Function at 0x4b9b30
Capabilities:
Delete file
Get file size
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x86295b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x554
mov eax, dword [0x8ab26c]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x578]
mov esi, 1
cmp ebp, ebx
mov dword [esp + 0x56c], esi
je 0x4ba5a2
cmp word [ebp], bx
je 0x4ba5a2
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call fcn.00469e90
push 0x9b5220
lea ecx, [esp + 0x20]
mov byte [esp + 0x570], 2
call fcn.00617650
mov eax, dword [esp + 0x57c]
mov byte [esp + 0x56c], 3
cmp eax, ebx
je 0x4b9bc1
push eax
lea ecx, [esp + 0x20]
call fcn.006181a0
push 0x94b27c
lea ecx, [esp + 0x20]
call fcn.0061b8a0
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 8], ebx
jne 0x4b9c34
lea edx, [esp + 0x10]
push edx
call fcn.004b83e0
add esp, 4
push str.OEATemp_
lea ecx, [esp + 0x14]
mov byte [esp + 0x570], 4
call fcn.00618b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebp
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
push str._s_s_08X
push ecx
call fcn.0061aed0
add esp, 0x14
lea ecx, [esp + 0x10]
mov byte [esp + 0x56c], 3
call fcn.00617ec0
push 0x92edb8
lea ecx, [esp + 0x20]
call fcn.00618b00
mov edx, dword [esp + 0x1c]
push edx
call fcn.004b9330
add esp, 4
test eax, eax
jne 0x4b9c9f
push 0x326
push esi
call fcn.004b8630
mov edi, dword [esp + 0x57c]
add esp, 8
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00617440
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], esi
mov byte [esp + 0x56c], 2
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x56c], 1
call fcn.00469ec0
jmp 0x4ba5c7
push ebx
push ebx
push ebx
push ebp
call fcn.006791b0
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x4b9cfd
push 0x32d
push esi
call fcn.004b8630
mov edi, dword [esp + 0x57c]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00617440
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], esi
mov byte [esp + 0x56c], 2
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x56c], 1
call fcn.00469ec0
jmp 0x4ba5c7
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4b9d64
push 0x33d
push 3
call fcn.004b8630
mov edi, dword [esp + 0x57c]
add esp, 8
lea edx, [esp + 0x18]
mov ecx, edi
push edx
call fcn.00617440
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], esi
mov byte [esp + 0x56c], 2
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x56c], 1
call fcn.00469ec0
jmp 0x4ba5c7
mov dword [esp + 0x14], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x68], 0x898514
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x50], 0x898508
mov dword [esp + 0x54], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebx
lea eax, [esp + 0x3c]
mov byte [esp + 0x56c], 6
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x3c], eax
call esi
cmp edi, 4
jne 0x4ba009
mov dword [esp + 0x14], 1
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xa4]
mov dword [esp + 0xa0], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xa4]
push 1
push ecx
push ebx
push ebp
call esi
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xa0], eax
cmp eax, ecx
jne 0x4b9e18
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0x3c]
cmp edx, eax
je 0x4ba1d9
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0x1f5]
mov byte [esp + 0x1f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push ebx
lea eax, [esp + 0x1fc]
push ebx
push eax
push ebp
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4ba1d9
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
lea edx, [esp + 0x44]
push 1
push edx
push eax
push ebp
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
call esi
push str._OEAX_
lea ecx, [esp + 0x28]
call fcn.00617650
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x224]
push eax
push ecx
mov byte [esp + 0x574], 7
call fcn.005fc4b7
add esp, 8
cmp eax, ebx
jne 0x4b9f92
mov edx, dword [esp + 0x578]
push edx
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x10]
push eax
call fcn.00617650
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x574], 8
call fcn.004ba600
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x34]
push edx
mov byte [esp + 0x570], 9
call fcn.00617440
mov eax, dword [esp + 0x38]
mov byte [esp + 0x56c], 0xa
push eax
call fcn.004ba6d0
add esp, 4
test eax, eax
je 0x4b9f48
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
sub eax, edi
lea ecx, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0061a690
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x570], 0xb
call fcn.00618070
lea ecx, [esp + 0x20]
mov byte [esp + 0x56c], 0xa
call fcn.00617ec0
mov ecx, dword [esp + 0x34]
push 0x77
lea edx, [esp + 0x228]
push ecx
push edx
call fcn.005fc3ce
add esp, 0xc
lea ecx, [esp + 0x34]
mov byte [esp + 0x56c], 9
call fcn.00617ec0
lea ecx, [esp + 0x38]
mov byte [esp + 0x56c], 8
call fcn.00617ec0
lea ecx, [esp + 0x10]
mov byte [esp + 0x56c], 7
call fcn.00617ec0
mov esi, dword [esp + 0x58]
push 0xffffffffffffffff
lea ecx, [esp + 0x54]
lea eax, [esi + 1]
push eax
call fcn.004bf370
mov edx, dword [esp + 0x54]
lea edi, [esi + esi*8]
shl edi, 5
add edi, edx
mov ecx, 0x48
lea esi, [esp + 0x1f4]
push 0xffffffffffffffff
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x74]
lea ecx, [esi + 1]
push ecx
lea ecx, [esp + 0x70]
call fcn.004bf1f0
mov ecx, dword [esp + 0x6c]
lea edx, [esi + esi*2]
mov byte [esp + 0x56c], 6
lea eax, [esi + edx*4]
lea esi, [esp + 0xa0]
lea edi, [ecx + eax*4]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
call fcn.00617ec0
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4b9dd1
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xa4]
mov dword [esp + 0xa0], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x47
lea edi, [esp + 0xd5]
mov byte [esp + 0xd4], al
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push ebx
push ebx
push ebp
stosb byte es:[edi], al
mov dword [esp + 0x20], ebx
call fcn.006790d0
add esp, 0x10
test eax, eax
je 0x4ba31a
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4ba31a
push eax
call fcn.008325b4
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4ba306
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x20], ebx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
push ebp
call fcn.006790d0
add esp, 0x10
test eax, eax
je 0x4ba15e
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xe8], ebx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x44], ebx
mov dword [esp + 0xe4], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0xec], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xf8], ecx
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], eax
mov eax, dword [edx]
mov dword [esp + 0xd4], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0xd8], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0xdc], eax
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x578]
push edx
mov dword [esp + 0xe4], ecx
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x24]
push eax
call fcn.00617650
mov eax, dword [esp + 0x24]
push 0x77
lea ecx, [esp + 0x108]
push eax
push ecx
call fcn.005fc3ce
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.00617ec0
jmp 0x4ba16d
push 0x38a
push 3
call fcn.004b8630
add esp, 8
push esi
call fcn.008325dd
mov esi, dword [esp + 0x74]
add esp, 4
lea ecx, [esp + 0x68]
mov dword [esp + 0x14], 1
lea edx, [esi + 1]
push 0xffffffffffffffff
push edx
call fcn.004bf1f0
mov edx, dword [esp + 0x6c]
lea eax, [esi + esi*2]
push 0xffffffffffffffff
lea ecx, [esi + eax*4]
lea esi, [esp + 0xa4]
lea edi, [edx + ecx*4]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x54]
lea eax, [esi + 1]
push eax
call fcn.004bf370
mov eax, dword [esp + 0x54]
lea edi, [esi + esi*8]
shl edi, 5
add edi, eax
mov ecx, 0x48
lea esi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x8c], method.CCommandLineInfo.virtual_0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], ebx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x56c], 0xc
call fcn.0061ebd0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x94]
mov byte [esp + 0x574], 0xd
call fcn.00412650
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x84]
call fcn.0061eca0
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x74]
push ebx
push ecx
lea edx, [esp + 0x94]
push ebx
lea eax, [esp + 0xa8]
push edx
push eax
push ebp
mov dword [esp + 0x8c], ebx
call fcn.004b72f0
mov eax, dword [esp + 0xa8]
add esp, 0x28
cmp eax, ebx
jne 0x4ba299
mov eax, dword [esp + 0x58]
xor esi, esi
cmp eax, ebx
jle 0x4ba299
mov ecx, dword [esp + 0x80]
push 0x9b5220
push ecx
lea ecx, [esp + 0x84]
call fcn.0061f240
mov eax, dword [esp + 0x58]
inc esi
cmp esi, eax
jl 0x4ba277
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp ecx, ebx
mov dword [esp + 0x2c], esi
je 0x4ba2c2
cmp eax, ebx
jne 0x4ba2c2
push 0x3c7
push 3
mov dword [esp + 0x1c], ebx
call fcn.004b8630
add esp, 8
cmp dword [esp + 0x80], esi
je 0x4ba2de
push 0x3cd
push 1
mov dword [esp + 0x1c], ebx
call fcn.004b8630
add esp, 8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
mov eax, dword [edx - 8]
add eax, ecx
cmp eax, 0x103
jl 0x4ba32e
push 0x3d4
push 0x29
call fcn.004b8630
add esp, 8
jmp 0x4ba47c
push 0x380
push 3
call fcn.004b8630
add esp, 8
jmp 0x4ba1d9
push 0x379
push 3
call fcn.004b8630
add esp, 8
jmp 0x4ba1d9
cmp dword [esp + 0x14], ebx
je 0x4ba47c
lea ecx, [esp + 0x40]
call fcn.0061ebd0
test esi, esi
mov byte [esp + 0x56c], 0xe
jle 0x4ba40a
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x6c]
push 0
mov ecx, dword [eax + edi]
mov edx, dword [eax + edi + 4]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], edx
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00617440
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x14]
mov byte [esp + 0x56c], 0xf
lea eax, [edx + ebx*4]
push eax
call fcn.00618b60
mov ecx, dword [esp + 0x54]
lea edx, [ecx + esi + 0x30]
lea ecx, [esp + 0x14]
push edx
call fcn.00618b00
mov eax, dword [esp + 0x54]
mov ecx, dword [eax + esi + 0x2c]
mov edx, dword [eax + esi + 0x28]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push ebp
call fcn.004b9860
add esp, 0x10
test eax, eax
je 0x4ba552
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x48]
call fcn.0061f330
lea ecx, [esp + 0x14]
mov byte [esp + 0x56c], 0xe
call fcn.00617ec0
mov eax, dword [esp + 0x2c]
inc ebx
add edi, 0x34
add esi, 0x120
cmp ebx, eax
jl 0x4ba355
mov eax, dword [esp + 0x44]
xor esi, esi
test eax, eax
jle 0x4ba469
mov bl, 0x10
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 8]
test eax, eax
je 0x4ba42f
push 0x933d50
lea ecx, [esp + 0x1c]
call fcn.00618b00
lea edx, [esp + 0x20]
push esi
push edx
lea ecx, [esp + 0x48]
call fcn.00471a10
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x570], bl
call fcn.00618b60
lea ecx, [esp + 0x20]
mov byte [esp + 0x56c], 0xe
call fcn.00617ec0
mov eax, dword [esp + 0x44]
inc esi
cmp esi, eax
jl 0x4ba416
lea ecx, [esp + 0x40]
mov byte [esp + 0x56c], 0xd
call fcn.0061ebe0
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x574]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00617440
lea ecx, [esp + 0x7c]
mov dword [esp + 0x28], 1
mov byte [esp + 0x56c], 0xc
call fcn.0061ebe0
mov dword [esp + 0x8c], 0x893fcc
mov eax, dword [esp + 0x90]
mov byte [esp + 0x56c], 0x11
cmp eax, ebx
je 0x4ba4d6
push eax
call fcn.008325dd
add esp, 4
mov dword [esp + 0x50], method.CCommandLineInfo.virtual_0
mov eax, dword [esp + 0x54]
mov byte [esp + 0x56c], 0x12
cmp eax, ebx
je 0x4ba4f7
push eax
call fcn.008325dd
add esp, 4
mov dword [esp + 0x68], method.CCommandLineInfo.virtual_0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0x56c], 0x13
cmp eax, ebx
je 0x4ba518
push eax
call fcn.008325dd
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x56c], 2
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x56c], 1
call fcn.00469ec0
lea ecx, [esp + 0x18]
mov byte [esp + 0x56c], 0
call fcn.00617ec0
mov eax, esi
jmp 0x4ba5da
lea ecx, [esp + 0x14]
mov byte [esp + 0x56c], 0xe
call fcn.00617ec0
mov eax, dword [esp + 0x44]
xor esi, esi
test eax, eax
jle 0x4ba469
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x48]
call fcn.00471a10
mov eax, dword [eax]
push eax
call edi
lea ecx, [esp + 0x20]
call fcn.00617ec0
mov eax, dword [esp + 0x44]
inc esi
cmp esi, eax
jl 0x4ba577
jmp 0x4ba469
push 0x311
push esi
call fcn.004b8630
mov edi, dword [esp + 0x57c]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00617440
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x56c], 0
call fcn.00617ec0
mov eax, edi
mov ecx, dword [esp + 0x564]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x560
ret