Function at 0x4deb60
Capabilities:
Delete file
Get file size
Get hostname
Get session user name
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xefc8
call fcn.00523cc0
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0xef84], ecx
mov dword [ebp - 0xef90], 0x135
mov byte [ebp - 0x414], 0
push 0x103
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.00527170
add esp, 0xc
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea ecx, [ebp - 0x20b]
push ecx
call fcn.00527170
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.00527170
add esp, 0xc
mov dword [ebp - 0xefc8], 0
mov dword [ebp - 0xefb0], 0
mov byte [ebp - 0x1f18], 0
push 0x1ff
push 0
lea eax, [ebp - 0x1f17]
push eax
call fcn.00527170
add esp, 0xc
mov byte [ebp - 0x518], 0
push 0x103
push 0
lea ecx, [ebp - 0x517]
push ecx
call fcn.00527170
add esp, 0xc
mov dword [ebp - 0xef98], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x204], 0
jne 0x4dec4e
mov eax, 0x69
jmp 0x4df8bf
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x22c]
test eax, eax
jne 0x4dec6f
mov eax, 0x64
jmp 0x4df8bf
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xef84]
call fcn.004e0a20
mov dword [ebp - 0xef90], eax
cmp dword [ebp - 0xef90], 0
je 0x4dec98
mov eax, dword [ebp - 0xef90]
jmp 0x4df8bf
push 8
push 0x57df88
call fcn.004d9ef0
add esp, 4
push eax
mov edx, dword [ebp + 8]
add edx, 0x22c
push edx
call fcn.005294d0
add esp, 0xc
test eax, eax
je 0x4decf3
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4decf3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x204]
push edx
mov eax, dword [ebp + 8]
add eax, 0x22c
push eax
mov ecx, dword [ebp - 0xef84]
call fcn.004ddf50
cmp eax, 1
jne 0x4decf3
mov eax, 0x6a
jmp 0x4df8bf
mov dword [ebp - 0xef90], 0x135
lea ecx, [ebp - 0xef80]
call fcn.004dcae0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x204]
mov dword [ebp - 0xef80], edx
mov eax, dword [ebp + 8]
add eax, 0x22c
push eax
lea ecx, [ebp - 0xef78]
push ecx
call fcn.004d9bf0
add esp, 8
movzx edx, byte [ebp + 0xc]
cmp edx, 1
jne 0x4ded44
mov dword [ebp - 0xef98], 0
jmp 0x4ded6a
sub esp, 0x268
mov ecx, 0x9a
lea esi, [ebp - 0xef80]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xef84]
call fcn.004de3b0
mov dword [ebp - 0xef98], eax
cmp dword [ebp - 0xef98], 1
jne 0x4deeff
mov eax, dword [ebp - 0xef84]
add eax, 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0xef84]
movzx edx, word [ecx + 0xa2]
push edx
mov eax, dword [ebp - 0xef84]
movzx ecx, word [eax + 0xa0]
push ecx
mov edx, dword [ebp - 0xef84]
movzx eax, word [edx + 0x9e]
push eax
mov ecx, dword [ebp - 0xef84]
movzx edx, word [ecx + 0x9c]
push edx
mov eax, dword [ebp - 0xef84]
movzx ecx, word [eax + 0x9a]
push ecx
mov edx, dword [ebp - 0xef84]
movzx eax, word [edx + 0x96]
push eax
mov ecx, dword [ebp - 0xef84]
movzx edx, word [ecx + 0x94]
push edx
push 0x57df98
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0041f000
add esp, 0x24
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + edx + 0x24c]
test ecx, ecx
je 0x4dee39
mov edx, dword [ebp + 8]
add edx, 0x24c
push edx
call fcn.004e12a0
add esp, 4
mov dword [ebp - 0xefb0], eax
jmp 0x4deeb1
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.00527170
add esp, 0xc
mov dword [ebp - 0xefbc], 0
lea ecx, [ebp - 0xefbc]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x108]
test edx, edx
jne 0x4dee9c
lea eax, [ebp - 0xefbc]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [ebp - 0x108]
push edx
call fcn.004e12a0
add esp, 4
mov dword [ebp - 0xefb0], eax
mov eax, dword [ebp - 0xefb0]
push eax
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x204]
push eax
push 0x57dfc0
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041f000
add esp, 0x14
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xef84]
call fcn.004dce60
jmp 0x4def11
mov dword [ebp - 0xefa0], 0
push 0x57dfd4
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x518]
push ecx
call fcn.004d9bf0
add esp, 8
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x518]
push edx
push 0x57df00
call fcn.004d9ef0
add esp, 4
push eax
mov eax, dword [ebp - 0xef84]
mov ecx, dword [eax + 0x84]
push ecx
mov edx, dword [ebp - 0xef84]
mov eax, dword [edx + 0x50]
call eax
mov dword [ebp - 0xefa0], eax
cmp dword [ebp - 0xefa0], 0
jne 0x4def95
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xca
jmp 0x4df8bf
mov byte [ebp - 0x1d18], 0
push 0x3ff
push 0
lea edx, [ebp - 0x1d17]
push edx
call fcn.00527170
add esp, 0xc
mov byte [ebp - 0xed18], 0
push 0xc7ff
push 0
lea eax, [ebp - 0xed17]
push eax
call fcn.00527170
add esp, 0xc
mov byte [ebp - 0x1918], 0
push 0x13ff
push 0
lea ecx, [ebp - 0x1917]
push ecx
call fcn.00527170
add esp, 0xc
mov dword [ebp - 0xefa8], 0
mov dword [ebp - 0xefb4], 0
mov dword [ebp - 0xef88], 0
mov dword [ebp - 0xefb8], 0
mov dword [ebp - 0xef9c], 0
mov dword [ebp - 0xef94], 0
mov dword [ebp - 0xef8c], 0
mov dword [ebp - 0xefac], 0
mov byte [ebp - 0x2118], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2117]
push edx
call fcn.00527170
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2518], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x2516]
push ecx
call fcn.00527170
add esp, 0xc
push 0x104
lea edx, [ebp - 0x2518]
push edx
mov eax, dword [ebp + 8]
add eax, 0x24c
push eax
call fcn.004d9c20
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x24c
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0x200
mov edx, dword [ebp + 8]
add edx, 0x24c
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x2518]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x57dff0
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x1d18]
push ecx
call fcn.0041f000
add esp, 8
mov edx, dword [ebp + 8]
add edx, 0x22c
push edx
push 0x57e048
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
push 0x1400
push 0
lea eax, [ebp - 0x1918]
push eax
call fcn.004d9af0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x204]
push edx
push 0x57e0a8
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x24c]
test eax, eax
je 0x4df1ed
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x24c
push edx
push 0x57e108
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x20]
test eax, eax
je 0x4df251
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
push 0x57e170
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0xa0]
test eax, eax
je 0x4df2bb
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0xa0
push edx
push 0x57e1d0
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x160]
test eax, eax
je 0x4df325
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x160
push edx
push 0x57e230
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x120]
test eax, eax
je 0x4df38f
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x120
push edx
push 0x57e290
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x1c0]
test eax, eax
je 0x4df3f9
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x1c0
push edx
push 0x57e2f0
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x208
je 0x4df456
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x208
push edx
push 0x57e350
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x228], 0
je 0x4df4b5
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x228]
push eax
push 0x57e3b0
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x1918]
push ecx
call fcn.0041f000
add esp, 0xc
lea edx, [ebp - 0x1918]
push edx
lea eax, [ebp - 0xed18]
push eax
call fcn.004d9b50
add esp, 8
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + edx + 0x1e0]
test ecx, ecx
je 0x4df51e
push 0x1400
push 0
lea edx, [ebp - 0x1918]
push edx
call fcn.004d9af0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x1e0
push eax
push 0x57e410
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x1918]
push ecx
call fcn.0041f000
add esp, 0xc
lea edx, [ebp - 0x1918]
push edx
lea eax, [ebp - 0xed18]
push eax
call fcn.004d9b50
add esp, 8
cmp dword [ebp - 0xef98], 1
jne 0x4df5b0
push 0x1400
push 0
lea ecx, [ebp - 0x1918]
push ecx
call fcn.004d9af0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x57e470
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 0xc
lea ecx, [ebp - 0x1918]
push ecx
lea edx, [ebp - 0xed18]
push edx
call fcn.004d9b50
add esp, 8
push 0x400
push 0
lea eax, [ebp - 0x1918]
push eax
call fcn.004d9af0
add esp, 0xc
push 0x57e508
call fcn.004d9ef0
add esp, 4
push eax
lea ecx, [ebp - 0x1918]
push ecx
call fcn.0041f000
add esp, 8
jmp 0x4df5e3
push 0x1400
push 0
lea edx, [ebp - 0x1918]
push edx
call fcn.004d9af0
add esp, 0xc
push 0x57e53c
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x1918]
push eax
call fcn.0041f000
add esp, 8
lea ecx, [ebp - 0xed18]
push ecx
call fcn.004d9c20
add esp, 4
mov dword [ebp - 0xefa8], eax
lea edx, [ebp - 0x1918]
push edx
call fcn.004d9c20
add esp, 4
mov dword [ebp - 0xefb4], eax
cmp dword [ebp - 0xef98], 0
je 0x4df71d
push 0
push 0x80
push 3
push 0
push 1
push accept
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xef9c], eax
cmp dword [ebp - 0xef9c], 0xffffffff
jne 0x4df671
mov ecx, dword [ebp - 0xefa0]
push ecx
mov edx, dword [ebp - 0xef84]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xcb
jmp 0x4df8bf
push 0
mov edx, dword [ebp - 0xef9c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xef88], eax
cmp dword [ebp - 0xef88], 0xffffffff
jne 0x4df699
mov dword [ebp - 0xef88], 0
cmp dword [ebp - 0xef88], 0x2ee000
jbe 0x4df6af
mov dword [ebp - 0xef88], 0
cmp dword [ebp - 0xef88], 0
je 0x4df710
mov dword [ebp - 0xefa4], 0
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xef9c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xefa4], eax
cmp dword [ebp - 0xefa4], 0
je 0x4df710
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0xefa4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xefac], eax
mov edx, dword [ebp - 0xefa4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xef9c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xefa8]
add ecx, dword [ebp - 0xef88]
add ecx, dword [ebp - 0xefb4]
mov dword [ebp - 0xefb8], ecx
mov edx, dword [ebp - 0xefb8]
push edx
call fcn.005238ab
add esp, 4
mov dword [ebp - 0xefc0], eax
mov eax, dword [ebp - 0xefc0]
mov dword [ebp - 0xef8c], eax
mov ecx, dword [ebp - 0xef8c]
mov dword [ebp - 0xef94], ecx
cmp dword [ebp - 0xef94], 0
jne 0x4df775
mov eax, 0xcc
jmp 0x4df8bf
mov edx, dword [ebp - 0xefa8]
push edx
lea eax, [ebp - 0xed18]
push eax
mov ecx, dword [ebp - 0xef94]
push ecx
call fcn.004d9a50
add esp, 0xc
mov edx, dword [ebp - 0xef8c]
add edx, dword [ebp - 0xefa8]
mov dword [ebp - 0xef8c], edx
cmp dword [ebp - 0xefac], 0
je 0x4df7e9
mov eax, dword [ebp - 0xef88]
push eax
mov ecx, dword [ebp - 0xefac]
push ecx
mov edx, dword [ebp - 0xef8c]
push edx
call fcn.004d9a50
add esp, 0xc
mov eax, dword [ebp - 0xef8c]
add eax, dword [ebp - 0xef88]
mov dword [ebp - 0xef8c], eax
mov ecx, dword [ebp - 0xefac]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0xefb4]
push edx
lea eax, [ebp - 0x1918]
push eax
mov ecx, dword [ebp - 0xef8c]
push ecx
call fcn.004d9a50
add esp, 0xc
mov edx, dword [ebp - 0xefb8]
push edx
mov eax, dword [ebp - 0xef94]
push eax
lea ecx, [ebp - 0x1d18]
push ecx
call fcn.004d9c20
add esp, 4
push eax
lea edx, [ebp - 0x1d18]
push edx
mov eax, dword [ebp - 0xefa0]
push eax
mov ecx, dword [ebp - 0xef84]
mov edx, dword [ecx + 0x54]
call edx
test eax, eax
je 0x4df84d
mov dword [ebp - 0xef90], 0
jmp 0x4df857
mov dword [ebp - 0xef90], 0xcd
cmp dword [ebp - 0xef94], 0
je 0x4df87b
mov eax, dword [ebp - 0xef94]
mov dword [ebp - 0xefc4], eax
mov ecx, dword [ebp - 0xefc4]
push ecx
call fcn.005238b4
add esp, 4
mov edx, dword [ebp - 0xefa0]
push edx
mov eax, dword [ebp - 0xef84]
mov ecx, dword [eax + 0x4c]
call ecx
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov ecx, dword [ebp - 0xef84]
call fcn.004dcdf0
jmp 0x4df8b9
mov eax, dword [ebp - 0xef90]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret 0xc