ebp - 0x24]
call fcn.004095fc
inc eax
setne al
test al, al
jne 0x47fde6
xor ecx, ecx
mov edx, 0x2a32
mov eax, dword [ebp - 0x28]
call fcn.0047a7e8
jmp 0x480322
xor eax, eax
push ebp
push 0x47fe0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x3c]
inc eax
call fcn.00402760
mov dword [ebp - 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47fe2d
mov eax, dword [ebp - 0x28]
call fcn.0047ac88
mov edx, dword [ebp - 0x3c]
inc edx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
call fcn.00403178
mov eax, dword [ebp - 0x40]
mov byte [eax], 0x4d
mov eax, dword [ebp - 0x40]
mov byte [eax + 1], 0x50
mov eax, dword [ebp - 0x40]
mov byte [eax + 2], 0x56
xor eax, eax
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 1
je 0x47fe67
mov al, 1
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 2
je 0x47fe75
or al, 2
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 8
je 0x47fe83
or al, 4
mov edx, dword [ebp - 0x28]
movzx edx, byte [edx + 0x2c6]
dec dl
je 0x47fe97
dec dl
je 0x47fe9b
jmp 0x47fe9d
or al, 8
jmp 0x47fe9d
or al, 0x10
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 0x10
jne 0x47feab
or al, 0x20
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 4
je 0x47feb9
or al, 0x40
mov edx, dword [ebp - 0x28]
test byte [edx + 0x2c5], 0x20
je 0x47fec7
or al, 0x80
mov edx, dword [ebp - 0x40]
mov byte [edx + 3], al
mov eax, dword [ebp - 0x40]
mov byte [eax + 5], 1
movzx eax, byte [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov byte [edx + 6], al
movzx eax, word [ebp - 0x3c]
movzx eax, ax
shr eax, 8
mov edx, dword [ebp - 0x40]
mov byte [edx + 7], al
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b1]
call fcn.00404aa0
mov ebx, eax
mov eax, dword [ebp - 0x40]
mov byte [eax + 8], bl
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x2b1]
mov eax, dword [ebp - 0x40]
add eax, 9
call fcn.00409bd0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b9]
call fcn.00404aa0
mov edx, dword [ebp - 0x40]
mov byte [edx + ebx + 9], al
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x2b9]
mov eax, dword [ebp - 0x40]
add eax, ebx
add eax, 0xa
call fcn.00409bd0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b9]
call fcn.00404aa0
add ebx, eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b5]
call fcn.00404aa0
mov edx, dword [ebp - 0x40]
mov byte [edx + ebx + 0xa], al
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x2b5]
mov eax, dword [ebp - 0x40]
add eax, ebx
add eax, 0xb
call fcn.00409bd0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2b5]
call fcn.00404aa0
add ebx, eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c1]
call fcn.00404aa0
mov edx, dword [ebp - 0x40]
mov byte [edx + ebx + 0xb], al
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c1]
call fcn.00404aa0
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x2c1]
mov eax, dword [ebp - 0x40]
add eax, ebx
add eax, 0xc
call fcn.00409bf4
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x173], 0
je 0x47ffe5
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x61]
call fcn.00404878
jmp 0x480048
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x61]
call fcn.00409a1c
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.00408acc
mov eax, dword [ebp - 0x184]
mov edx, 0x4803e4
call fcn.00404bec
je 0x480035
xor ecx, ecx
mov edx, 0x2a33
mov eax, dword [ebp - 0x28]
call fcn.0047a7e8
mov eax, dword [ebp - 0x40]
call fcn.00402780
jmp 0x480322
lea ecx, [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x61]
mov edx, 0x4803f4
call fcn.00409888
mov eax, dword [ebp - 4]
call fcn.004095fc
inc eax
je 0x480068
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x198]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
call fcn.0047c5c8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404ca0
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x48028f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c7]
mov edx, 0x20
call fcn.00409508
mov ebx, eax
cmp ebx, 0xffffffff
je 0x480105
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0047c888
mov dword [ebp - 0x2c], eax
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.004095b8
mov dword [ebp - 0x38], eax
mov eax, ebx
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x2c], 0
jne 0x48010c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2bd]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x48010c
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.0047f834
mov dword [ebp - 0x2c], eax
jmp 0x48010c
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x2c], 0
jne 0x480273
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
call fcn.0040958c
cmp eax, dword [ebp - 0x3c]
je 0x480130
mov dword [ebp - 0x2c], 0xfffffffe
cmp dword [ebp - 0x2c], 0
jne 0x480273
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x173], 0
je 0x480196
lea eax, [ebp - 0x15b]
xor ecx, ecx
mov edx, 0x16
call fcn.00403178
mov dword [ebp - 0x15b], 0x6054b50
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14b], eax
lea edx, [ebp - 0x15b]
mov ecx, 0x16
mov eax, dword [ebp - 0x30]
call fcn.0040958c
cmp eax, 0x16
je 0x480273
mov dword [ebp - 0x2c], 0xfffffffe
jmp 0x480273
xor eax, eax
push ebp
push 0x48024e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x15b]
mov cl, 1
mov eax, dword [ebp - 0x28]
call fcn.0047c994
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1b2]
xor ecx, ecx
xor edx, edx
call fcn.004095b8
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x1ad], 0
je 0x4801f9
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x1b2]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.0047c888
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1a9]
mov dword [ebp - 0x34], eax
jmp 0x480244
mov eax, dword [ebp - 0x14b]
push eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x1b2]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.0047c888
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x480238
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x15b]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
call fcn.004803fc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1a5]
mov dword [ebp - 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48025f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1b2]
cmp eax, 0xffffffff
je 0x480273
push eax
call sub.kernel32.dll_CloseHandle_1
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x30]
call fcn.004095b8
mov esi, eax
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x480296
mov dword [ebp - 0x2c], 0xffffffff
cmp dword [ebp - 0x2c], 0
jne 0x4802a8
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x173], 0
jne 0x48030c
cmp dword [ebp - 0x2c], 0
jne 0x4802d3
cmp dword [ebp - 0x38], 0xffffffff
je 0x4802cc
cmp dword [ebp - 0x34], 0xffffffff
je 0x4802cc
cmp esi, 0xffffffff
je 0x4802cc
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x3c]
cmp esi, eax
je 0x4802d3
mov dword [ebp - 0x2c], 0xfffffff7
cmp dword [ebp - 0x2c], 0
jne 0x4802fe
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + 0x198]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x61]
mov eax, dword [ebp - 0x28]
call fcn.0047c5c8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
call fcn.0047ab08
jmp 0x48030c
mov eax, dword [ebp - 4]
call fcn.00404ca0
push eax
call sub.kernel32.dll_DeleteFileA
cmp dword [ebp - 0x40], 0
je 0x48031a
mov eax, dword [ebp - 0x40]
call fcn.00402780
mov eax, dword [ebp - 0x28]
call fcn.0047acac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480354
lea eax, [ebp - 0x188]
mov edx, 0xb
call fcn.00404804
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00404804
ret