Function at 0x4a5b10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x544ee6
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp + 0x54], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
mov dword [ebp + 0x1c], esi
mov eax, dword [0x59e598]
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x18], edi
test al, 1
jne 0x4a5b84
or eax, 1
mov dword [0x59e598], eax
mov dword [ebp - 4], 0
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4a5b99
cmp byte [eax + 0x19], 6
jb 0x4a5b99
mov al, 1
jmp 0x4a5b9b
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4a5bb5
cmp byte [0x59e5a9], 0
jne 0x4a5bb5
test al, al
je 0x4a5ceb
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 2
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xc0
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a46c
mov ecx, eax
call fcn.0047f130
mov edx, str.CopyAtReboot
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 2
cmp dword [ebp + 0x50], 0x10
jb 0x4a5c49
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a5c49
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x4a5c66
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x4a5c91
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 5
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 4
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x50], 0x10
jb 0x4a5cb4
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a5cb4
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4a5ce4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp + 0x38], 7
push 0xffffffffffffffff
push eax
xor ebx, ebx
mov word [ebp + 0x24], ax
push edi
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x34], ebx
call fcn.0047c410
push 1
push 0x57234c
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], 7
call fcn.00482560
cmp dword [ebp + 0x38], 8
mov ecx, dword [ebp + 0x24]
jae 0x4a5d2e
lea ecx, [ebp + 0x24]
cmp dword [edi + 0x14], 8
jb 0x4a5d3b
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
jmp 0x4a5d3e
mov dword [ebp + 0x10], edi
push 0x104
push ecx
lea ecx, [ebp + 8]
call fcn.00483d00
push 0x104
push dword [ebp + 0x10]
lea ecx, [ebp]
mov esi, dword [eax]
call fcn.00483d00
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp + 4]
mov esi, eax
test ecx, ecx
je 0x4a5d79
push ecx
call fcn.005074d4
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a5d89
push eax
call fcn.005074d4
add esp, 4
test esi, esi
je 0x4a5dd2
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x4a5d99
lea eax, [ebp + 0x24]
push 0x104
push eax
lea ecx, [ebp + 8]
call fcn.00483d00
push 4
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a5dc3
push eax
call fcn.005074d4
add esp, 4
mov ecx, dword [ebp + 0x1c]
mov edx, edi
call fcn.004a56e0
jmp 0x4a611c
mov eax, dword [0x59e598]
test al, 1
jne 0x4a5dfd
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 8
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4a5e12
cmp byte [eax + 0x19], 6
jb 0x4a5e12
mov al, 1
jmp 0x4a5e14
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4a5e2e
cmp byte [0x59e5a9], 0
jne 0x4a5e2e
test al, al
je 0x4a5f74
sub esp, 8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0xa
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xcb
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.MoveFile_failed_with_error_code
mov ecx, eax
call fcn.0047f130
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0047b350
mov edx, str.__attempting_MoveFileEx
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0xa
cmp dword [ebp + 0x50], 0x10
jb 0x4a5ecf
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a5ecf
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4a5eec
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x4a5f17
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0xd
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0xc
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x50], 0x10
jb 0x4a5f3a
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a5f3a
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4a5f6d
mov dword [ebp - 4], 7
push 1
push 0x57234c
lea ecx, [ebp + 0x24]
call fcn.00482560
mov ecx, dword [ebp + 0x1c]
lea edx, [ebp + 0x24]
call fcn.004a56e0
cmp dword [edi + 0x14], 8
jb 0x4a5f96
mov edi, dword [edi]
cmp dword [ebp + 0x38], 8
mov ecx, dword [ebp + 0x24]
jae 0x4a5fa2
lea ecx, [ebp + 0x24]
push 5
mov edx, edi
call fcn.00483f50
add esp, 4
test eax, eax
jne 0x4a611c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x59e598]
mov dword [ebp + 0x20], ebx
test al, 1
jne 0x4a5feb
or dword [0x59e598], 1
mov byte [ebp - 4], 0xf
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4a6000
cmp byte [eax + 0x19], 6
jb 0x4a6000
mov al, 1
jmp 0x4a6002
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4a601c
cmp byte [0x59e5a9], 0
jne 0x4a601c
test al, al
je 0x4a611c
sub esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x11
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xd0
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.MoveFileEx_failed_with_error_code
mov ecx, eax
call fcn.0047f130
push ebx
mov ecx, eax
call fcn.0047b350
mov byte [ebp - 4], 0x11
cmp dword [ebp + 0x50], 0x10
jb 0x4a60a9
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a60a9
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x13
cmp dword [esi + 0x14], 0x10
jb 0x4a60c6
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
cmp dword [ebp + 0x50], 0x10
jb 0x4a60eb
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a60eb
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x10
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4a6115
mov dword [ebp - 4], 7
mov eax, dword [0x59e598]
test al, 1
jne 0x4a6146
or dword [0x59e598], 1
mov byte [ebp - 4], 0x15
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4a615b
cmp byte [eax + 0x19], 6
jb 0x4a615b
mov al, 1
jmp 0x4a615d
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4a6177
cmp byte [0x59e5a9], 0
jne 0x4a6177
test al, al
je 0x4a629d
sub esp, 8
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 0x17
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..InstallHelper.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xd3
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a498
mov ecx, eax
call fcn.0047f130
mov edx, str.CopyAtReboot
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0x17
cmp dword [ebp + 0x50], 0x10
jb 0x4a6208
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6208
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x19
cmp dword [esi + 0x14], 0x10
jb 0x4a6225
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x4a6250
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0x1a
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0x19
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x50], 0x10
jb 0x4a6273
mov eax, dword [ebp + 0x3c]
test eax, eax
je 0x4a6273
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x16
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4a629d
cmp dword [ebp + 0x38], 8
jb 0x4a62b3
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4a62b3
push eax
call fcn.005074d4
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x54]
xor ecx, ebp
call fcn.00506c7d
lea esp, [ebp + 0x58]
pop ebp
ret