Function at 0x4ef791
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
sub esp, 0x58c
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x58c], eax
push 0x18
mov eax, 0x5e9f9b
call fcn.0059ca57
mov edi, dword [ebp + 0x59c]
mov esi, dword [ebp + 0x598]
and dword [ebp - 4], 0
mov ebx, ecx
and dword [ebx + 0x18], 0
push 1
lea ecx, [ebp + 0x438]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], edi
call fcn.004b06db
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00427139
mov byte [ebp - 4], 2
test esi, esi
je 0x4efa8d
test edi, edi
je 0x4efa8d
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.005757d6
and dword [ebp - 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call edi
cmp dword [ebp - 0x14], 0x3e8
jge 0x4ef8dc
mov ecx, ebx
call fcn.004ef0c7
mov dword [ebp - 0x1c], eax
cmp eax, 0x3e7
je 0x4ef8ff
test eax, eax
jge 0x4ef8d2
lea eax, [ebx + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00498be1
xor edi, edi
push edi
push edi
lea ecx, [ebp]
call fcn.00498d2a
mov esi, str.flag
push esi
push edi
lea ecx, [ebp]
call fcn.00499340
lea eax, [ebp]
push eax
push 0x100
lea eax, [ebx + 0x120]
push eax
push 0x631718
push 0x6107e8
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebx + 0x18], 0x14
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0
call fcn.004b0b8e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x58c]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x590
leave
ret 8
inc dword [ebp - 0x14]
push 0xa
jmp 0x4ef815
cmp dword [ebp - 0x1c], 0x3e7
je 0x4ef8ff
push dword [ebp - 0x1c]
lea eax, [ebx + 0x120]
push str.progress_status___d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4ef889
lea eax, [ebx + 0x1c]
push 0x5f6264
push eax
lea ecx, [ebp + 0x438]
call fcn.004b0baa
test eax, eax
jne 0x4ef923
mov dword [ebx + 0x18], 0xe
jmp 0x4ef890
lea ecx, [ebp + 0x438]
call fcn.004b0903
mov dword [ebp - 0x14], eax
inc eax
push eax
call fcn.00564e4a
mov edi, eax
pop ecx
test edi, edi
jne 0x4ef94b
mov dword [ebx + 0x18], 0xf
jmp 0x4ef890
push dword [ebp - 0x14]
lea ecx, [ebp + 0x438]
push edi
call fcn.004b082a
cmp eax, dword [ebp - 0x14]
jne 0x4ef917
lea ecx, [ebp + 0x438]
call fcn.004b0acc
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x14]
push 0xa
push esi
push edi
mov byte [eax + edi], 0
call fcn.00428c76
add esp, 0xc
push edi
call fcn.00564e3f
mov eax, dword [esi + 8]
cmp eax, 2
pop ecx
jge 0x4ef9a2
mov dword [ebx + 0x18], 0x11
jmp 0x4ef890
xor edi, edi
cmp eax, edi
jg 0x4ef9ad
call fcn.00566b22
mov eax, dword [esi + 4]
mov eax, dword [eax]
push 8
push str.LDR_ERR
push eax
call fcn.005a3862
add esp, 0xc
test eax, eax
jne 0x4ef9f8
xor ebx, ebx
inc ebx
push ebx
push edi
mov ecx, esi
call fcn.005759bc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp]
mov dword [eax], ebx
mov byte [ebp - 4], bl
call fcn.0042719c
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0
call fcn.004b0b8e
mov eax, ebx
jmp 0x4ef8ad
cmp dword [esi + 8], edi
jle 0x4ef9a8
mov eax, dword [esi + 4]
mov eax, dword [eax]
push 7
push str.LDR_OK
push eax
call fcn.005a3862
add esp, 0xc
test eax, eax
jne 0x4ef996
cmp dword [esi + 8], edi
jle 0x4ef9a8
mov ecx, dword [esi + 4]
push 7
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d280
mov eax, dword [eax]
mov edi, dword [esi + 8]
push eax
call fcn.0059f541
dec edi
pop ecx
mov ecx, dword [ebp - 0x1c]
cmp eax, edi
setne byte [ebp - 0x15]
add ecx, 0xfffffff0
call fcn.00402490
cmp byte [ebp - 0x15], 0
je 0x4efa59
mov dword [ebx + 0x18], 0x12
jmp 0x4ef890
mov eax, dword [ebp - 0x20]
and dword [eax], 0
push 1
push 0
mov ecx, esi
call fcn.005759bc
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp + 0x438]
mov byte [ebp - 4], 0
call fcn.004b0b8e
xor eax, eax
inc eax
jmp 0x4ef8ad
mov dword [ebx + 0x18], 0x10
jmp 0x4ef890