Function at 0x5a574c
Capabilities:
Delete file
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x5a5754
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a5d08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005a64b0
test al, al
je 0x5a5792
mov ecx, 0x5a5d24
mov dl, 1
mov eax, dword [0x40eab0]
call fcn.00419fd8
call fcn.00405d54
mov ecx, dword [0x5b6e48]
mov ecx, dword [ecx]
mov edx, dword [0x5b6d50]
mov edx, dword [edx]
lea eax, [ebp - 0x78]
call fcn.00407bac
mov eax, dword [ebp - 0x78]
call fcn.00414b7c
test al, al
je 0x5a582b
mov ecx, dword [0x5b6e48]
mov ecx, dword [ecx]
mov edx, dword [0x5b6d50]
mov edx, dword [edx]
lea eax, [ebp - 0x7c]
call fcn.00407bac
mov ebx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], ebx
mov eax, dword [ebp - 0x80]
call fcn.00407764
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5a582b
push 0x5a5dd8
mov eax, dword [0x5b6d50]
push dword [eax]
mov eax, dword [0x5b6e48]
push dword [eax]
push 0x5a5e24
lea eax, [ebp - 0x84]
mov edx, 4
call fcn.00407c90
mov ecx, dword [ebp - 0x84]
mov dl, 1
mov eax, dword [0x40eab0]
call fcn.00419fd8
call fcn.00405d54
push 0x5a5ebc
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3a8]
test edx, edx
je 0x5a5849
sub edx, 0xffffff20
mov ecx, 0x5a5ecc
call fcn.0040a834
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
call fcn.0047c718
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
xor edx, edx
call fcn.0047c794
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov dl, 1
call fcn.0049fad0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
xor edx, edx
mov dword [eax + 0x138], edx
mov dword [eax + 0x13c], edx
xor edx, edx
mov dword [eax + 0x130], edx
mov dword [eax + 0x134], edx
xor edx, edx
mov dword [eax + 0x110], edx
mov dword [eax + 0x114], edx
mov edx, 0x5a5ee8
call fcn.0049fbe8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov esi, dword [eax + 0x64]
mov eax, dword [esi + 0x10]
movzx ebx, byte [eax + 0x1d]
movzx edx, byte [0x5a5f30]
not edx
and dl, bl
mov eax, esi
call fcn.0045a970
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x90]
mov eax, dword [0x5b7474]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004cd1e4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005a6510
xor edx, edx
push ebp
push 0x5a5caa
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
jne 0x5a5948
mov word [ebp - 0x74], 0x2d
mov word [ebp - 0x72], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
call fcn.0055ca60
mov edx, dword [ebp - 4]
mov dword [eax + 0xb4], edx
mov dword [eax + 0xb0], 0x5a617c
push 0x5a5ebc
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3a8]
test edx, edx
je 0x5a5987
sub edx, 0xffffff20
mov ecx, 0x5a5ecc
call fcn.0040a834
mov eax, dword [ebp - 0x90]
push eax
lea edx, [ebp - 0x8c]
push edx
mov eax, dword [eax]
call dword [eax + 0x2c]
mov ecx, dword [ebp - 0x8c]
mov dl, 1
mov eax, dword [0x434918]
call fcn.0044106c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5a5a48
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff00
mov ecx, dword [0x5b6e48]
mov ecx, dword [ecx]
mov edx, dword [0x5b6d50]
mov edx, dword [edx]
lea eax, [ebp - 0x94]
call fcn.00407bac
mov ecx, dword [ebp - 0x94]
mov dl, 1
mov eax, dword [0x43415c]
call fcn.00440ae8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a5a2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004f14cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a5a32
mov eax, dword [ebp - 0xc]
call fcn.004051b8
ret