Function at 0x4a3af0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x3c
mov edx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x50c]
push ebx
mov ebx, 4
sub esp, 0x538
mov dword [ebp - 0x514], 0x4550
rep stosd dword es:[edi], eax
mov eax, 0x10b
mov ecx, 1
mov word [ebp - 0x4d4], dx
mov word [ebp - 0x4fc], ax
mov eax, dword [0x79ea48]
lea edx, [ebp - 0x514]
lea edi, [ebp - 0x214]
mov word [ebp - 0x4d0], cx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
add eax, 0x160
mov dword [ebp - 0x4c4], eax
mov eax, 0x40
mov word [ebp - 0x4cc], bx
lea ebx, [ebp - 0x318]
mov dword [ebp - 0x510], 0x1014c
mov dword [ebp - 0x500], 0x200200e0
mov byte [ebp - 0x4fa], 1
mov dword [ebp - 0x4e8], 0x10
mov dword [ebp - 0x4e0], 0x10000000
mov dword [ebp - 0x4b8], 0x1400003
mov dword [ebp - 0x4b4], 0x100000
mov dword [ebp - 0x4b0], 0x1000
mov dword [ebp - 0x4ac], 0x100000
mov dword [ebp - 0x4a8], 0x1000
mov dword [ebp - 0x4a0], 0x10
mov dword [ebp - 0x4c0], 0x160
call fcn.004a1f40
mov ecx, dword [sym.imp.msvcrt.dll_strcpy]
lea eax, [ebp - 0x41c]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [ebp - 0x534], ecx
call ecx
mov eax, dword [sym.imp.msvcrt.dll_strrchr]
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
mov dword [ebp - 0x52c], eax
call eax
lea ecx, [ebp - 0x41c]
mov dword [eax], 0x6968745c
mov dword [eax + 4], 0x73692d73
mov dword [eax + 8], 0x6c2d612d
mov dword [eax + 0xc], 0x2d676e6f
mov dword [eax + 0x10], 0x656d616e
mov dword [eax + 0x14], 0x6c6c642e
mov byte [eax + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_MoveFileA]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov edx, dword fs:[0x18]
mov dword [eax + 4], 0x5df
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x51c], edx
mov dword [esp], esi
lea esi, [ebp - 0x214]
mov dword [esp + 8], eax
mov dword [esp + 4], str.MoveFileA_failed_err__lu_n
call fcn.0049fda0
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 0xc
mov dword [esp], esi
mov dword [ebp - 0x518], eax
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x51c]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5e3
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x528], edx
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x110]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov ecx, dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov dword [esp + 8], 0x104
mov dword [ebp - 0x51c], ecx
call ecx
sub esp, 0xc
call fcn.0057d110
lea edx, [ebp - 0x214]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5e5
mov dword [esp + 4], edx
lea edx, [ebp - 0x110]
mov dword [esp], edx
mov edx, dword [sym.imp.kernel32.dll_lstrcmpiA]
mov dword [ebp - 0x520], edx
call edx
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x110]
movzx eax, al
mov dword [esp + 8], edi
lea edi, [ebp - 0x214]
mov dword [esp + 4], str.got_wrong_path__s____s_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [ebp - 0x524], edi
call edi
sub esp, 4
mov edi, eax
call fcn.0057d110
lea ecx, [ebp - 0x214]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5e7
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], str.wrong_module__p_for__s_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], ebx
mov edi, dword [ebp - 0x524]
call edi
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5e9
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.wrong_module__p_for__s_n
call fcn.0049fda0
mov dword [esp], ebx
mov eax, dword [ebp - 0x518]
call eax
sub esp, 4
mov edi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x528]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5eb
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x530], edx
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5ec
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 4], str.library_loaded_twice_n
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x110]
mov dword [esp], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x51c]
call ecx
sub esp, 0xc
call fcn.0057d110
lea ecx, [ebp - 0x214]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5ee
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x110]
mov dword [esp], ecx
mov edx, dword [ebp - 0x520]
call edx
lea ecx, [ebp - 0x214]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x110]
movzx eax, al
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], str.got_wrong_path__s____s_n
call fcn.0049fda0
mov eax, dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [esp], edi
mov edi, eax
call eax
sub esp, 4
mov dword [esp], esi
mov dword [ebp - 0x528], edi
call edi
sub esp, 4
mov dword [esp], ebx
mov eax, dword [ebp - 0x518]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x530]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5f3
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x110]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], 0x104
mov ecx, dword [ebp - 0x51c]
call ecx
sub esp, 0xc
call fcn.0057d110
lea ecx, [ebp - 0x110]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5f5
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x520]
call edx
lea edx, [ebp - 0x110]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.got_wrong_path__s____s_n
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x214]
mov dword [esp], ecx
mov edi, dword [ebp - 0x524]
call edi
sub esp, 4
mov edi, eax
call fcn.0057d110
lea edx, [ebp - 0x214]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5f7
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], str.wrong_module__p_for__s_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], ebx
mov edi, dword [ebp - 0x524]
call edi
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5f9
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 8], edi
lea edi, [ebp - 0x214]
mov dword [esp], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.wrong_module__p_for__s_n
call fcn.0049fda0
mov dword [esp], edi
mov eax, dword [ebp - 0x518]
call eax
sub esp, 4
mov edi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x530]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5fb
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5fc
xor eax, eax
cmp esi, edi
sete al
mov dword [esp + 4], str.library_loaded_twice_n
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x110]
mov dword [esp], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x51c]
call ecx
sub esp, 0xc
call fcn.0057d110
lea ecx, [ebp - 0x110]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x5fe
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x520]
call edx
lea edx, [ebp - 0x110]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.got_wrong_path__s____s_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov edi, dword [ebp - 0x528]
call edi
sub esp, 4
mov dword [esp], esi
lea esi, [ebp - 0x41c]
call edi
mov edi, 0x6c
sub esp, 4
mov dword [esp], esi
mov dword [esp + 4], ebx
mov ecx, dword [ebp - 0x534]
call ecx
mov dword [esp], esi
mov dword [esp + 4], 0x5c
mov eax, dword [ebp - 0x52c]
call eax
mov dword [eax], 0x6968745c
mov dword [eax + 4], 0x73692d73
mov dword [eax + 8], 0x6f6e612d
mov dword [eax + 0xc], 0x72656874
mov dword [eax + 0x10], 0x6d616e2d
mov dword [eax + 0x14], 0x6c642e65
mov word [eax + 0x18], di
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_CreateHardLinkA]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x530]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x605
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x52c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateHardLinkA_failed_err__lu_n
mov dword [esp], esi
call fcn.0049fda0
test esi, esi
jne 0x4a4240
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x41c]
lea esi, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [ebp - 0x518]
call eax
sub esp, 4
mov edi, eax
mov eax, 0x609
call fcn.0049f440
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], edi
mov esi, dword [ebp - 0x51c]
call esi
mov eax, 0x60b
sub esp, 0xc
call fcn.0049f440
lea ecx, [ebp - 0x41c]
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x110]
mov dword [esp], ecx
mov edx, dword [ebp - 0x520]
call edx
lea ecx, [ebp - 0x41c]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x110]
movzx eax, al
mov dword [esp + 8], ecx
mov dword [esp + 4], str.got_wrong_path__s____s_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], ebx
mov ecx, dword [ebp - 0x524]
call ecx
sub esp, 4
mov esi, eax
mov eax, 0x60d
call fcn.0049f440
xor eax, eax
cmp edi, esi
mov dword [esp + 8], esi
sete al
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 4], str.wrong_module__p_for__s_n
call fcn.0049fda0
mov dword [esp], ebx
mov eax, dword [ebp - 0x518]
call eax
sub esp, 4
mov esi, eax
mov eax, 0x60f
call fcn.0049f440
mov edx, dword [ebp - 0x52c]
mov eax, dword [edx + 0x34]
mov dword [esp + 4], str.loading_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x610
call fcn.0049f440
xor eax, eax
cmp edi, esi
mov dword [esp + 4], str.library_loaded_twice_n
sete al
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x110]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x104
mov eax, dword [ebp - 0x51c]
call eax
mov eax, 0x612
sub esp, 0xc
call fcn.0049f440
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov edx, dword [ebp - 0x520]
call edx
lea edx, [ebp - 0x214]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x110]
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.got_wrong_path__s____s_n
call fcn.0049fda0
mov dword [esp], esi
mov esi, dword [ebp - 0x528]
mov eax, esi
call eax
mov eax, esi
sub esp, 4
mov dword [esp], edi
call eax
lea eax, [ebp - 0x41c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
jmp 0x4a4225