Function at 0x48ac50
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4ebf3e
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
cmp dword [esi + 0x196ca], ebp
jne 0x48ace5
push 0x504034
lea eax, [esi + 0x192ac]
push 2
push eax
call fcn.00418e80
add esp, 0xc
push 0x15
mov ecx, esi
mov dword [esi + 0x196b6], 4
call fcn.00482e40
call fcn.00419310
mov eax, dword [eax + 0x162]
and eax, 0x800
xor ecx, ecx
or eax, ecx
je 0x48bbc3
push 0x504808
mov ecx, esi
call fcn.00436c50
jmp 0x48bbc3
mov ecx, dword [esi + 0x19712]
mov edx, dword [esi + 0x1970e]
push ecx
push edx
mov ecx, esi
call fcn.004854a0
test al, al
mov ecx, esi
jne 0x48ad16
push 0x15
mov dword [esi + 0x196b6], 4
call fcn.00482e40
jmp 0x48bbc3
call fcn.004847d0
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
push ecx
mov ecx, esi
call fcn.00437d10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebp
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebp
push eax
mov word [ecx + 4], bp
call fcn.00401640
lea edx, [esp + 0x90]
lea ecx, [esi + 0x1916a]
push edx
call fcn.0045fdf0
lea ecx, [esp + 0x54]
mov dword [esp + 0x94], ebp
call fcn.004bac44
cmp word [esi + 0x194fe], 5
mov byte [esp + 0x94], 1
mov edi, 8
jne 0x48adc0
mov ecx, esi
call fcn.00438740
test al, al
je 0x48adc0
mov ecx, esi
call fcn.004371c0
test al, al
je 0x48adc0
cmp dword [esp + 0x84], edi
mov eax, dword [esp + 0x70]
jae 0x48adb2
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00438910
cmp dword [esi + 0x198aa], edi
lea ebx, [esi + 0x19892]
mov byte [esp + 0x17], 0
jb 0x48add8
mov eax, dword [ebx + 4]
jmp 0x48addb
lea eax, [ebx + 4]
push ebp
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
je 0x48ae00
mov byte [esp + 0x17], 1
cmp dword [ebx + 0x18], edi
jb 0x48b055
mov eax, dword [ebx + 4]
jmp 0x48b058
mov ecx, esi
call fcn.00485bb0
test al, al
jne 0x48adef
cmp dword [esi + 0x19802], edi
jb 0x48ae1b
mov ebp, dword [esi + 0x197ee]
jmp 0x48ae21
lea ebp, [esi + 0x197ee]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push ebp
push 0x504840
lea eax, [esi + 0x192ac]
push 2
push eax
call fcn.00418e80
add esp, 0x14
call ebx
cmp eax, 0x3e7
ja 0x48aeb7
cmp eax, 0x3e6
jae case.0x48aee2.1005
sub eax, 1
cmp eax, 0xa9
ja case.0x48aee2.1007
movzx ecx, byte [eax + 0x48bc04]
jmp dword [ecx*4 + 0x48bbe8]
push 0x504988
lea edx, [esi + 0x198ca]
push 0x200
push edx
call fcn.004c0258
mov word [esi + 0x19cca], di
jmp 0x48b020
push 0x50416c
lea eax, [esi + 0x198ca]
push 0x200
push eax
call fcn.004c0258
mov word [esi + 0x19cca], 9
jmp 0x48b020
cmp eax, 0x547
ja 0x48af26
je case.0x48ae6a.5
cmp eax, 0x48f
ja 0x48aee9
je case.0x48ae6a.2
sub eax, 0x3ed
cmp eax, 0x7a
ja case.0x48aee2.1007
movzx ecx, byte [eax + 0x48bcb8]
jmp dword [ecx*4 + 0x48bcb0]
cmp eax, 0x4cf
je case.0x48ae6a.2
add eax, 0xfffffadf
cmp eax, 1
ja case.0x48aee2.1007
push 0x504910
lea edx, [esi + 0x198ca]
push 0x200
push edx
call fcn.004c0258
mov word [esi + 0x19cca], 7
jmp 0x48b020
cmp eax, 0x6f8
ja 0x48af8c
je 0x48af44
cmp eax, 0x570
jb case.0x48aee2.1007
cmp eax, 0x571
jbe case.0x48aee2.1005
cmp eax, 0x5aa
jne case.0x48aee2.1007
push str.Insufficient_system_resources.
lea ecx, [esi + 0x198ca]
push 0x200
push ecx
call fcn.004c0258
mov word [esi + 0x19cca], 0xb
jmp 0x48b020
push 0x5041dc
lea eax, [esi + 0x198ca]
push 0x200
push eax
call fcn.004c0258
mov word [esi + 0x19cca], 0xa
jmp 0x48b020
cmp eax, 0x718
je case.0x48ae6a.112
cmp eax, 0x10fe
je case.0x48ae6a.2
push 0x5042ac
lea edx, [esi + 0x198ca]
push 0x200
push edx
call fcn.004c0258
add esp, 0xc
mov word [esi + 0x19cca], 0xa
call fcn.00419310
mov eax, dword [eax + 0x162]
and eax, 0x1000
xor ecx, ecx
or eax, ecx
je 0x48b023
push 0x504a98
mov ecx, esi
call fcn.00436c50
jmp 0x48b023
push 0x5048b8
lea eax, [esi + 0x198ca]
push 0x200
push eax
call fcn.004c0258
mov word [esi + 0x19cca], 5
jmp 0x48b020
push 0x5040fc
lea ecx, [esi + 0x198ca]
push 0x200
push ecx
call fcn.004c0258
mov word [esi + 0x19cca], 3
add esp, 0xc
mov dword [esi + 0x196b6], 4
push 0x15
mov ecx, esi
call fcn.00482e40
mov byte [esp + 0x94], 0
lea ecx, [esp + 0x54]
call fcn.004bac6a
lea ecx, [esp + 0x6c]
call fcn.00401470
jmp 0x48bbc3
lea eax, [ebx + 4]
push ebp
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
je 0x48b08c
cmp dword [esi + 0x198c6], edi
jb 0x48b077
mov eax, dword [esi + 0x198b2]
jmp 0x48b07d
lea eax, [esi + 0x198b2]
push ebp
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
jne 0x48b09a
mov ecx, esi
call fcn.00484bc0
mov ecx, esi
call fcn.004830a0
lea edi, [esi + 0x198ae]
mov ebp, 8
cmp dword [edi + 0x18], ebp
jb 0x48b0af
mov eax, dword [edi + 4]
jmp 0x48b0b2
lea eax, [edi + 4]
push 0
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
jne 0x48b0fb
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x48b0d3
lea eax, [esp + 0x70]
push 0
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
je 0x48b0fb
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x48b0f4
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp byte [esp + 0x17], al
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
je 0x48b176
cmp dword [ebx + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
jb 0x48b11d
mov eax, dword [ebx + 4]
jmp 0x48b120
lea eax, [ebx + 4]
push 0
push 0x10000000
push 3
push 0
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x48b171
mov eax, dword [esi + 0x19364]
cmp eax, 5
ja 0x48b14d
jne 0x48b16a
lea edx, [esp + 0x1c]
push edx
push ebp
mov ecx, esi
call fcn.00436c30
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 8
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x48b187
lea eax, [esp + 0x70]
push 0
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
jne 0x48b385
cmp byte [esp + 0x17], al
je 0x48b385
mov eax, dword [esi + 0x1970e]
cmp dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x19712]
jne 0x48b2f5
cmp dword [esp + 0x30], ecx
jne 0x48b2f5
cmp byte [esi + 0x19502], 2
jne 0x48b20c
cmp dword [ebx + 0x18], ebp
jb 0x48b1d8
mov ebx, dword [ebx + 4]
jmp 0x48b1db
add ebx, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x48b1f5
lea eax, [esp + 0x70]
push eax
call edi
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
push eax
jmp 0x48b37a
lea ecx, [esi + 0x192ac]
push 0x504afc
push ecx
call fcn.00418ea0
mov edx, dword [esi + 0x1970e]
mov eax, dword [esi + 0x19712]
xor ebx, ebx
add esp, 8
push 0x15
mov ecx, esi
mov byte [esi + 0x1951c], 1
mov dword [esi + 0x196b6], 5
mov dword [esi + 0x1971e], edx
mov dword [esi + 0x19722], eax
mov dword [esi + 0x19736], ebx
mov dword [esi + 0x1973a], ebx
mov dword [esi + 0x1972e], ebx
mov dword [esi + 0x19732], ebx
call fcn.00482e40
call fcn.00419310
cmp dword [eax + 6], ebx
je 0x48b2e9
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
call fcn.00406510
mov ecx, dword [esi + 0x19712]
mov edx, dword [esi + 0x1970e]
mov eax, dword [esi + 0x196ca]
push ecx
movzx ecx, word [esi + 0x196c4]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004877f0
mov dx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
lea ecx, [esp + 0x1c]
mov word [esp + 0x1c], dx
push ecx
lea edx, [esp + 0x48]
push edx
lea ecx, [esi + 0x19ec8]
mov word [esp + 0x2a], bx
mov dword [esp + 0x26], eax
call fcn.0047a5b0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x19ee0]
call fcn.00482db0
mov byte [esp + 0x94], bl
jmp 0x48b03e
mov edx, dword [esp + 0x2c]
push 0
push ecx
mov ecx, dword [esp + 0x38]
push eax
push ecx
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.00406510
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
push edi
mov byte [esp + 0xe4], 2
call fcn.00406510
sub esp, 0x1c
lea eax, [esp + 0xd4]
mov ecx, esp
mov dword [esp + 0x9c], esp
push eax
mov byte [esp + 0x100], 3
call fcn.00406510
mov ecx, dword [esi + 0x196ca]
movzx edx, word [esi + 0x196c4]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x104], 1
call fcn.00487050
mov eax, dword [esi + 0x196ca]
movzx ecx, word [esi + 0x196c4]
push eax
push ecx
lea ecx, [esi + 0x1916a]
call fcn.0046f880
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
push 0
jae 0x48b398
lea eax, [esp + 0x74]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00401430
lea ecx, [esi + 0x1916a]
call fcn.0046cb90
cmp dword [esi + 0x19802], ebp
jb 0x48b3c2
mov eax, dword [esi + 0x197ee]
jmp 0x48b3c8
lea eax, [esi + 0x197ee]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00406e40
mov ecx, esi
call fcn.00483e30
test al, al
jne 0x48b45b
cmp dword [esi + 0x19802], ebp
jb 0x48b3f0
mov ebx, dword [esi + 0x197ee]
jmp 0x48b3f6
lea ebx, [esi + 0x197ee]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x504b38
lea edx, [esi + 0x192ac]
push 2
push edx
call fcn.00418e80
add esp, 0x14
push 0x15
mov ecx, esi
mov dword [esi + 0x196b6], 4
mov word [esi + 0x19cca], 0xa
call fcn.00482e40
call fcn.00419310
mov eax, dword [eax + 0x162]
and eax, 0x2000
xor ecx, ecx
or eax, ecx
je 0x48b036
push 0x504b90
mov ecx, esi
call fcn.00436c50
jmp 0x48b036
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
push ecx
lea edi, [esi + 0x1916a]
mov ecx, edi
call fcn.0043fec0
mov edx, dword [esi + 0x196ca]
mov ebx, eax
movzx eax, word [esi + 0x196c4]
push edx
push eax
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.0045d040
mov ebp, eax
xor edi, edi
cmp ebp, edi
mov dword [esp + 0x40], ebp
je 0x48b6d0
movzx eax, word [ebp + 0x50e]
movzx ecx, ax
cmp cx, 3
je 0x48b6b1
cmp ebx, edi
je 0x48b6b1
mov ecx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call fcn.004402a0
sub eax, 1
cmp byte [esi + 0x19cd6], 0
mov dword [esp + 0x3c], eax
jne 0x48b519
mov ecx, ebx
call fcn.004402a0
mov edi, eax
test edi, edi
jbe 0x48b519
lea eax, [edi - 1]
push eax
mov ecx, ebx
mov dword [esp + 0x38], eax
call fcn.004402c0
cmp dword [eax + 0xc], 0
ja 0x48b512
mov edi, dword [esp + 0x34]
test edi, edi
ja 0x48b4f3
jmp 0x48b519
add edi, 0xffffffff
mov dword [esp + 0x3c], edi
mov ecx, ebx
xor edi, edi
call fcn.004402a0
test eax, eax
jbe 0x48b610
lea ebx, [ebx]
push edi
mov ecx, ebx
call fcn.004402c0
mov ecx, dword [ebp + 0x14]
mov ebp, dword [ebp + 0x18]
mov dword [esp + 0x34], eax
lea eax, [edi + 1]
mov edx, 0xa00000
mov dword [esp + 0x38], eax
mul edx
cmp edx, ebp
mov dword [esp + 0x44], 0xa00000
mov dword [esp + 0x48], 0
jb 0x48b57b
ja 0x48b56c
mov edx, ecx
cmp eax, edx
jbe 0x48b57b
mov eax, edi
mov edx, 0xa00000
mul edx
sub ecx, eax
sbb ebp, edx
jmp 0x48b583
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0xc]
add dword [esp + 0x1c], eax
adc dword [esp + 0x20], 0
cmp byte [esi + 0x19cd6], 0
jne 0x48b5ac
cmp edi, dword [esp + 0x3c]
jae 0x48b5ac
add dword [esp + 0x24], ecx
adc dword [esp + 0x28], ebp
jmp 0x48b5b5
add dword [esp + 0x24], eax
adc dword [esp + 0x28], 0
movzx edx, word [ebx + 0x18]
movzx edx, dx
cmp edx, 0x1000
jg case.default.0x48b5ce
je case.0x48b5ce.3
sub edx, 1
cmp edx, 4
ja case.default.0x48b5ce
jmp dword [edx*4 + 0x48bd34]
xor edx, edx
cmp ecx, eax
jne 0x48b5f1
cmp ebp, edx
jne 0x48b5f1
mov word [ebx + 0x18], 2
jmp case.default.0x48b5ce
xor edx, edx
cmp ecx, eax
jne 0x48b5f1
cmp ebp, edx
je case.default.0x48b5ce
mov word [ebx + 0x18], dx
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x38]
mov ecx, ebx
call fcn.004402a0
cmp edi, eax
mov ebp, dword [esp + 0x40]
jb 0x48b530
mov eax, dword [ebp + 0x1c]
mov edx, dword [esp + 0x1c]
cmp edx, eax
mov ecx, dword [ebp + 0x20]
jne 0x48b68f
mov edi, ecx
cmp dword [esp + 0x20], edi
jne 0x48b68f
mov edx, dword [esp + 0x24]
cmp dword [esp + 0x2c], edx
jne 0x48b665
mov edi, dword [esp + 0x30]
cmp edi, dword [esp + 0x28]
jne 0x48b665
movzx edx, word [ebp + 0x12]
cmp dx, 5
jne 0x48b7d7
mov edx, dword [ebp + 0x14]
cmp eax, edx
mov edi, dword [ebp + 0x18]
jne 0x48b65a
cmp ecx, edi
je 0x48b7d7
mov word [ebp + 0x12], 2
jmp 0x48b7d7
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
push eax
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push 0x504bf0
lea eax, [esi + 0x192ac]
push 2
push eax
call fcn.00418e80
add esp, 0x1c
xor edi, edi
jmp 0x48b6d0
push ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push edx
push 0x504c80
lea edx, [esi + 0x192ac]
push 2
push edx
call fcn.00418e80
add esp, 0x1c
xor edi, edi
jmp 0x48b6d0
movzx eax, ax
cmp ax, 3
jne 0x48b6d0
push 0x504d00
lea eax, [esi + 0x192ac]
push 2
push eax
call fcn.00418e80
add esp, 0xc
xor ebp, ebp
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
cmp ebx, edi
mov byte [esp + 0x94], 4
je 0x48b6f8
push ebx
lea ecx, [esp + 0x48]
call fcn.00468410
lea ebp, [esp + 0x44]
cmp dword [esp + 0x84], 8
mov eax, dword [esp + 0x70]
jae 0x48b70a
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x196ca]
movzx edx, word [esi + 0x196c4]
push ecx
push edx
lea ecx, [esi + 0x1916a]
call fcn.0046f880
mov eax, dword [esp + 0x30]
cmp eax, edi
ja 0x48b73d
cmp dword [esp + 0x2c], edi
jbe 0x48b7c6
mov ecx, dword [esi + 0x19712]
mov edx, dword [esi + 0x1970e]
push ebp
push ecx
push edx
push eax
mov eax, dword [esp + 0x3c]
push eax
sub esp, 0x1c
lea eax, [esi + 0x19892]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00406510
sub esp, 0x1c
lea eax, [esi + 0x198ae]
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
mov byte [esp + 0xe4], 5
call fcn.00406510
sub esp, 0x1c
lea edx, [esp + 0xd4]
mov ecx, esp
mov dword [esp + 0x9c], esp
push edx
mov byte [esp + 0x100], 6
call fcn.00406510
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x104], 4
call fcn.00487050
lea ecx, [esp + 0x44]
mov byte [esp + 0x94], 1
call fcn.0045d3f0
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
lea edi, [esi + 0x1916a]
push eax
mov ecx, edi
mov ebp, 8
call fcn.0045d040
test eax, eax
jne 0x48b896
mov ecx, esi
call fcn.00484bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x198ae]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], bx
call fcn.00401640
mov ecx, dword [esi + 0x196ca]
movzx edx, word [esi + 0x196c4]
mov eax, dword [esi + 0x19712]
push ecx
mov ecx, dword [esi + 0x1970e]
push edx
push eax
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x80], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xbc]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edx
mov byte [esp + 0xe8], 7
mov word [ecx + 4], bx
call fcn.00401640
mov ecx, edi
mov byte [esp + 0xdc], 1
call fcn.0046e0f0
mov ecx, esi
call fcn.004830a0
jmp 0x48b898
xor ebx, ebx
mov eax, dword [esi + 0x1953a]
mov ecx, dword [eax + 0x24]
cmp ecx, ebx
jne 0x48b916
lea ecx, [esi + 0x192ac]
push 0x504d78
push ecx
call fcn.00418ea0
add esp, 8
push 0x15
mov ecx, esi
mov dword [esi + 0x196b6], 4
call fcn.00482e40
call fcn.00419310
mov eax, dword [eax + 0x162]
and eax, 0x4000
xor ecx, ecx
or eax, ecx
je 0x48b8ee
push 0x504dd8
mov ecx, esi
call fcn.00436c50
lea ecx, [esp + 0x54]
mov byte [esp + 0x94], 0
call fcn.004bac6a
cmp dword [esp + 0x84], ebp
jb 0x48bbc3
mov edx, dword [esp + 0x70]
push edx
jmp 0x48bbbb
call fcn.0045cdf0
test al, al
je 0x48b9d3
cmp byte [esi + 0x19502], 2
jne 0x48ba12
mov ecx, esi
call fcn.00483100
cmp dword [esi + 0x198aa], ebp
jb 0x48b947
mov eax, dword [esi + 0x19896]
jmp 0x48b94d
lea eax, [esi + 0x19896]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx ecx, word [esi + 0x196c4]
mov eax, dword [esi + 0x196ca]
push eax
push ecx
mov ecx, edi
call fcn.0046f880
sub esp, 0x1c
lea eax, [esi + 0x198ae]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00406510
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
mov ecx, dword [esi + 0x19712]
push edx
mov edx, dword [esi + 0x1970e]
push eax
push ecx
push edx
sub esp, 0x1c
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x80], esp
push eax
mov byte [esp + 0xe0], 8
call fcn.00406510
mov ecx, edi
mov byte [esp + 0xdc], 1
call fcn.0046e0f0
mov ecx, esi
call fcn.004830a0
cmp word [esi + 0x194fe], 5
jne 0x48bb09
mov ecx, dword [esi + 0x1953a]
mov ecx, dword [ecx + 0x24]
call fcn.0045ccf0
cmp edx, ebx
ja 0x48b9fb
cmp eax, ebx
jbe 0x48bb09
cmp dword [esi + 0x198c6], ebp
jb 0x48ba95
mov eax, dword [esi + 0x198b2]
jmp 0x48ba9b
mov byte [esi + 0x1951c], 1
call fcn.00419310
cmp dword [eax + 6], ebx
jne 0x48ba3b
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x48ba34
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00438910
mov ecx, dword [esi + 0x1970e]
mov edx, dword [esi + 0x19712]
lea eax, [esi + 0x192ac]
push 0x504e50
push eax
mov dword [esi + 0x196b6], 5
mov dword [esi + 0x1971e], ecx
mov dword [esi + 0x19722], edx
mov dword [esi + 0x19736], ebx
mov dword [esi + 0x1973a], ebx
mov dword [esi + 0x1972e], ebx
mov dword [esi + 0x19732], ebx
call fcn.00418ea0
add esp, 8
jmp 0x48b02d
lea eax, [esi + 0x198b2]
push ebx
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
jne 0x48bb09
cmp dword [esi + 0x198aa], ebp
jb 0x48baba
mov eax, dword [esi + 0x19896]
jmp 0x48bac0
lea eax, [esi + 0x19896]
push ebx
push eax
lea ecx, [esp + 0x5c]
call fcn.004bacd2
test eax, eax
je 0x48bb40
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dword [esi + 0x198c6], ebp
jb 0x48bae5
mov ecx, dword [esi + 0x198b2]
jmp 0x48baeb
lea ecx, [esi + 0x198b2]
cmp dword [esi + 0x198aa], ebp
jb 0x48bafb
mov eax, dword [esi + 0x19896]
jmp 0x48bb01
lea eax, [esi + 0x19896]
push ecx
push eax
call edi
cmp eax, ebx
je 0x48bad5
mov edx, dword [esi + 0x196ca]
movzx eax, word [esi + 0x196c4]
push edx
push eax
lea ecx, [esi + 0x1916a]
mov byte [esi + 0x1a378], 0
call fcn.0045d040
mov edi, eax
cmp edi, ebx
je 0x48bb7c
cmp dword [esi + 0x198c6], ebp
jb 0x48bb5b
mov eax, dword [esi + 0x198b2]
jmp 0x48bb61
push ebp
mov ecx, esi
call fcn.00482e40
mov ecx, esi
mov byte [esi + 0x19508], 1
call fcn.00491580
jmp 0x48b036
lea eax, [esi + 0x198b2]
push eax
mov ecx, edi
call fcn.0045a820
cmp dword [edi + 0x20], ebx
mov eax, dword [edi + 0x1c]
ja 0x48bb75
cmp eax, ebx
jbe 0x48bb7c
mov byte [esi + 0x1a378], 1
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esi + 0x1975e]
push eax
mov ecx, esi
call edx
push 9
mov ecx, esi
mov byte [esi + 0x19508], 1
call fcn.00482e40
lea ecx, [esp + 0x54]
mov byte [esp + 0x94], 0
call fcn.004bac6a
cmp dword [esp + 0x84], ebp
jb 0x48bbc3
mov eax, dword [esp + 0x70]
push eax
call fcn.004aef39
add esp, 4
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x84
ret