Function at 0x4762b4
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, eax
mov eax, dword [0x48dad8]
cmp byte [eax], 4
je 0x4762dd
mov ax, 0x312
call fcn.0040bc04
mov edx, 4
call fcn.00411d74
mov byte [esi + 0x553], 0
mov dl, 0x1a
mov ax, 0x16
call fcn.0042d52c
test eax, eax
je 0x476a54
xor eax, eax
mov dword [esi + 0x474], eax
mov dword [esi + 0x478], eax
mov eax, esi
call fcn.00464bb4
test al, al
je 0x476a54
mov ax, 0x2bc
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d370]
call fcn.00405c48
push 0x476a60
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [esi + 0x14]
call fcn.0040fb28
push eax
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_lstrcatA
push 0x476a64
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d370]
mov dl, 0x3a
call fcn.0040fa38
call fcn.0040f494
mov al, 1
call fcn.0042aef4
test al, al
je 0x476a54
mov eax, dword [0x48d370]
call fcn.00412584
test al, al
je 0x47639b
mov eax, dword [0x48d370]
xor edx, edx
call fcn.00411180
test al, al
je 0x476369
mov al, byte [esi + 0x55d]
test al, al
jle 0x4763ce
cmp al, 0x1a
jg 0x4763ce
movsx eax, al
add eax, 0x40
mov edx, dword [0x48d370]
cmp al, byte [edx]
jne 0x4763ce
mov ax, 0x2fe
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
jmp 0x476369
push 0x2000
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
test edi, edi
jne 0x4763fc
push 0
push 0x2000
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x476a54
push 0
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll__lcreat
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0xffffffff
jne 0x47642e
push edi
call sub.kernel32.dll_GlobalFree
mov edx, dword [0x48d370]
mov ax, 3
call fcn.0040de10
jmp 0x476a54
mov eax, dword [0x48d9a8]
mov byte [eax], 1
mov dl, 7
mov ax, 0x28
call fcn.0042d52c
test eax, eax
je 0x476a54
push 0
push 0x4001
mov eax, dword [0x48db38]
push dword [eax + 4]
push dword [eax]
call fcn.0040bbcc
fistp qword [esp + 0x28]
wait
mov eax, dword [0x48d74c]
mov byte [eax], 7
mov eax, dword [0x48d550]
mov al, byte [eax + 0x189d]
mov edx, dword [0x48d51c]
mov edx, dword [edx]
mov byte [edx + 0x136], al
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x40], 1
mov ax, 0x2f9
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
push esi
push edi
mov esi, 0x476a6c
lea edi, [esp + 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x48d550]
cmp byte [eax + 0x1943], 0
je 0x47651a
push esi
push edi
lea esi, [esp + 0x4c]
lea edi, [esp + 0x6c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x48d9d0]
mov cl, 0x20
call fcn.00403354
push esi
push edi
lea esi, [esp + 0x6c]
lea edi, [esp + 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x48d550]
cmp byte [eax + 0x1944], 0
je 0x47655f
push esi
push edi
lea esi, [esp + 0x4c]
lea edi, [esp + 0x6c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x48d36c]
mov cl, 0x20
call fcn.00403354
push esi
push edi
lea esi, [esp + 0x6c]
lea edi, [esp + 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x48d550]
cmp byte [eax + 0x1945], 0
je 0x4765a4
push esi
push edi
lea esi, [esp + 0x4c]
lea edi, [esp + 0x6c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esp + 0x64]
mov edx, dword [0x48d450]
mov cl, 0x20
call fcn.00403354
push esi
push edi
lea esi, [esp + 0x6c]
lea edi, [esp + 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x48d550]
cmp byte [eax + 0x18c1], 0
je 0x4765c8
mov eax, dword [esi + 0x494]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x498]
mov dword [esp + 0x24], eax
jmp 0x4765d6
fild qword [esi + 0x18]
fsub dword [0x476a8c]
fistp qword [esp + 0x20]
wait
lea eax, [esi + 0xc]
call fcn.00428760
test al, al
jne 0x4765ed
push edi
call sub.kernel32.dll_GlobalFree
jmp 0x476a54
lea eax, [esi + 0xc]
call fcn.00428520
mov ebx, eax
test bl, bl
jne 0x476637
fild qword [esp]
fcomp dword [0x476a90]
fnstsw ax
sahf
jne 0x476637
mov ax, 0x139
call fcn.0040bc04
push eax
mov ax, 0x3f
call fcn.0040bc04
mov ecx, 4
pop edx
call fcn.00411d84
fild qword [esi + 0x18]
fsub dword [0x476a8c]
fistp qword [esi + 0x474]
wait
cmp bl, 1
jne 0x4769b5
mov eax, dword [esi + 0x474]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x478]
mov dword [esp + 0x14], eax
fild qword [esp]
fcomp dword [0x476a90]
fnstsw ax
sahf
jbe 0x476685
mov eax, dword [0x48da44]
mov byte [eax], 0xd
mov eax, dword [0x48da44]
mov byte [eax + 1], 0xa
push 2
mov eax, dword [0x48da44]
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll__hwrite
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push 0
push 0x2000
fild qword [esp + 0x28]
fild qword [esp + 0x18]
fsubp st(1)
fadd dword [0x476a8c]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.0040bb94
call fcn.004028a0
mov ebp, eax
test ebp, ebp
je 0x4769c5
push ebp
lea edx, [esp + 0x14]
lea eax, [esi + 0xc]
mov ecx, edi
call fcn.004254a8
mov dword [esp + 0x3c], eax
cmp ebp, dword [esp + 0x3c]
jg 0x4769c5
mov dword [esp + 0x38], 0xffffffff
mov edx, dword [esp + 0x3c]
mov eax, 0x2000
call fcn.0040bb7c
mov dword [esp + 0x34], eax
mov ebp, dword [esp + 0x34]
dec ebp
test ebp, ebp
jl 0x4767a5
inc ebp
xor eax, eax
mov edx, dword [0x48d550]
cmp byte [edx + 0x1946], 0
jne 0x476735
lea edx, [eax + edi]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x44], edx
jb 0x47679d
mov dword [esp + 0x38], eax
jmp 0x4767a5
lea edx, [eax + edi]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x44], edx
jb 0x476755
lea edx, [eax + edi]
cmp byte [edx], 0
je 0x476755
mov dword [esp + 0x38], eax
jmp 0x4767a5
mov edx, dword [esp + 0x34]
dec edx
cmp eax, edx
jge 0x476779
lea edx, [eax + edi]
cmp byte [edx], 0
jne 0x476779
lea edx, [eax + edi]
inc edx
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x44], edx
jae 0x476794
lea edx, [eax + edi]
inc edx
cmp byte [edx], 0
jne 0x47679d
lea edx, [eax + edi]
mov dl, byte [edx]
and edx, 0xff
bt dword [esp + 0x44], edx
jb 0x47679d
lea edx, [eax + 1]
mov dword [esp + 0x38], edx
jmp 0x4767a5
inc eax
dec ebp
jne 0x47670e
cmp byte [edi], 0xd
jne 0x4767b9
lea eax, [edi + 1]
cmp byte [eax], 0xa
jne 0x4767b9
mov eax, 2
jmp 0x4767bb
xor eax, eax
cmp dword [esp + 0x38], 0xffffffff
jne 0x4767ca
mov ebp, dword [esp + 0x3c]
sub ebp, eax
jmp 0x4767d0
mov ebp, dword [esp + 0x38]
sub ebp, eax
push ebp
add eax, edi
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll__hwrite
mov dword [esp + 0x84], eax
fild dword [esp + 0x84]
fild qword [esp]
faddp st(1)
fistp qword [esp]
wait
cmp ebp, eax
jle 0x47680d
mov edx, dword [0x48d370]
mov ax, 5
call fcn.0040de10
jmp 0x4769c5
cmp dword [esp + 0x38], 0xffffffff
je 0x476685
fild dword [esp + 0x38]
fild qword [esp + 0x18]
faddp st(1)
fistp qword [esi + 0x474]
wait
fld xword [0x476a94]
fild qword [esp + 8]
fmulp st(1)
fild qword [esp]
fcompp
fnstsw ax
sahf
jbe 0x47689f
mov ax, 0x2f9
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d830]
call fcn.00405c48
push 0x476a60
mov eax, dword [0x48d830]
push eax
call sub.kernel32.dll_lstrcatA
push dword [esp + 4]
push dword [esp + 4]
call fcn.00412abc
push eax
mov eax, dword [0x48d830]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d830]
push eax
mov eax, dword [0x48db04]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [0x48d8b8]
cmp byte [eax], 0
je 0x4768b3
mov eax, dword [0x48dad8]
cmp byte [eax], 4
je 0x4768e4
fild qword [esp]
fcomp dword [0x476aa0]
fnstsw ax
sahf
jb 0x4768e4
mov ax, 0x313
call fcn.0040bc04
push eax
mov ax, 0x312
call fcn.0040bc04
mov ecx, 4
pop edx
call fcn.00411d84
jmp 0x4769c5
mov eax, dword [esp + 0x30]
call fcn.00412ed4
fadd dword [0x476aa4]
fild qword [esp + 0x28]
fcompp
fnstsw ax
sahf
jae 0x4769b5
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [0x48d370]
mov eax, dword [0x48da44]
call fcn.00405c48
mov eax, dword [0x48da44]
mov dl, 0x2e
call fcn.00405e00
test eax, eax
je 0x47692f
mov byte [eax], 0
push 0x476aa8
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
fild dword [esp + 0x40]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004123c0
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d4fc]
push eax
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48da44]
call fcn.00412584
test al, al
je 0x476985
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x48da44]
push eax
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4769c5
push 0
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll__lcreat
mov dword [esp + 0x30], eax
inc dword [esp + 0x40]
mov byte [esi + 0x553], 1
cmp bl, 1
je 0x4765ed
mov eax, dword [esp + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [esi + 0xc]
call fcn.00428820
push edi
call sub.kernel32.dll_GlobalFree
call fcn.0040eb04
fild qword [esp]
fcomp dword [0x476a90]
fnstsw ax
sahf
jne 0x4769fd
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x476a4d
push dword [esp + 4]
push dword [esp + 4]
call fcn.00412abc
mov edx, dword [0x48da44]
mov eax, dword [0x48d830]
call fcn.00405c48
mov ax, 0x1eb
call fcn.0040bc04
mov edx, dword [0x48d370]
call fcn.0040f5a0
mov edx, dword [0x48d830]
mov eax, dword [0x48da44]
call fcn.0040f5a0
mov eax, dword [0x48da44]
mov edx, 4
call fcn.00411d74
mov byte [esi + 0x553], 0
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret