Function at 0x4fe8f8
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x284], 0
push 0x104
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
movsx ecx, byte [ebp - 0x27a]
cmp ecx, 0x5c
jne 0x4fe94d
movsx edx, byte [ebp - 0x279]
test edx, edx
jne 0x4fe94d
mov byte [ebp - 0x27a], 0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x178]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5aacdc
lea edx, [ebp - 0x178]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x178]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x178]
push edx
call fcn.00401fca
add esp, 4
push 0x5aace0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jne 0x4fe9fc
lea ecx, [ebp - 0x178]
push ecx
push str._s______Denegado_Acceso_Lectura__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5aad08
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4ff171
push 0
push 0x3c
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 8
add esi, eax
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 0x10
add esi, eax
mov dword [ebp - 0x48], esi
push 0
mov eax, dword [ebp - 0x48]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 8
add esi, eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 0x10
add esi, eax
mov dword [ebp - 4], esi
mov dword [0x5b84b8], 0
jmp 0x4feac2
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0x20
jge 0x4feae2
mov eax, dword [0x5b84b8]
mov byte [ebp + eax - 0x24], 0
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x44], 0
jmp 0x4feab3
push 0
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4feb16
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 6
jge 0x4feb3b
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x24], al
jmp 0x4feb07
push 0
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4feb6f
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 6
jge 0x4feb94
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x44], al
jmp 0x4feb60
push 0x5aad1c
lea edx, [ebp - 0x24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4febd3
push 0x5aad24
lea eax, [ebp - 0x44]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4febd3
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x4ff171
push 0
mov edx, dword [ebp - 0x48]
add edx, 0x78
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov esi, eax
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 8
add esi, eax
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
shl eax, 0x10
add esi, eax
mov dword [ebp - 0x284], esi
push 0
mov ecx, dword [ebp - 0x284]
add ecx, 0x450
push ecx
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4fec66
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x20
jge 0x4fec8b
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x78], al
jmp 0x4fec59
push str.HttpSendRequestA
lea eax, [ebp - 0x78]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4fedb0
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x5b7db4
lea edx, [ebp - 0x27c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fed28
lea eax, [ebp - 0x178]
push eax
push str.El_Fichero__s_nesta_Infectado_por_el_Gusano_ALEMOD._n_nPor_favor__envienos_una_muestra_a__virus_satinfo.es__ny_Restaurelo_con_la_copia_de_Seguridad_arrancando_nen_Modo_Seguro_solo_Simbolo_de_Sistema
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5aae04
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x178]
push ecx
push str._s_____Infectado_con_ALEMOD_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4fedab
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x178]
push eax
push str._s_____Infectado_con_ALEMOD
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
test eax, eax
je 0x4fed76
push 0x5aae54
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x4fed88
push str.__Fichero_Eliminado__n
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x5aae70
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4ff171
mov edx, dword [ebp - 0x284]
sub edx, 0xa30
mov dword [ebp - 0x284], edx
mov dword [0x5b84b8], 0
jmp 0x4feddb
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 8
jge 0x4fedfc
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x58], 0
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x50], 0
jmp 0x4fedce
push str.OLEADM
lea eax, [ebp - 0x24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4feec5
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x11
push ecx
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4fee47
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 4
jge 0x4fee6c
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x58], al
jmp 0x4fee3a
push 0
mov eax, dword [ebp - 4]
add eax, 0x1d
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4feea0
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 4
jge 0x4feec5
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x50], al
jmp 0x4fee91
push str.OLEEXT
lea edx, [ebp - 0x44]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fef90
push 0
mov eax, dword [ebp - 4]
add eax, 0x13
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4fef12
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 4
jge 0x4fef37
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x58], al
jmp 0x4fef03
push 0
mov edx, dword [ebp - 4]
add edx, 0x1f
push edx
mov eax, dword [ebp - 0x280]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4fef6b
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 4
jge 0x4fef90
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x50], al
jmp 0x4fef5c
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0x5aae94
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jne 0x4ff022
lea ecx, [ebp - 0x178]
push ecx
push str.El_Fichero__s_nesta_Infectado_por_el_Gusano_ALEMOD._n_nReinicie_el_Sistema_para_Completar_la_Limpieza.
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5aaefc
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [ebp - 0x178]
push edx
push str._s_____Infectado_con_ALEMOD__Denegado_Acceso_Escritura__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ff171
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4ff053
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0x60
jge 0x4ff070
mov eax, dword [ebp - 0x280]
push eax
push 0
call dword [sym.imp.MSVCRT.dll_fputc]
add esp, 8
jmp 0x4ff044
push 0
mov ecx, dword [ebp - 0x48]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4ff0a2
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 4
jge 0x4ff0ca
mov ecx, dword [ebp - 0x280]
push ecx
mov edx, dword [0x5b84b8]
xor eax, eax
mov al, byte [ebp + edx - 0x58]
push eax
call dword [sym.imp.MSVCRT.dll_fputc]
add esp, 8
jmp 0x4ff095
push 0
mov ecx, dword [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4ff0fc
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 4
jge 0x4ff124
mov ecx, dword [ebp - 0x280]
push ecx
mov edx, dword [0x5b84b8]
xor eax, eax
mov al, byte [ebp + edx - 0x50]
push eax
call dword [sym.imp.MSVCRT.dll_fputc]
add esp, 8
jmp 0x4ff0ef
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebp - 0x178]
push edx
push str._s_____Limpiado_Gusano_ALEMOD_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5aaf6c
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
pop esi
mov esp, ebp
pop ebp
ret