Function at 0x4ef4a0
Capabilities:
Delete file
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x728]
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x74c
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea eax, [ebp - 0x728]
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_strlen]
mov dword [ebp - 0x734], eax
call eax
lea ecx, [ebp - 0x728]
lea ebx, [ecx + eax]
mov eax, 0x2a
lea ecx, [ebp - 0x214]
mov word [ebx], ax
mov eax, dword [sym.imp.kernel32.dll_GetLongPathNameA]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x728]
mov dword [esp], ecx
mov dword [esp + 8], 0x104
mov dword [ebp - 0x730], eax
call eax
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x480
xor eax, eax
test esi, esi
sete al
mov dword [esp + 4], str.GetLongPathNameA_should_fail_n
mov dword [esp], eax
call fcn.004e88d0
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x481
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5e8a58
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x7b
sete al
mov dword [ebp - 0x738], edi
lea edi, [ebp - 0x214]
mov dword [esp], eax
call fcn.004e88d0
lea edx, [ebp - 0x728]
mov byte [ebx + 0x14], 0
mov dword [ebx], 0x676e6f6c
mov dword [ebx + 4], 0x656c6966
mov dword [ebx + 8], 0x656d616e
mov dword [ebx + 0xc], 0x6e6f6c2e
mov dword [ebx + 0x10], 0x74786567
mov dword [esp], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x41
lea edx, [ebp - 0x214]
rep stosd dword es:[edi], eax
sub esp, 4
mov dword [esp + 4], edx
lea edx, [ebp - 0x728]
mov dword [esp], edx
mov dword [esp + 8], 4
mov edi, dword [ebp - 0x730]
call edi
lea edi, [ebp - 0x214]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
lea edx, [ebp - 0x728]
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x48c
mov dword [esp], edx
mov esi, dword [ebp - 0x734]
call esi
mov dword [esp + 4], str.Wrong_length_n
lea esi, [ebp - 0x110]
add eax, 1
cmp ebx, eax
setae al
movzx eax, al
mov dword [esp], eax
call fcn.004e88d0
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x48d
xor eax, eax
mov dword [esp + 4], str.Buffer_should_not_have_been_touched_n
cmp byte [ebp - 0x214], 0
sete al
add ebx, 4
mov dword [esp], eax
call fcn.004e88d0
xor eax, eax
mov ecx, 0x41
lea edx, [ebp - 0x728]
rep stosd dword es:[edi], eax
mov edi, esi
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 0x5c3f5c5c
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov ecx, dword [ebp - 0x738]
mov dword [ecx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x730]
call edi
sub esp, 0xc
mov edi, eax
mov eax, 0x499
call fcn.004e7d80
xor eax, eax
cmp ebx, edi
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], edi
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
mov dword [esp], eax
call fcn.004e88d0
mov dword [esp], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x730]
call edi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x49c
xor eax, eax
cmp ebx, edi
sete al
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
mov dword [esp], eax
call fcn.004e88d0
lea edx, [ebp - 0x214]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], 4
mov edi, dword [ebp - 0x730]
call edi
lea edi, [ebp - 0x41c]
sub esp, 0xc
mov esi, eax
mov eax, 0x49f
call fcn.004e7d80
xor eax, eax
cmp ebx, esi
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], esi
lea ebx, [ebp - 0x520]
mov dword [esp], eax
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
call fcn.004e88d0
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4a0
xor eax, eax
mov dword [esp + 4], str.Buffer_should_not_have_been_touched_n
cmp byte [ebp - 0x214], 0
sete al
mov dword [esp], eax
call fcn.004e88d0
mov edx, 0x5c5c
lea eax, [ebp - 0x72c]
mov byte [ebp - 0x51e], 0
mov word [ebp - 0x520], dx
mov dword [ebp - 0x72c], 0x102
mov dword [esp + 4], eax
lea eax, [ebp - 0x51e]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetComputerNameA]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, 0x5c
lea edx, [ebp - 0x214]
mov word [ebp + eax - 0x520], cx
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 4], edx
lea edx, [ebp - 0x728]
mov dword [esp], edx
mov dword [esp + 8], 0x104
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
lea edx, [ebp - 0x41c]
mov esi, dword [sym.imp.msvcrt.dll_strcpy]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], edx
call esi
lea edx, [ebp - 0x41c]
mov dword [esp], edx
mov edx, dword [ebp - 0x734]
call edx
movzx edx, byte [ebp - 0x214]
lea ecx, [ebp - 0x41c]
mov byte [ebp + eax - 0x41c], dl
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x41c]
mov edx, 0x5c24
mov edi, eax
add eax, ecx
lea ecx, [ebp - 0x214]
mov word [eax], dx
mov edx, dword [sym.imp.msvcrt.dll_strchr]
mov byte [eax + 2], 0
mov dword [esp], ecx
mov dword [esp + 4], 0x5c
mov dword [ebp - 0x73c], edx
call edx
add eax, 1
mov dword [esp + 4], eax
lea eax, [ebp + edi - 0x41a]
lea edi, [ebp - 0x624]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
lea eax, [ebp - 0x728]
mov dword [esp], eax
mov edi, dword [ebp - 0x730]
call edi
lea eax, [ebp - 0x624]
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
lea eax, [ebp - 0x624]
mov dword [esp], eax
mov edx, dword [ebp - 0x734]
call edx
movzx ecx, byte [ebp - 0x214]
mov byte [ebp + eax - 0x624], cl
lea eax, [ebp - 0x624]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, 0x5c24
mov ebx, eax
lea eax, [ebp - 0x624]
add eax, ebx
mov word [eax], cx
mov byte [eax + 2], 0
lea eax, [ebp - 0x214]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
mov edx, dword [ebp - 0x73c]
call edx
add eax, 1
mov dword [esp + 4], eax
lea eax, [ebp + ebx - 0x622]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov ebx, dword [ebp - 0x738]
lea eax, [ebp - 0x41c]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 0xc
mov esi, eax
test eax, eax
jne 0x4efa08
cmp dword [ebx + 0x34], 0x35
je 0x4efd58
lea eax, [ebp - 0x624]
mov dword [esp], eax
mov eax, dword [ebp - 0x734]
call eax
mov edi, dword [0x8f0770]
mov dword [ebp - 0x738], eax
lea ebx, [eax + 1]
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
xor ecx, ecx
test edi, edi
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4efa89
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4c4
xor eax, eax
cmp esi, ebx
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
call fcn.004e88d0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4efa50
lea eax, [ebp - 0x41c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x730]
call eax
mov edi, dword [0x8f0770]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
xor ecx, ecx
test edi, edi
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4efb29
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4c8
xor eax, eax
cmp ebx, esi
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
call fcn.004e88d0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4efaf0
mov eax, edx
mov ecx, 0x41
lea edi, [ebp - 0x318]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [ebp - 0x734]
call eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x318]
mov dword [esp + 4], eax
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [ebp - 0x730]
call eax
mov edi, dword [0x8f0770]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
xor ecx, ecx
test edi, edi
setne cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4efbe9
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4ce
xor eax, eax
cmp ebx, esi
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
call fcn.004e88d0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4efbb0
mov eax, 0x4cf
mov dword [ebp - 0x734], edx
lea edi, [ebp - 0x318]
call fcn.004e7d80
mov dword [esp + 4], str.Buffer_should_not_have_been_touched_n
xor eax, eax
cmp byte [ebp - 0x318], 0
sete al
mov dword [esp], eax
call fcn.004e88d0
mov eax, dword [ebp - 0x734]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x318]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [ebp - 0x730]
call eax
mov esi, dword [0x8f0770]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
xor ecx, ecx
test esi, esi
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiA]
mov edi, dword [eax + 0x10]
setne cl
mov dword [eax + 0x14], 1
lea edx, [edi + edi]
mov edi, dword [ebp - 0x738]
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x4efd27
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4d7
xor eax, eax
cmp ebx, edi
sete al
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Wrong_length__ld__expected__ld_n
call fcn.004e88d0
call fcn.0057d110
mov dword [eax], 0x5e82d4
mov dword [eax + 4], 0x4d8
lea eax, [ebp - 0x624]
mov dword [esp + 4], eax
lea eax, [ebp - 0x318]
mov dword [esp], eax
call esi
lea ecx, [ebp - 0x318]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x624]
movzx eax, al
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], str.Expected___s___got___s__n
call fcn.004e88d0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4efc98
lea eax, [ebp - 0x728]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4be
call fcn.004e7d80
mov dword [esp], str.UNC_with_computername_is_not_supported_n
call fcn.004e88a0
lea eax, [ebp - 0x728]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
jmp 0x4efd50