Function at 0x47a110
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2547
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x6385e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
lea ecx, [ebp - 0x44]
call fcn.00432460
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x12c]
add ecx, 0x60
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x60]
mov eax, dword [edx + 4]
call eax
push str.Results
lea ecx, [ebp - 0xa4]
call fcn.004b3550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x28
call fcn.004bb430
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.004b3860
mov edx, dword [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x28
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x28]
mov eax, dword [edx + 0x14]
call eax
push str.Success
lea ecx, [ebp - 0xb0]
call fcn.004b3550
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x28
call fcn.004bb430
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x14]
call edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.004b3860
push str.Pending
lea ecx, [ebp - 0xbc]
call fcn.004b3550
mov byte [ebp - 4], 3
lea eax, [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0x12c]
add ecx, 0x28
call fcn.004bb430
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x14]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.004b3860
push str.Failed
lea ecx, [ebp - 0xc8]
call fcn.004b3550
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x28
call fcn.004bb430
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x14]
call edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8]
call fcn.004b3860
push 0
lea ecx, [ebp - 0x1c]
call fcn.00432990
mov byte [ebp - 4], 5
push str.Group
lea ecx, [ebp - 0xd4]
call fcn.004b3550
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004bb6d0
mov ecx, eax
call fcn.004c1b80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd4]
call fcn.004b3860
mov dword [ebp - 0x30], str.Service
mov dword [ebp - 0x2c], str.Handle
mov dword [ebp - 0x28], str.Process
mov dword [ebp - 0x24], str.File
mov dword [ebp - 0x20], str.Registry
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx + 4]
neg eax
sbb eax, eax
and eax, 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0
jmp 0x47a320
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1c]
call fcn.004b9730
cmp dword [ebp - 0x48], eax
jge 0x47a86e
push 0x5fbfb4
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0046f100
mov ecx, dword [eax]
call fcn.004bbb70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x54]
call fcn.004553f0
push eax
push str.__s__r_n
call fcn.0054eca8
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x58], ecx
jmp 0x47a378
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 5
jae 0x47a85d
push 0
lea ecx, [ebp - 0x64]
call fcn.00432990
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + eax*4 - 0x30]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.004b3550
mov byte [ebp - 4], 9
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0046f100
mov ecx, dword [eax]
call fcn.004c1b80
xor edx, edx
test eax, eax
setg dl
mov byte [ebp - 0xd5], dl
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe4]
call fcn.004b3860
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x47a84c
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp + ecx*4 - 0x30]
push edx
push str.___s_r_n
call fcn.0054eca8
add esp, 8
mov dword [ebp - 0x130], str.Handle
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov ax, word [edx]
mov word [ebp - 0x136], ax
mov ecx, dword [ebp - 0x130]
cmp ax, word [ecx]
jne 0x47a482
cmp word [ebp - 0x136], 0
je 0x47a476
mov edx, dword [ebp - 0x134]
mov ax, word [edx + 2]
mov word [ebp - 0x138], ax
mov ecx, dword [ebp - 0x130]
cmp ax, word [ecx + 2]
jne 0x47a482
add dword [ebp - 0x134], 4
add dword [ebp - 0x130], 4
cmp word [ebp - 0x138], 0
jne 0x47a41c
mov dword [ebp - 0x13c], 0
jmp 0x47a48d
sbb edx, edx
sbb edx, 0xffffffff
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x47a4b6
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.0047ace0
jmp 0x47a84c
mov dword [ebp - 0x144], str.Process
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp + edx*4 - 0x30]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
mov dx, word [ecx]
mov word [ebp - 0x14a], dx
mov eax, dword [ebp - 0x144]
cmp dx, word [eax]
jne 0x47a533
cmp word [ebp - 0x14a], 0
je 0x47a527
mov ecx, dword [ebp - 0x148]
mov dx, word [ecx + 2]
mov word [ebp - 0x14c], dx
mov eax, dword [ebp - 0x144]
cmp dx, word [eax + 2]
jne 0x47a533
add dword [ebp - 0x148], 4
add dword [ebp - 0x144], 4
cmp word [ebp - 0x14c], 0
jne 0x47a4cd
mov dword [ebp - 0x150], 0
jmp 0x47a53e
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x154], edx
cmp dword [ebp - 0x154], 0
jne 0x47a567
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.0047ae50
jmp 0x47a84c
mov dword [ebp - 0x158], str.Service
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp + ecx*4 - 0x30]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x15c]
mov cx, word [eax]
mov word [ebp - 0x15e], cx
mov edx, dword [ebp - 0x158]
cmp cx, word [edx]
jne 0x47a5e4
cmp word [ebp - 0x15e], 0
je 0x47a5d8
mov eax, dword [ebp - 0x15c]
mov cx, word [eax + 2]
mov word [ebp - 0x160], cx
mov edx, dword [ebp - 0x158]
cmp cx, word [edx + 2]
jne 0x47a5e4
add dword [ebp - 0x15c], 4
add dword [ebp - 0x158], 4
cmp word [ebp - 0x160], 0
jne 0x47a57e
mov dword [ebp - 0x164], 0
jmp 0x47a5ef
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x168], ecx
cmp dword [ebp - 0x168], 0
jne 0x47a609
jmp 0x47a84c
mov dword [ebp - 0x16c], str.File
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp + edx*4 - 0x30]
mov dword [ebp - 0x170], eax
mov ecx, dword [ebp - 0x170]
mov dx, word [ecx]
mov word [ebp - 0x172], dx
mov eax, dword [ebp - 0x16c]
cmp dx, word [eax]
jne 0x47a686
cmp word [ebp - 0x172], 0
je 0x47a67a
mov ecx, dword [ebp - 0x170]
mov dx, word [ecx + 2]
mov word [ebp - 0x174], dx
mov eax, dword [ebp - 0x16c]
cmp dx, word [eax + 2]
jne 0x47a686
add dword [ebp - 0x170], 4
add dword [ebp - 0x16c], 4
cmp word [ebp - 0x174], 0
jne 0x47a620
mov dword [ebp - 0x178], 0
jmp 0x47a691
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], edx
cmp dword [ebp - 0x17c], 0
jne 0x47a7a0
mov dword [ebp - 0x68], 0
jmp 0x47a6bc
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x64]
call fcn.004b9730
cmp dword [ebp - 0x68], eax
jge 0x47a78c
push 0x5fc03c
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0x68]
push edx
lea ecx, [ebp - 0x64]
call fcn.0046f100
mov ecx, dword [eax]
call fcn.004bbb70
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 0xa
push 0
push 0x5fc034
mov ecx, dword [ebp - 0x184]
call fcn.004b4b20
mov byte [ebp - 0xe5], al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf4]
call fcn.004b3860
movzx ecx, byte [ebp - 0xe5]
test ecx, ecx
je 0x47a787
push str.path
lea edx, [ebp - 0x100]
push edx
mov eax, dword [ebp - 0x68]
push eax
lea ecx, [ebp - 0x64]
call fcn.0046f100
mov ecx, dword [eax]
call fcn.004bbb70
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x18c], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x44]
call fcn.00441810
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x100]
call fcn.004b3860
jmp 0x47a6b3
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.0047b000
jmp 0x47a84c
mov dword [ebp - 0x190], str.Registry
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp + ecx*4 - 0x30]
mov dword [ebp - 0x194], edx
mov eax, dword [ebp - 0x194]
mov cx, word [eax]
mov word [ebp - 0x196], cx
mov edx, dword [ebp - 0x190]
cmp cx, word [edx]
jne 0x47a81d
cmp word [ebp - 0x196], 0
je 0x47a811
mov eax, dword [ebp - 0x194]
mov cx, word [eax + 2]
mov word [ebp - 0x198], cx
mov edx, dword [ebp - 0x190]
cmp cx, word [edx + 2]
jne 0x47a81d
add dword [ebp - 0x194], 4
add dword [ebp - 0x190], 4
cmp word [ebp - 0x198], 0
jne 0x47a7b7
mov dword [ebp - 0x19c], 0
jmp 0x47a828
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
cmp dword [ebp - 0x1a0], 0
jne 0x47a84c
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.0047c510
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x64]
call fcn.004329e0
jmp 0x47a36f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54]
call fcn.004b3860
jmp 0x47a317
push str._Complete_r_n
call fcn.0054eca8
add esp, 4
mov ecx, dword [ebp - 0x12c]
add ecx, 0x60
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x60]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jle 0x47ab0d
mov ecx, dword [ebp - 0x12c]
add ecx, 0x5c
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [eax]
call edx
push eax
lea ecx, [ebp - 0x78]
call fcn.00432930
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x78]
call fcn.004b9730
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [edx]
call eax
movzx ecx, al
test ecx, ecx
je 0x47ab01
lea ecx, [ebp - 0x78]
call fcn.004b9730
mov dword [ebp - 0x1a8], eax
mov edx, dword [ebp - 0x1a8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [eax + 8]
call edx
push eax
lea ecx, [ebp - 0x84]
call fcn.004b34d0
mov byte [ebp - 4], 0xd
mov byte [ebp - 0x85], 1
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x47aaed
mov byte [ebp - 0x85], 0
lea ecx, [ebp - 0x84]
call fcn.004553f0
push eax
push str.Is_folder_empty__r_n_t_s_r_n
call fcn.0054eca8
add esp, 8
lea ecx, [ebp - 0x84]
push ecx
call fcn.004137d0
add esp, 4
movzx edx, al
test edx, edx
jne 0x47a979
push str._tfolder_not_found_r_n
call fcn.0054eca8
add esp, 4
jmp 0x47aae8
mov byte [ebp - 0x86], 0
mov ecx, dword [ebp - 0x12c]
add ecx, 0x48
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x48]
mov eax, dword [edx]
call eax
push eax
lea ecx, [ebp - 0x94]
call fcn.00432930
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x94]
call fcn.004b9730
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [edx]
call eax
movzx ecx, al
test ecx, ecx
je 0x47aa16
lea ecx, [ebp - 0x94]
call fcn.004b9730
mov dword [ebp - 0x1b0], eax
push 0
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [edx + 8]
call eax
mov ecx, eax
call fcn.004b4c90
movzx ecx, al
test ecx, ecx
je 0x47aa14
mov byte [ebp - 0x86], 1
jmp 0x47aa16
jmp 0x47a9a6
movzx edx, byte [ebp - 0x86]
test edx, edx
je 0x47aa33
push str._tNot_deleting_Shell_folder_r_n
call fcn.0054eca8
add esp, 4
jmp 0x47aad9
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.0047b3b0
movzx ecx, al
test ecx, ecx
je 0x47aa5b
push str._tFolder_has_files__r_n
call fcn.0054eca8
add esp, 4
jmp 0x47aad9
lea ecx, [ebp - 0x84]
call fcn.004553f0
push eax
push str.Empty_folder_detected___Deleting__r_n_t_s_r_n
call fcn.0054eca8
add esp, 8
push 1
lea edx, [ebp - 0x84]
push edx
call fcn.00413530
add esp, 8
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004131c0
add esp, 8
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x84]
call fcn.004b3890
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x10c]
call fcn.004b3860
mov byte [ebp - 0x85], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x94]
call fcn.00432970
jmp 0x47a922
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x84]
call fcn.004b3860
jmp 0x47a8bf
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x78]
call fcn.00432970
mov ecx, dword [ebp - 0x12c]
movzx edx, byte [ecx + 4]
test edx, edx
jne 0x47ac89
mov eax, dword [ebp - 0x12c]
movzx ecx, byte [eax + 5]
test ecx, ecx
je 0x47ab56
push str.Resetting_the_wallpaper_r_n
call fcn.0054eca8
add esp, 4
push str.Resetting_the_wallpaper_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 1
push 0x5ffc9c
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx + 6]
test eax, eax
je 0x47ab87
push str.Deploying_BootDeleter_r_n
call fcn.0054eca8
add esp, 4
push str.Deploying_BootDeleter_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x12c]
call fcn.004799e0
mov ecx, dword [ebp - 0x12c]
movzx edx, byte [ecx + 9]
test edx, edx
je 0x47abf2
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x118]
call fcn.004b3550
mov byte [ebp - 4], 0x10
push 1
lea eax, [ebp - 0x118]
push eax
call fcn.00414b70
add esp, 8
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x118]
call fcn.004b3860
cmp dword [ebp - 0x98], 0
je 0x47abf2
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 0xc]
push edx
push str.AutoRestartShell
mov ecx, dword [ebp - 0x98]
call fcn.00414980
mov eax, dword [ebp - 0x12c]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x47ac0c
mov dword [ebp - 0x1bc], 0x5fc034
jmp 0x47ac16
mov dword [ebp - 0x1bc], 0x5ff444
mov edx, dword [ebp - 0x1bc]
push edx
push str.reboot
mov ecx, dword [ebp - 0x34]
call fcn.004bbca0
mov eax, dword [ebp - 0x12c]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x47ac89
push str.Saving_crusader_file_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea edx, [ebp - 0x124]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.00479ed0
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1c4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004bb1d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x124]
call fcn.004b3860
lea ecx, [ebp - 0x44]
call fcn.004b9730
test eax, eax
jle 0x47aca1
lea edx, [ebp - 0x44]
push edx
call fcn.004af9f0
add esp, 4
mov byte [ebp - 0x125], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004329e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.004324a0
mov al, byte [ebp - 0x125]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4