Function at 0x4febc4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
xor ecx, ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
lea eax, [ebp - 0x170]
mov edx, dword [0x4089b4]
call fcn.00405e24
xor eax, eax
push ebp
push 0x4feeb0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x174]
mov ecx, 0x4feec4
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.0040a550
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4fee6e
mov eax, dword [ebp - 0x15c]
mov edx, 0x4feed0
call fcn.004055f8
je 0x4fee56
mov eax, dword [ebp - 0x15c]
mov edx, 0x4feedc
call fcn.004055f8
je 0x4fee56
test byte [ebp - 0x160], 8
jne 0x4fee56
test byte [ebp - 0x160], 0x10
jne 0x4fee56
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 0x15c]
call fcn.00409b80
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4fee56
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x17c]
call fcn.004dc810
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x180]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4fee56
push 3
push dword [ebp - 4]
push dword [ebp - 0x15c]
push 0x4feee8
lea eax, [ebp - 0x184]
mov edx, 3
call fcn.0040556c
mov eax, dword [ebp - 0x184]
call fcn.004056ac
push eax
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x188]
call fcn.004056ac
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
jne 0x4fedd5
push 7
push dword [ebp - 4]
push dword [ebp - 0x15c]
push 0x4feee8
lea eax, [ebp - 0x18c]
mov edx, 3
call fcn.0040556c
mov eax, dword [ebp - 0x18c]
call fcn.004056ac
push eax
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x190]
call fcn.004056ac
push eax
call sub.kernel32.dll_MoveFileExA
jmp 0x4fee08
push 7
push 0
push dword [ebp - 4]
push dword [ebp - 0x15c]
push 0x4feee8
lea eax, [ebp - 0x194]
mov edx, 3
call fcn.0040556c
mov eax, dword [ebp - 0x194]
call fcn.004056ac
push eax
call sub.kernel32.dll_MoveFileExA
push 0x4feef8
push dword [ebp - 0x15c]
push 0x4fef08
lea eax, [ebp - 0x198]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00511784
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x20
mov edx, 0x4fef34
call fcn.0040523c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 0x19], 1
lea eax, [ebp - 0x170]
call fcn.0040a5a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4fec6e
lea eax, [ebp - 0x170]
call fcn.0040a5c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4feeb7
lea eax, [ebp - 0x198]
mov edx, 0xa
call fcn.0040520c
lea eax, [ebp - 0x170]
mov edx, dword [0x4089b4]
call fcn.00405ef4
lea eax, [ebp - 4]
call fcn.004051e8
ret