Function at 0x4cdcec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x4cdcf4
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ce239
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dff18]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x4cdd21
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xa
jle 0x4cdeda
xor eax, eax
push ebp
push 0x4cdd71
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x70]
mov eax, dword [0x4dfdd8]
mov eax, dword [eax + 0x380]
mov edx, dword [0x4dff18]
call fcn.004956e0
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00409c64
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 8]
call fcn.0040994c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cdd7b
mov edx, dword [ebp - 8]
mov eax, dword [0x4dff38]
call fcn.004058b8
test eax, eax
jle 0x4cde56
lea eax, [ebp - 0x84]
mov ecx, dword [0x4dfe24]
mov edx, dword [0x4dff38]
call fcn.004055f4
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00472348
lea eax, [ebp - 0x80]
lea edx, [ebp - 0xc]
call fcn.004723c0
xor eax, eax
push ebp
push 0x4cde4c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cde3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4250d0]
call fcn.004251d0
mov dword [ebp - 0x10], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00425270
push 0x4ce250
push dword [ebp - 0xc]
push 0x4ce264
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.00405670
mov edx, dword [ebp - 0x88]
mov cl, 1
mov eax, dword [ebp - 0x10]
call fcn.004252d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cde42
mov eax, dword [ebp - 0x10]
call fcn.004043dc
ret
mov edx, dword [ebp - 8]
mov eax, dword [0x4dff38]
call fcn.004058b8
test eax, eax
jle 0x4cdeda
mov eax, 0x4ce270
call fcn.004cd3d8
mov eax, 0x4ce284
call fcn.004cd3d8
mov eax, 0x4ce298
call fcn.004cd3d8
mov eax, 0x4ce2ac
call fcn.004cd3d8
mov eax, 0x4ce2c4
call fcn.004cd3d8
mov eax, 0x4ce2d8
call fcn.004cd3d8
mov eax, 0x4ce2ec
call fcn.004cd3d8
mov eax, dword [0x4dff44]
call fcn.004cd3d8
mov eax, 0x4ce300
call fcn.004cd3d8
mov eax, 0x4ce310
call fcn.0044316c
mov eax, dword [0x4dfdd8]
call fcn.0046bd54
jmp 0x4ce201
mov eax, dword [0x4dfe1c]
mov edx, 0x4ce330
call fcn.00405704
jne 0x4ce201
lea edx, [ebp - 0x90]
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.004702c0
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.0040a7b0
mov edx, dword [ebp - 0x8c]
mov eax, 0x4dff48
call fcn.00405330
lea ecx, [ebp - 0x94]
mov edx, 1
mov eax, dword [0x4dff48]
call fcn.00439494
mov eax, dword [ebp - 0x94]
mov edx, 0x4ce264
call fcn.00405704
je 0x4cdf7f
lea ecx, [ebp - 0x98]
mov edx, 1
mov eax, dword [0x4dff48]
call fcn.00439494
mov eax, dword [ebp - 0x98]
mov edx, 0x4ce33c
call fcn.00405704
je 0x4cdf7f
mov eax, 0x4dff48
mov edx, 0x4ce264
call fcn.004055a8
mov eax, 0x4dff44
mov edx, 0x4ce300
call fcn.00405330
lea eax, [ebp - 4]
mov edx, 0x4ce348
call fcn.00405374
mov eax, dword [ebp - 4]
call fcn.0040a5c0
test al, al
je 0x4cdfb5
mov eax, dword [ebp - 4]
call fcn.0040576c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040576c
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, 0x4dfee8
mov edx, 0x4ce364
call fcn.00405330
mov eax, dword [0x4dfee8]
mov edx, 0x4ce364
call fcn.00405704
jne 0x4ce039
lea edx, [ebp - 0x9c]
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.004702c0
mov eax, dword [ebp - 0x9c]
mov edx, dword [0x4dff4c]
call fcn.004cd918
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.0046f988
mov edx, 6
mov eax, dword [0x4dff4c]
call fcn.0040a700
mov eax, dword [0x4dff4c]
call fcn.0040a5c0
test al, al
je 0x4ce0ef
mov eax, dword [0x4dfecc]
mov edx, 0x4ce364
call fcn.00405704
je 0x4ce068
push 0
push 0x4ce368
call sub.kernel32.dll_WinExec
xor eax, eax
push ebp
push 0x4ce0e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.004039d0
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x10
call fcn.004039d0
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0xa0]
mov eax, dword [0x4dff4c]
call fcn.0040a7e4
mov eax, dword [ebp - 0xa0]
call fcn.0040576c
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4dff4c]
call fcn.0040576c
push eax
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce0ef
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.0046f988
push 1
push 0
push 0x4ce384
lea edx, [ebp - 0xa4]
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.004702c0
mov eax, dword [ebp - 0xa4]
call fcn.0040576c
push eax
push 0x4ce38c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4d90d4]
mov eax, dword [eax]
call fcn.0046f988
mov eax, dword [0x4dfdd8]
mov eax, dword [eax + 0x378]
mov dl, 1
call fcn.0043d1b0
mov eax, dword [0x4dfe88]
mov edx, 0x4ce364
call fcn.00405704
jne 0x4ce162
call fcn.004ccf54
mov eax, dword [0x4dfe8c]
mov edx, 0x4ce364
call fcn.00405704
jne 0x4ce190
mov eax, dword [0x4dff8c]
push eax
mov eax, dword [0x4dfdd8]
mov eax, dword [eax + 0x37c]
push eax
mov eax, dword [0x4dfdd8]
push eax
call fcn.004ccfe4
cmp dword [0x4dfe9c], 0
je 0x4ce1c4
mov eax, dword [0x4dfe9c]
mov edx, 0x4ce39c
call fcn.00405704
je 0x4ce1c4
push 1
push 0
push 0
mov eax, dword [0x4dfe9c]
call fcn.0040576c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4dfedc]
mov edx, 0x4ce364
call fcn.00405704
jne 0x4ce201
xor eax, eax
push ebp
push 0x4ce1f7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00443ec0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce201
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce240
lea eax, [ebp - 0xa4]
mov edx, 9
call fcn.00405300
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00405300
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405300
ret