Function at 0x49689d
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x58
mov eax, 0x4e6a46
call fcn.004b5417
mov eax, ecx
sub eax, 0xffffff80
xor esi, esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x60], esi
call fcn.004420c1
mov dword [ebp - 4], esi
push str.EEMarker.dll
lea ecx, [ebp - 0x54]
call fcn.00444b0f
lea ecx, [ebp - 0x5c]
call fcn.0040c7d0
mov byte [ebp - 4], 1
push esi
push esi
call fcn.00447055
mov ecx, eax
call fcn.0046d07f
mov dword [ebp - 0x4c], eax
cmp eax, 2
jne 0x49694d
lea ecx, [ebp - 0x2c]
call fcn.00461a45
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
call fcn.00463487
pop ecx
test al, al
je 0x496941
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004476b0
pop ecx
pop ecx
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x496926
mov eax, dword [eax + 4]
jmp 0x496929
add eax, 4
push eax
lea ecx, [ebp - 0x5c]
call fcn.00428d50
mov byte [ebp - 4], 2
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0040d590
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00461a66
cmp dword [0x53fe98], 1
mov ebx, 0x53fda0
mov edi, 0x50ea8c
mov esi, 0x80000001
jne 0x496a27
lea ecx, [ebp - 0x48]
call fcn.00461a45
mov byte [ebp - 4], 4
lea eax, [ebp - 0x50]
push eax
mov ecx, ebx
call fcn.00494782
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044a24a
pop ecx
pop ecx
mov byte [ebp - 4], 6
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x48]
call fcn.0040cf90
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
call fcn.0040d610
lea eax, [ebp - 0x48]
push eax
call fcn.0046366e
push dword [ebp - 0x54]
push 0x200
push str.FILE
call fcn.00493b26
add esp, 0x10
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push str.SOFTWARE360TotalSecurity360Connect
call fcn.0044bc85
mov byte [ebp - 4], 8
push esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 9
push eax
call fcn.0046f194
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00443c39
jmp 0x496a53
push dword [ebp - 0x54]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x496a3d
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x48]
call fcn.00461a45
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x48]
push eax
call fcn.0046366e
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00461a66
cmp byte [0x53fe3c], 0
je 0x496c2f
cmp dword [0x53fe98], 1
jne 0x496ab4
cmp dword [ebp - 0x4c], 0
je 0x496ab0
cmp dword [ebp - 0x4c], 2
jne 0x496aba
mov eax, dword [ebp - 0x5c]
cmp dword [eax - 0xc], 0
je 0x496aba
lea eax, [ebp - 0x50]
push eax
mov ecx, ebx
call fcn.00494782
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x60], 1
call fcn.0043f539
pop ecx
pop ecx
test al, al
je 0x496aba
mov bl, 1
jmp 0x496abc
cmp dword [ebp - 0x4c], 2
je 0x496ab0
xor bl, bl
mov dword [ebp - 4], 1
test byte [ebp - 0x60], 1
je 0x496ad5
and dword [ebp - 0x60], 0xfffffffe
lea ecx, [ebp - 0x50]
call fcn.0040d610
test bl, bl
je 0x496c2f
lea eax, [ebp - 0x48]
push eax
call fcn.00455bed
pop ecx
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x18], 8
jb 0x496af6
mov eax, dword [eax + 4]
jmp 0x496af9
add eax, 4
push eax
lea ecx, [ebp - 0x50]
call fcn.0044bc85
mov byte [ebp - 4], 0xe
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040d590
push str._activity.log
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0xf
push dword [ebp - 0x4c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x496b43
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.qhconnect_profile.bmp
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x4c]
call fcn.004453ce
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x58]
call fcn.0040d610
push dword [ebp - 0x4c]
call ebx
test eax, eax
je 0x496b83
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push str.SOFTWARE360TotalSecurityUserProfile
call fcn.0044bc85
mov byte [ebp - 4], 0x12
push esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 0x13
push eax
call fcn.0046f194
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x20]
call fcn.00443c39
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push edi
call fcn.0044bc85
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.SOFTWARE360TotalSecurity360Connect
call fcn.0044bc85
mov byte [ebp - 4], 0x15
push esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x20]
call fcn.00443769
mov byte [ebp - 4], 0x16
push eax
call fcn.0046f194
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x20]
call fcn.00443c39
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x4c]
call fcn.0040d610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.0040d610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040d610
call fcn.004b549a
ret