Function at 0x4e50e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
mov ecx, 0x5b8ac0
sub esp, 0x22c
call fcn.004ba5f0
mov edx, eax
mov eax, dword [0x5b464c]
and eax, 1
or eax, edx
jne 0x4e510d
cmp dword [0x5b4648], 1
je 0x4e5140
mov ecx, 0x5b8ac0
call fcn.004ba5f0
test eax, eax
je 0x4e512d
cmp byte [0x5b8e40], 0
js 0x4e512d
cmp dword [0x5b4648], 1
je 0x4e5190
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4e510d
cmp word [0x5b99e4], 0
je 0x4e5260
mov eax, dword [0x5c766c]
cmp eax, 1
je 0x4e5356
cmp eax, 2
je 0x4e5340
test eax, eax
je 0x4e5328
add eax, 1
xor edx, edx
cmp eax, 2
cmovg eax, edx
mov dword [0x5c766c], eax
jmp 0x4e510d
mov eax, dword [0x5b464c]
and eax, 1
or eax, dword [ebx + 0xc]
jne 0x4e512d
add ebx, 0x59
lea edi, [esp + 0x16]
lea esi, [esp + 0x11b]
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], ebx
mov dword [esp], esi
mov byte [esp + 0x11a], 0
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
mov byte [esp + 0x21f], 0
call sub.msvcrt.dll_strlen
lea edx, [eax + 8]
cmp edx, 0x103
jbe 0x4e538c
mov byte [esp + 0x11a], 1
mov ebx, 1
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edx, [eax + 9]
cmp edx, 0x103
ja 0x4e512d
add eax, esi
mov edx, 0x4d
mov dword [eax], 0x4f545541
mov dword [eax + 4], 0x56532e32
mov word [eax + 8], dx
or bl, byte [esp + 0x21f]
jne 0x4e512d
mov dword [esp], edi
mov ecx, 0x5ba360
call fcn.0049a070
sub esp, 4
test eax, eax
jne 0x4e53d1
mov dword [esp], str.AUTO.SVM
call fcn.004cee30
jmp 0x4e512d
lea esi, [ebx + 0x59]
lea edi, [esp + 0x16]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], esi
lea esi, [esp + 0x11b]
mov dword [esp], esi
mov byte [esp + 0x11a], 0
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
mov byte [esp + 0x21f], 0
call sub.msvcrt.dll_strlen
lea edx, [eax + 8]
cmp edx, 0x103
jbe 0x4e536c
mov byte [esp + 0x11a], 1
mov ebp, 1
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edx, [eax + 9]
cmp edx, 0x103
ja 0x4e512d
add eax, esi
mov ecx, 0x56
mov dword [eax], 0x4f545541
mov dword [eax + 4], 0x41532e32
mov word [eax + 8], cx
mov eax, ebp
or al, byte [esp + 0x21f]
jne 0x4e512d
mov dword [esp], edi
mov ecx, 0x5ba360
call fcn.0049a070
sub esp, 4
test eax, eax
jne 0x4e53ac
mov dword [esp], str.AUTO.SAV
call fcn.004cee30
jmp 0x4e510d
mov dword [esp], str.DEBUG1.SAV
call fcn.004cee30
mov eax, dword [0x5c766c]
jmp 0x4e5174
mov dword [esp], str.DEBUG3.SAV
call fcn.004cee30
mov eax, dword [0x5c766c]
jmp 0x4e5174
mov dword [esp], str.DEBUG2.SAV
call fcn.004cee30
mov eax, dword [0x5c766c]
jmp 0x4e5174
add eax, edi
mov dword [eax], 0x4f545541
mov dword [eax + 4], 0x5641532e
mov byte [eax + 8], 0
movzx ebp, byte [esp + 0x11a]
jmp 0x4e52ba
add eax, edi
mov dword [eax], 0x4f545541
mov dword [eax + 4], 0x4d56532e
mov byte [eax + 8], 0
movzx ebx, byte [esp + 0x11a]
jmp 0x4e51f7
mov dword [esp], esi
mov ecx, 0x5ba360
call fcn.0049a070
sub esp, 4
test eax, eax
jne 0x4e53f6
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_rename
jmp 0x4e5310
mov dword [esp], esi
mov ecx, 0x5ba360
call fcn.0049a070
sub esp, 4
test eax, eax
jne 0x4e5400
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_rename
jmp 0x4e524b
mov dword [esp], esi
call sub.msvcrt.dll_remove
jmp 0x4e53c0
mov dword [esp], esi
call sub.msvcrt.dll_remove
jmp 0x4e53e5