Function at 0x47ee34
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47f3ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xb8], edx
mov eax, dword [ebp - 8]
call fcn.0046a968
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 1
setne bl
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d], 0
je 0x47eead
mov eax, dword [ebp - 8]
test byte [eax + 0x62], 1
je 0x47eead
mov eax, dword [ebp - 8]
cmp dword [eax + 0x114], 0
jne 0x47eead
push 1
mov ecx, 0x283e
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
xor edx, edx
push ebp
push 0x47f1a4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.0047f670
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc4], 0
jne 0x47eee7
push 1
mov ecx, 0x2776
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x47ef4e
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 8
jne 0x47ef20
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 0x10
jne 0x47ef20
push 1
mov ecx, 0x283d
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
mov eax, dword [ebp - 8]
movzx edx, word [0x47f3bc]
not edx
and dx, word [eax + 0x61]
or dx, word [0x47f3c0]
mov eax, dword [ebp - 8]
mov word [eax + 0x61], dx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, 0x47f3cc
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x8c]
call fcn.00476744
mov esi, eax
cmp dword [esi + 0x2c], 0
jne 0x47ef74
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc4]
mov eax, esi
call fcn.0046f3f8
mov eax, dword [esi + 0x70]
xor edx, edx
call fcn.0046c104
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d], 0
je 0x47efaf
mov eax, dword [esi + 0x70]
call fcn.0046c0fc
test al, al
jne 0x47efaf
test bl, bl
je 0x47efaf
push 1
mov ecx, 0x2b11
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
mov eax, esi
call fcn.0047207c
test eax, eax
jne 0x47efdb
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 8
je 0x47efdb
push 1
mov ecx, 0x283d
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
mov eax, dword [esi + 0x70]
call fcn.0046c0fc
test al, al
jne 0x47efeb
test bl, bl
jne 0x47f055
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 4
je 0x47f00d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
call fcn.00409f70
mov eax, dword [ebp - 0x14]
call fcn.00467168
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
call fcn.00409f70
mov eax, dword [ebp - 0x18]
call fcn.00466d54
test al, al
jne 0x47f055
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
call fcn.00409f70
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, 0x2844
mov dl, 1
mov eax, dword [0x483548]
call fcn.0048379c
call fcn.00404900
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc4]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.0047aa28
test al, al
jne 0x47f08c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
push eax
mov ecx, 0x2b2b
mov dl, 1
mov eax, dword [0x483548]
call fcn.0048379c
call fcn.00404900
mov eax, dword [ebp - 8]
call fcn.0047d098
test eax, eax
jg 0x47f0a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f388
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc4]
call fcn.00405024
test bl, bl
je 0x47f0ec
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00479478
mov esi, eax
test esi, esi
je 0x47f0ec
mov eax, dword [ebp - 8]
call fcn.0047d0c8
push 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x483548]
call fcn.004836a0
call fcn.00404900
test bl, bl
jne 0x47f14d
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
call fcn.0040a094
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov esi, 0x47f3d8
test esi, esi
je 0x47f115
sub esi, 4
mov esi, dword [esi]
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x47f121
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 0x10]
call fcn.00405450
push eax
push esi
mov eax, 0x47f3d8
call fcn.00405450
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x47f14f
xor eax, eax
test al, al
je 0x47f19a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc4]
call fcn.00409cb0
test al, al
jne 0x47f19a
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc4]
mov eax, dword [ebp - 8]
call fcn.00478d00
mov esi, eax
test esi, esi
je 0x47f19a
mov eax, esi
call fcn.00466cc4
push eax
mov ecx, 0x2840
mov dl, 1
mov eax, dword [0x483548]
call fcn.0048374c
call fcn.00404900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f1e0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0046b200
xor eax, eax
push ebp
push 0x47f334
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47f2a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0047fa18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x6c
call fcn.00404f8c
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xec]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047d034
mov edx, dword [ebp - 8]
mov dword [edx + 0xb8], eax
mov eax, dword [ebp - 8]
add eax, 0x6c
call fcn.00404f8c
test bl, bl
je 0x47f29b
mov eax, dword [ebp - 8]
cmp dword [eax + 0xb8], 0
jl 0x47f28d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x8c]
cmp dword [eax + 4], 0
jle 0x47f278
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 8
jne 0x47f27c
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 0x10
jne 0x47f27c
xor ecx, ecx
jmp 0x47f27e
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004791f0
test al, al
je 0x47f29b
mov eax, dword [ebp - 4]
call fcn.00405450
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f2f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f33b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x11c]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047d9a0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f3b2
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404fb0
lea eax, [ebp - 4]
call fcn.00404f8c
ret