Function at 0x447910
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e969
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1218
call fcn.004c2760
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
call fcn.004de17f
mov eax, dword [0x5580a0]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.004dd17f
push 0x5f
push 0x2f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004d371b
push 0x5f
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004d371b
lea edx, [ebp + 0xc]
push 0xe851
push edx
call fcn.0042e080
add esp, 8
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 4], 3
call fcn.004d3e8c
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.004dd111
mov eax, dword [ebp - 0x1c]
push 0
mov ebx, 6
push str.Executable_files__.exe_
push ebx
push eax
push 0x555ae0
push 0
lea ecx, [ebp - 0x228]
call fcn.004d43c0
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 4
call fcn.004d4522
cmp eax, 1
je 0x4479f0
mov byte [ebp - 4], 5
jmp 0x447bf8
call fcn.004f7db8
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x8c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004dd17f
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d3ae4
cmp eax, 0xffffffff
jne 0x447a28
push 0x55cdc0
lea ecx, [ebp - 0x14]
call fcn.004dd29a
jmp 0x447a5a
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004d3ae4
inc eax
lea edx, [ebp + 0xc]
push eax
push 0
push edx
lea ecx, [ebp - 0x14]
call fcn.004d392f
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004dd24a
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.004dd111
push str.newstub.exe
lea ecx, [ebp - 0x14]
call fcn.004dd4ed
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push eax
call fcn.004d45fd
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd111
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x228]
push edx
mov dword [ebp + 0xc], 0xffffffff
mov byte [ebp - 4], 8
call fcn.004d45fd
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004de331
lea ecx, [ebp - 0x30]
mov esi, eax
mov byte [ebp - 4], 8
call fcn.004dd111
test esi, esi
je 0x447be5
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1228]
push 0x1000
push eax
lea ecx, [ebp - 0x2c]
call fcn.004de44e
test eax, eax
je 0x447b79
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x1228]
inc eax
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x447b61
lea ecx, [ebp - 0x228]
sub ecx, ebx
push ecx
push 0x49
push ebx
call fcn.004c4910
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x447b61
cmp byte [ebx], 0
je 0x447b61
mov esi, str.IdOfSiteInSM
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447b55
test cl, cl
je 0x447b51
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447b55
add eax, 2
add esi, 2
test cl, cl
jne 0x447b31
xor eax, eax
jmp 0x447b5a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447b79
inc ebx
jmp 0x447b07
xor eax, eax
test eax, eax
jne 0x447b79
mov ecx, 0x400
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
jmp 0x447ae2
test ebx, ebx
je 0x447c4c
cmp byte [ebx], 0
je 0x447c4c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1228]
shl eax, 0xc
sub eax, ecx
push 0
add eax, ebx
lea ecx, [ebp - 0x2c]
push eax
call fcn.004de4d3
mov edx, dword [ebp + 8]
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x1228]
push 0x555ab8
push eax
call fcn.004c286d
add esp, 0xc
lea ecx, [ebp - 0x1228]
push 0xc
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004de488
lea ecx, [ebp - 0x2c]
call fcn.004de54c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 4
call fcn.004dd111
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.004dd111
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.004d8dd9
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004dd111
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004dd111
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004de274
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x2c]
call fcn.004de54c
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push edx
call fcn.004d45fd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd111
lea eax, [ebp + 0xc]
push 0xf2ae
push eax
call fcn.0042e080
add esp, 8
mov eax, dword [eax]
push 0
push 0
push eax
mov byte [ebp - 4], 0xa
call fcn.004e548e
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.004dd111
jmp 0x447be5