Function at 0x480f3e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0046e3c9
mov eax, dword [esi + 0x190]
or eax, dword [esi + 0x194]
jne 0x480f70
mov eax, dword [0x548aa0]
mov dword [esi + 0x190], eax
mov eax, dword [0x548aa4]
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x18c]
mov edx, eax
or edx, ecx
push 0
pop ebx
je 0x480ff3
cmp dword [esi + 0xc8], ebx
je 0x480ff3
mov edi, dword [esi + 0x194]
cmp edi, ebx
mov edx, dword [esi + 0x190]
jl 0x480fbf
jg 0x480fa3
cmp edx, ebx
jbe 0x480fbf
sub eax, dword [0x548aa0]
sbb ecx, dword [0x548aa4]
add eax, edx
adc ecx, edi
mov dword [esi + 0x188], eax
mov dword [esi + 0x18c], ecx
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x18c]
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov edx, dword [0x548aa0]
add edx, eax
mov eax, dword [0x548aa4]
adc eax, ecx
mov ecx, dword [esi + 0xc8]
push eax
push edx
call fcn.0042758e
test byte [esi + 0xf5], 1
jne 0x481016
cmp dword [esi + 0xc8], ebx
jne 0x481016
cmp dword [esi + 0xc4], ebx
ja 0x481048
jb 0x481016
cmp dword [esi + 0xc0], ebx
ja 0x481048
mov ecx, dword [esi + 0x190]
add ecx, dword [esi + 0x188]
mov eax, dword [esi + 0x194]
adc eax, dword [esi + 0x18c]
mov edx, dword [0x548aa4]
cmp edx, eax
jl 0x481048
jg 0x481043
mov eax, dword [0x548aa0]
cmp eax, ecx
jb 0x481048
mov byte [ebp - 1], bl
jmp 0x48104c
mov byte [ebp - 1], 1
test byte [ebp + 8], 2
je 0x48106d
and byte [esi + 0xf4], 0xfe
lea ecx, [esi + 0xb0]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [ebp - 1], bl
call fcn.004285a9
lea ecx, [esi + 0xf4]
mov al, byte [ecx]
test al, 1
jne 0x481241
or al, 1
mov byte [ecx], al
mov ecx, esi
call fcn.0047d18d
cmp byte [ebp - 1], bl
jne 0x4810a7
mov ecx, esi
call fcn.0047e202
lea edi, [esi + 0x94]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4810a7
call fcn.00447ca6
mov dword [edi], ebx
lea eax, [esi + 0xf0]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x4810b8
mov dword [ecx + 0x40], ebx
mov dword [eax], ebx
mov ecx, esi
call fcn.0047fcc3
cmp dword [esi + 0x70], 2
jne 0x4810ce
mov ecx, esi
call fcn.0047df80
jmp 0x4810e8
mov eax, dword [esi + 0xc8]
cmp eax, ebx
je 0x4810e8
test byte [eax + 0x1cb], 0x80
je 0x4810e8
or byte [eax + 0x1be], 0x40
mov ecx, dword [esi + 0xc8]
cmp ecx, ebx
je 0x48112b
lea eax, [esi + 4]
push eax
call fcn.0040d253
mov eax, dword [esi + 0xc8]
inc dword [eax + 0x504]
mov eax, dword [esi + 0xc8]
test byte [eax + 0x1cb], 0x80
je 0x481125
cmp dword [eax + 0x2d0], ebx
jne 0x481125
mov byte [eax + 0x508], 3
mov dword [esi + 0xc8], ebx
lea edi, [esi + 0x98]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x48113e
call fcn.00447ca6
mov dword [edi], ebx
lea ecx, [esi + 0x9c]
cmp dword [ecx], 0xffffffff
je 0x48114e
call fcn.004720fd
cmp byte [ebp - 1], bl
jne 0x481177
lea ecx, [esi + 0xa0]
mov eax, dword [ecx]
cmp eax, ebx
je 0x481177
xor edx, edx
cmp word [eax], bx
sete dl
cmp dl, bl
jne 0x481177
call fcn.0048e806
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x481215
or byte [esi + 0xf5], 2
mov al, byte [esi + 0xf5]
cmp byte [ebp - 1], bl
je 0x4811af
and al, 0xfd
mov byte [esi + 0xf5], al
call fcn.0047caf5
push ebx
push 0x258
lea ecx, [esi + 8]
call fcn.0047cc9f
test byte [ebp + 8], 1
je 0x4811df
mov ecx, dword [esi + 0x10]
push ebx
push 5
push 1
call fcn.0046f5a5
mov ecx, dword [esi + 0x10]
call fcn.0046f6b4
mov ecx, dword [esi + 0x10]
call fcn.0047048e
lea ecx, [esi + 0xb0]
call fcn.004285a9
jmp 0x481210
cmp byte [esi + 0x44], bl
je 0x481201
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x10]
add eax, eax
push eax
add ecx, 0x48
call fcn.0047ccc6
mov eax, dword [esi + 0x10]
or dword [eax + 0x80], 0xffffffff
jmp 0x481208
mov ecx, esi
call fcn.0047d18d
mov ecx, dword [esi + 0x10]
call fcn.0047048e
mov dword [esi + 0x10], ebx
jmp 0x481241
cmp byte [ebp - 1], bl
je 0x48122a
push ebx
push 0x258
lea ecx, [esi + 8]
call fcn.0047cc9f
jmp 0x481241
test byte [ebp + 8], 4
jne 0x481241
test byte [esi + 0xf5], 2
jne 0x481241
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
call fcn.0046e3e5
pop edi
pop esi
pop ebx
leave
ret 4