Function at 0x48bec0
Capabilities:
Delete file
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ebfb2
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x19532], ebx
jne 0x48bf1b
call fcn.004836e0
test eax, eax
jne 0x48bf1b
mov ecx, esi
call fcn.00436d00
test al, al
jne 0x48bf1b
mov ecx, esi
call fcn.00438af0
test al, al
je 0x48bf50
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esi + 0x19626]
push ecx
mov ecx, esi
call edx
fcomp qword [0x4f6a28]
fnstsw ax
test ah, 0x41
jne 0x48c919
mov ecx, esi
mov dword [esi + 0x19532], ebx
call fcn.00437210
mov ecx, esi
call fcn.00438b30
cmp byte [esi + 0x19d06], bl
je 0x48c919
cmp dword [esi + 0x19536], ebx
jne 0x48c027
call fcn.00419310
add eax, 0x1da
push eax
lea ecx, [esp + 0x64]
call fcn.00444720
mov edi, dword [esp + 0x64]
cmp edi, ebx
mov dword [esp + 0x98], ebx
je 0x48bfef
mov ecx, dword [esp + 0x68]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x48bfef
push ebx
lea ecx, [esp + 0x64]
call fcn.0043fb10
mov ecx, dword [eax + 2]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0x74]
call fcn.00401380
push ebx
lea ecx, [esp + 0x64]
mov byte [esp + 0x9c], 1
call fcn.0043fb10
movzx edx, word [eax]
push ebx
push 0x42
push edx
lea eax, [esp + 0x7c]
push eax
mov ecx, esi
call fcn.004734a0
lea ecx, [esp + 0x70]
call fcn.004013f0
jmp 0x48c003
push ebx
push 0x42
push 0x2328
push 0x66f2dc
mov ecx, esi
call fcn.004734a0
cmp edi, ebx
mov dword [esp + 0x98], 0xffffffff
je 0x48c01b
push edi
call fcn.004aef39
add esp, 4
cmp dword [esi + 0x19536], ebx
je 0x48c477
cmp dword [esi + 0x1a2e0], ebx
je 0x48c0dc
push ebx
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
call fcn.0048e780
mov ecx, dword [esi + 0x19ce2]
add esp, 4
call fcn.00475840
cmp eax, ebx
jne 0x48c063
mov eax, dword [esi + 0x1a2e0]
mov word [eax + 0x14], 1
jmp 0x48c0b4
cmp dword [esi + 0x19836], ebx
mov edx, 1
jne 0x48c07a
mov eax, dword [esi + 0x1a2e0]
mov word [eax + 0x16], dx
mov ecx, dword [esi + 0x197b6]
mov eax, dword [esi + 0x197ba]
mov edi, ecx
or edi, eax
jne 0x48c098
mov eax, dword [esi + 0x1a2e0]
mov word [eax + 0x26], dx
jmp 0x48c0b4
cmp eax, dword [esi + 0x197b2]
ja 0x48c0b4
jb 0x48c0aa
cmp ecx, dword [esi + 0x197ae]
jae 0x48c0b4
mov eax, dword [esi + 0x1a2e0]
mov word [eax + 0x28], dx
mov edx, dword [esi + 0x1a2e0]
mov eax, dword [esi + 0x19536]
push ebx
push ebx
push 0x835
push ebx
push 0x838
push edx
push eax
mov ecx, esi
call fcn.0047b8f0
mov dword [esi + 0x1a2e0], ebx
mov eax, dword [esi + 0x195e2]
mov edi, dword [eax]
xor ecx, ecx
lea ebp, [esi + 0x195de]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebp
jmp 0x48c140
cmp ebp, ecx
mov edx, dword [esi + 0x195e2]
lea eax, [esi + 0x195de]
mov dword [esp + 0x64], edx
je 0x48c158
cmp ebp, eax
je 0x48c15f
call fcn.004c000c
xor ecx, ecx
cmp edi, dword [esp + 0x64]
je 0x48c31a
cmp ebp, ecx
jne 0x48c172
call fcn.004c000c
cmp edi, dword [ebp + 4]
jne 0x48c17c
call fcn.004c000c
mov eax, dword [edi + 0x12]
add dword [esp + 0x28], eax
cmp edi, dword [ebp + 4]
jne 0x48c18d
call fcn.004c000c
mov ecx, dword [edi + 0x2a]
add dword [esp + 0x3c], ecx
mov edx, dword [edi + 0x2e]
adc dword [esp + 0x40], edx
cmp edi, dword [ebp + 4]
jne 0x48c1a5
call fcn.004c000c
movzx eax, word [edi + 0x10]
cmp eax, 4
ja case.default.0x48c1b2
jmp dword [eax*4 + 0x48c930]
lea ecx, [esp + 0x34]
call fcn.004108b0
mov eax, dword [eax + 6]
add dword [esp + 0x30], eax
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ecx, dword [eax + 0xa]
add dword [esp + 0x1c], ecx
lea ecx, [esp + 0x34]
call fcn.004108b0
lea ecx, [esp + 0x34]
lea ebp, [eax + 0x1a]
call fcn.004108b0
mov edi, dword [eax + 0x16]
add edi, dword [ebp]
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ebp, dword [eax + 0x12]
lea ecx, [esp + 0x34]
add ebp, edi
call fcn.004108b0
mov edx, dword [eax + 0xe]
add edx, ebp
add dword [esp + 0x24], edx
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ecx, dword [eax + 0x1e]
add dword [esp + 0x44], ecx
mov edx, dword [eax + 0x22]
adc dword [esp + 0x48], edx
jmp case.default.0x48c1b2
lea ecx, [esp + 0x34]
call fcn.004108b0
mov eax, dword [eax + 6]
add dword [esp + 0x2c], eax
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ecx, dword [eax + 0xa]
add dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
call fcn.004108b0
lea ecx, [esp + 0x34]
lea ebp, [eax + 0x1a]
call fcn.004108b0
mov edi, dword [eax + 0x16]
add edi, dword [ebp]
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ebp, dword [eax + 0x12]
lea ecx, [esp + 0x34]
add ebp, edi
call fcn.004108b0
mov edx, dword [eax + 0xe]
add edx, ebp
add dword [esp + 0x20], edx
lea ecx, [esp + 0x34]
call fcn.004108b0
mov ecx, dword [eax + 0x1e]
add dword [esp + 0x4c], ecx
mov edx, dword [eax + 0x22]
adc dword [esp + 0x50], edx
jmp case.default.0x48c1b2
cmp edi, dword [ebp + 4]
jne 0x48c2ae
call fcn.004c000c
mov eax, dword [edi + 0x12]
add dword [esp + 0x14], eax
cmp edi, dword [ebp + 4]
jne 0x48c2bf
call fcn.004c000c
add ebx, dword [edi + 0x16]
cmp edi, dword [ebp + 4]
jne 0x48c2f4
call fcn.004c000c
cmp edi, dword [ebp + 4]
jne 0x48c2f4
call fcn.004c000c
cmp edi, dword [ebp + 4]
jne 0x48c2f4
call fcn.004c000c
cmp edi, dword [ebp + 4]
jne 0x48c2f4
call fcn.004c000c
cmp edi, dword [ebp + 4]
jne 0x48c2f4
call fcn.004c000c
mov ecx, dword [edi + 0x2a]
add dword [esp + 0x54], ecx
mov edx, dword [edi + 0x2e]
adc dword [esp + 0x58], edx
lea ecx, [esp + 0x34]
call fcn.0043ffd0
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
xor ecx, ecx
jmp 0x48c140
lea edi, [esi + 0x192ac]
push 0x504fe0
push edi
call fcn.00418ea0
push 0x54
call fcn.004aef0e
add esp, 0xc
test eax, eax
je 0x48c342
mov ecx, eax
call fcn.0048d3f0
jmp 0x48c344
xor eax, eax
mov ecx, dword [esi + 0x19686]
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x10], ecx
movzx ecx, word [esi + 0x196c4]
mov word [eax + 0x14], cx
movzx ecx, word [esi + 0x19ea0]
mov word [eax + 0x16], cx
mov ecx, dword [esp + 0x28]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x28], ecx
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x24], edx
mov dword [eax + 0x2c], ebx
jb 0x48c395
sub ecx, ebx
jmp 0x48c397
xor ecx, ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [esi + 0x197b6]
add ecx, dword [esi + 0x197ae]
mov edx, dword [esi + 0x197ba]
adc edx, dword [esi + 0x197b2]
add ecx, dword [esp + 0x3c]
push 0
adc edx, dword [esp + 0x44]
mov dword [eax + 0x34], ecx
mov ecx, dword [esp + 0x4c]
mov dword [eax + 0x38], edx
mov edx, dword [esp + 0x48]
push 0
mov dword [eax + 0x40], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 0x3c], edx
mov edx, dword [esp + 0x54]
push 0x835
mov dword [eax + 0x48], ecx
mov ecx, dword [esp + 0x64]
push 0
mov dword [eax + 0x44], edx
mov edx, dword [esp + 0x64]
push 0x837
mov dword [eax + 0x50], ecx
mov dword [eax + 0x4c], edx
mov edx, dword [esi + 0x19536]
push eax
push edx
mov ecx, esi
call fcn.0047b8f0
push 0x505038
push edi
call fcn.00418ea0
push 0x5050c8
push edi
call fcn.00418ea0
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push ebp
push eax
push ecx
push 0x505108
push edi
call fcn.00418ea0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
push ebx
push edx
push eax
push 0x505148
push edi
call fcn.00418ea0
add esp, 0x38
cmp ebp, ebx
jb 0x48c45a
sub ebp, ebx
jmp 0x48c45c
xor ebp, ebp
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push ebp
push ecx
push edx
push 0x505188
push edi
call fcn.00418ea0
add esp, 0x14
xor ebx, ebx
lea ebp, [esi + 0x192ac]
push 0x5051c8
push ebp
call fcn.00418ea0
mov eax, dword [esi + 0x196ce]
push eax
push 0x505254
push ebp
call fcn.00418ea0
mov ecx, dword [esi + 0x197b6]
add ecx, dword [esi + 0x197ae]
mov edx, dword [esi + 0x197ba]
adc edx, dword [esi + 0x197b2]
push edx
push ecx
push 0x505284
push ebp
call fcn.00418ea0
mov eax, dword [esi + 0x197c2]
mov ecx, dword [esi + 0x197be]
push eax
push ecx
push 0x5052bc
push ebp
call fcn.00418ea0
mov edx, dword [esi + 0x197ca]
mov eax, dword [esi + 0x197c6]
push edx
push eax
push 0x5052f4
push ebp
call fcn.00418ea0
add esp, 0x44
push 0x505330
push ebp
call fcn.00418ea0
mov ecx, dword [esi + 0x19f7e]
add esp, 8
cmp ecx, ebx
je 0x48c530
push ebx
push 0x64
call fcn.0040cac0
test al, al
je 0x48c52a
mov ecx, dword [esi + 0x19f7e]
cmp ecx, ebx
je 0x48c52a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x19f7e], ebx
cmp byte [esi + 0x1951c], 0
jne 0x48c548
cmp byte [esi + 0x19cd6], 0
je 0x48c64d
xor ebx, ebx
mov edi, dword [esi + 0x19ce2]
cmp edi, ebx
je 0x48c562
mov ecx, edi
call fcn.00446ab0
push edi
call fcn.004aef39
add esp, 4
mov ecx, dword [esi + 0x196ca]
movzx edx, word [esi + 0x196c4]
push ecx
lea edi, [esi + 0x1916a]
push edx
mov ecx, edi
mov dword [esi + 0x19ce2], 0
call fcn.0045d040
mov ebx, eax
call fcn.00419310
cmp dword [eax + 6], 0
je 0x48c59d
test ebx, ebx
jne 0x48c629
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
push ecx
mov ecx, esi
call fcn.00437d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edx
push eax
mov word [ecx + 4], dx
call fcn.00401640
lea edx, [esp + 0x94]
push edx
mov ecx, edi
call fcn.0045fdf0
mov ebx, 8
cmp dword [eax + 0x18], ebx
jb 0x48c5f3
mov eax, dword [eax + 4]
jmp 0x48c5f6
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x88], ebx
jb 0x48c613
mov eax, dword [esp + 0x74]
push eax
call fcn.004aef39
add esp, 4
mov ecx, dword [esi + 0x196ca]
movzx edx, word [esi + 0x196c4]
push ecx
push edx
mov ecx, edi
call fcn.0046f880
cmp byte [esi + 0x19cd6], 0
je 0x48c64d
mov ecx, dword [esi + 0x19e7e]
test ecx, ecx
je 0x48c64d
call fcn.00470900
mov dword [esi + 0x1971e], eax
mov dword [esi + 0x19722], edx
mov ecx, dword [esi + 0x19e7e]
test ecx, ecx
je 0x48c6ba
call fcn.00471900
test al, al
je 0x48c67e
mov ecx, dword [esi + 0x19e7e]
test ecx, ecx
je 0x48c672
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x19e7e], 0
jmp 0x48c6ba
push 0x5053e0
push 2
push ebp
mov dword [esi + 0x19e7e], 0
call fcn.00418e80
add esp, 0xc
call fcn.00419310
mov eax, dword [eax + 0x162]
and eax, 0x4000000
xor ecx, ecx
or eax, ecx
je 0x48c6ba
push 0x505428
mov ecx, esi
call fcn.00436c50
cmp dword [esi + 0x19518], 0
ja 0x48c6d0
cmp dword [esi + 0x19514], 0
jbe 0x48c892
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
lea ebp, [esi + 0x1916a]
push ecx
mov ecx, ebp
call fcn.0045d040
mov edi, eax
test edi, edi
je 0x48c762
mov word [edi + 0x50e], 0
cmp byte [esi + 0x1951c], 0
je 0x48c762
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
push eax
mov ecx, ebp
call fcn.0043fec0
mov ebx, eax
test ebx, ebx
je 0x48c762
mov ecx, ebx
mov dword [esp + 0x24], 0
call fcn.004402a0
test eax, eax
jbe 0x48c762
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.004402c0
movzx ecx, word [eax + 0x18]
cmp cx, 0x1000
jne 0x48c750
mov word [eax + 0x18], 3
add dword [esp + 0x24], 1
mov ecx, ebx
call fcn.004402a0
cmp dword [esp + 0x24], eax
jb 0x48c733
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
push eax
mov ecx, esi
call fcn.00437d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], bx
call fcn.00401640
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
cmp byte [esi + 0x19cd6], bl
je 0x48c7ff
cmp edi, ebx
je 0x48c892
sub esp, 0x1c
lea edx, [edi + 0x224]
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00401430
mov eax, dword [edi + 0x14]
mov edi, dword [edi + 0x18]
movzx ecx, word [esi + 0x196c4]
push edi
push eax
mov eax, dword [esi + 0x196ca]
push eax
push ecx
mov ecx, esi
call fcn.004877f0
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
push eax
mov ecx, ebp
call fcn.0045d040
mov edi, eax
cmp edi, ebx
je 0x48c892
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [edi + 0x5b6]
push eax
mov ecx, esi
call edx
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
sub esp, 0x1c
mov ebx, esp
mov dword [esp + 0x4c], esp
push eax
push ecx
mov ecx, esi
call fcn.00437d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edx
push eax
mov word [ecx + 4], dx
call fcn.00401640
push ebx
mov ecx, ebp
call fcn.0045fdf0
sub esp, 0x1c
add edi, 0x224
mov ecx, esp
mov dword [esp + 0x64], esp
push edi
mov dword [esp + 0xd4], 2
call fcn.00401430
mov ecx, esi
mov dword [esp + 0xd0], 0xffffffff
call fcn.00480c10
mov dx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
lea ecx, [esp + 0x54]
mov word [esp + 0x54], dx
push ecx
lea edx, [esp + 0x64]
xor edi, edi
push edx
lea ecx, [esi + 0x19ed4]
mov word [esp + 0x62], di
mov dword [esp + 0x5e], eax
call fcn.0047a5b0
lea eax, [esp + 0x54]
push eax
lea ecx, [esi + 0x19ee0]
call fcn.00482db0
push edi
mov ecx, esi
call fcn.00482e40
mov eax, dword [esi + 0x1953a]
cmp eax, edi
je 0x48c8fe
mov ecx, dword [eax + 0x24]
cmp ecx, edi
je 0x48c8f5
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esi + 0x1953a]
mov dword [ecx + 0x24], edi
cmp byte [esi + 0x19cf2], 0
je 0x48c90e
mov ecx, esi
call fcn.00438390
lea ecx, [esi + 0x196b6]
call fcn.00446c80
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret