Function at 0x4880d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4884aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [0x634c90]
cmp byte [eax], 0
jne 0x48814c
mov eax, dword [0x634e58]
mov edx, 0x4884c4
call fcn.0040541c
mov eax, dword [0x634e58]
mov eax, dword [eax]
call fcn.00405858
call fcn.004230a4
test al, al
jne 0x48814c
mov eax, dword [0x634c90]
mov byte [eax], 1
mov edx, dword [0x634f20]
mov edx, dword [edx]
mov eax, dword [0x634e58]
mov ecx, 0x4884d8
call fcn.004056e0
call fcn.00486f0c
mov eax, dword [0x634e58]
mov eax, dword [eax]
call fcn.00405858
call fcn.004230a4
test al, al
je 0x488487
xor edx, edx
push ebp
push 0x48847d
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [0x634e58]
mov ecx, dword [ecx]
lea eax, [ebp - 0x10]
mov edx, 0x4884f0
call fcn.004056e0
mov eax, dword [ebp - 0x10]
mov edx, dword [0x634a94]
call fcn.00487c80
xor ebx, ebx
mov esi, 0x20
mov edi, 0x6344b0
lea eax, [ebp - 0x14]
mov edx, dword [edi]
call fcn.004055c0
mov eax, dword [ebp - 0x14]
call fcn.00463d20
test eax, eax
jne 0x4881bc
mov bl, 1
jmp 0x4881c2
add edi, 4
dec esi
jne 0x4881a2
test bl, bl
je 0x4881d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488487
lea eax, [ebp - 4]
call fcn.00488074
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00488814
mov eax, 0x4884fc
call fcn.00487e0c
mov edx, dword [0x634e1c]
mov dword [edx], eax
mov eax, 0x488510
call fcn.00487e0c
mov edx, dword [0x634e74]
mov dword [edx], eax
mov eax, 0x488524
call fcn.00487e0c
mov edx, dword [0x634bb0]
mov dword [edx], eax
mov eax, 0x488538
call fcn.00487e0c
mov edx, dword [0x634ca0]
mov dword [edx], eax
mov eax, 0x48854c
call fcn.00487e0c
mov edx, dword [0x635048]
mov dword [edx], eax
mov eax, 0x488560
call fcn.00487e0c
mov edx, dword [0x6350bc]
mov dword [edx], eax
mov eax, 0x488574
call fcn.00487e0c
mov edx, dword [0x634e00]
mov dword [edx], eax
mov eax, 0x488588
call fcn.00487e0c
mov edx, dword [0x634e4c]
mov dword [edx], eax
mov eax, 0x48859c
call fcn.00487e0c
mov edx, dword [0x634b94]
mov dword [edx], eax
mov eax, 0x4885b0
call fcn.00487e0c
mov edx, dword [0x634dfc]
mov dword [edx], eax
mov eax, 0x4885cc
call fcn.00487e0c
mov edx, dword [0x634e40]
mov dword [edx], eax
mov eax, 0x4885e8
call fcn.00487e0c
mov edx, dword [0x634b88]
mov dword [edx], eax
mov eax, 0x488604
call fcn.00487e0c
mov edx, dword [0x6350d4]
mov dword [edx], eax
mov eax, 0x488614
call fcn.00487e0c
mov edx, dword [0x635130]
mov dword [edx], eax
mov eax, 0x488628
call fcn.00487e0c
mov edx, dword [0x634ed0]
mov dword [edx], eax
mov eax, 0x48863c
call fcn.00487e0c
mov edx, dword [0x634f30]
mov dword [edx], eax
mov eax, 0x488650
call fcn.00487e0c
mov edx, dword [0x635150]
mov dword [edx], eax
mov eax, 0x488668
call fcn.00487e0c
mov edx, dword [0x63497c]
mov dword [edx], eax
mov eax, 0x488680
call fcn.00487e0c
mov edx, dword [0x634ad4]
mov dword [edx], eax
mov eax, 0x488698
call fcn.00487e0c
mov edx, dword [0x634b38]
mov dword [edx], eax
mov eax, 0x4886b0
call fcn.00487e0c
mov edx, dword [0x634f14]
mov dword [edx], eax
mov eax, 0x4886c8
call fcn.00487e0c
mov edx, dword [0x634f58]
mov dword [edx], eax
mov eax, 0x4886e4
call fcn.00487e0c
mov edx, dword [0x634c6c]
mov dword [edx], eax
mov eax, 0x4886fc
call fcn.00487e0c
mov edx, dword [0x634cc8]
mov dword [edx], eax
mov eax, 0x488718
call fcn.00487e0c
mov edx, dword [0x634cc4]
mov dword [edx], eax
mov eax, 0x488730
call fcn.00487e0c
mov edx, dword [0x634d24]
mov dword [edx], eax
mov eax, 0x48874c
call fcn.00487e0c
mov edx, dword [0x6349f8]
mov dword [edx], eax
mov eax, 0x488764
call fcn.00487e0c
mov edx, dword [0x634a4c]
mov dword [edx], eax
mov eax, 0x488780
call fcn.00487e0c
mov edx, dword [0x635038]
mov dword [edx], eax
mov eax, 0x488798
call fcn.00487e0c
mov edx, dword [0x6350a0]
mov dword [edx], eax
mov eax, 0x4887b4
call fcn.00487e0c
mov edx, dword [0x634b64]
mov dword [edx], eax
mov eax, 0x4887cc
call fcn.00487e0c
mov edx, dword [0x634be4]
mov dword [edx], eax
mov eax, 0x4887e8
call fcn.00487e0c
mov edx, dword [0x634ab0]
mov dword [edx], eax
mov eax, 0x488800
call fcn.00487e0c
mov edx, dword [0x634b00]
mov dword [edx], eax
mov byte [ebp - 9], 1
mov eax, dword [0x634e58]
mov eax, dword [eax]
mov edx, 0x4884c4
call fcn.004057f0
je 0x488473
mov eax, dword [0x634e58]
mov eax, dword [eax]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488487
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4884b1
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret