Function at 0x4e19cc
Capabilities:
Copy file
Delete file
Manipulate boot configuration
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x4e19d5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
call fcn.0040685c
xor eax, eax
push ebp
push 0x4e2d95
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1e], 1
xor edx, edx
push ebp
push 0x4e2c5b
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x1d], 0
je 0x4e1ad1
push 2
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x408]
call fcn.004a6474
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
call fcn.004214dc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x54]
mov ecx, 0x4e2db8
call fcn.00406d58
mov eax, dword [ebp - 0x54]
mov ecx, 0x4e2ddc
mov edx, 0x4e2dfc
call fcn.004da964
lea edx, [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.00420a20
push 2
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x40c]
call fcn.004a6474
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
call fcn.004214dc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x6b8]
lea eax, [ebp - 0x7c]
mov ecx, 0x4e2db8
call fcn.00406d58
mov eax, dword [ebp - 0x7c]
mov ecx, 0x4e2e1c
mov edx, 0x4e2dfc
call fcn.004da964
lea edx, [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00420a20
jmp 0x4e1aeb
lea eax, [ebp - 4]
mov edx, 0x4e2e3c
call fcn.004068c8
lea eax, [ebp - 8]
mov edx, 0x4e2e68
call fcn.004068c8
test bl, bl
jne 0x4e208c
mov byte [ebp - 0x1f], 1
call fcn.004d8fdc
test al, al
jne 0x4e1e22
movzx ebx, byte [ebp - 0x1d]
xor bl, 1
test bl, bl
je 0x4e1bad
push 2
lea eax, [ebp - 0x9c]
xor edx, edx
call fcn.004214dc
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xa0]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0xa0]
mov ecx, 0x4e2e98
mov edx, 0x4e2eb4
call fcn.004da964
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xb4]
mov edx, 0x4e2ed8
call fcn.00406c98
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
call fcn.004214dc
lea edx, [ebp - 0xb0]
pop eax
call fcn.004229d4
setne byte [ebp - 0x1f]
movzx eax, byte [ebp - 0x1f]
and al, byte [ebp + 0xc]
je 0x4e1bba
mov byte [ebp - 0x1f], 0
push 0
lea ecx, [ebp - 0xb8]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xb8]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0xb8]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
lea ecx, [ebp - 0xbc]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xbc]
mov edx, 0x4e2ef0
call fcn.00406c98
mov eax, dword [ebp - 0xbc]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp byte [ebp - 0x1f], 0
je 0x4e1c89
test bl, bl
je 0x4e1c89
push 0
lea ecx, [ebp - 0xc0]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xc0]
mov edx, 0x4e2ef0
call fcn.00406c98
mov eax, dword [ebp - 0xc0]
call fcn.00406900
push eax
lea ecx, [ebp - 0xc4]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xc4]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0xc4]
call fcn.00406900
push eax
call sub.kernel32.dll_CopyFileW
test bl, bl
je 0x4e1cfc
lea ecx, [ebp - 0xd8]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xd8]
mov edx, 0x4e2ed8
call fcn.00406c98
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.004214dc
lea eax, [ebp - 0xd4]
push eax
push 2
lea ecx, [ebp - 0xdc]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xdc]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0xdc]
mov ecx, 0x4e2e98
mov edx, 0x4e2eb4
call fcn.004dabcc
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 8]
call fcn.004214dc
lea eax, [ebp - 0xec]
push eax
push 2
lea ecx, [ebp - 0xf0]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0xf0]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0xf0]
mov ecx, 0x4e2f10
mov edx, 0x4e2eb4
call fcn.004dabcc
lea eax, [ebp - 0x100]
mov edx, dword [ebp - 4]
call fcn.004214dc
lea eax, [ebp - 0x100]
push eax
push 2
lea ecx, [ebp - 0x104]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x104]
mov edx, 0x4e2ed8
call fcn.00406c98
mov eax, dword [ebp - 0x104]
push eax
lea ecx, [ebp - 0x108]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x108]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0x108]
mov edx, 0x4e2f2c
pop ecx
call fcn.004dabcc
push 7
lea ecx, [ebp - 0x10c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x10c]
mov edx, 0x4e2e78
call fcn.00406c98
mov eax, dword [ebp - 0x10c]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
push 7
lea ecx, [ebp - 0x110]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x110]
mov edx, 0x4e2ef0
call fcn.00406c98
mov eax, dword [ebp - 0x110]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
jmp 0x4e21b5
mov eax, dword [ebp - 0x1c]
call fcn.004eb798
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4e1ece
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4e1eb8
lea ecx, [ebp - 0x114]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x114]
mov eax, 0x4e2f5c
call fcn.004072dc
test eax, eax
jle 0x4e1eb2
cmp byte [ebp - 0x1d], 0
jne 0x4e1ea2
lea ecx, [ebp - 0x118]
mov edx, ebx
sub edx, 2
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x118]
mov eax, 0x4e2e98
call fcn.004072dc
test eax, eax
sete byte [ebp - 0x1f]
cmp byte [ebp + 0xc], 0
je 0x4e1eac
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x20], 1
jmp 0x4e1eb8
dec ebx
cmp ebx, 0xffffffff
jne 0x4e1e4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1ed5
mov eax, dword [ebp - 0x24]
call fcn.00404da0
ret
push 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x47c]
mov edx, 0x4e3188
mov eax, 0x4e31a8
call fcn.004d912c
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x47c]
call fcn.00411eb8
test al, al
je 0x4e21b1
xor eax, eax
push ebp
push 0x4e21aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x41c]
call fcn.004a6474
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x10]
call fcn.0041126c
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x47c]
push 0x4e31c4
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x6b8]
push 0x4e31dc
push dword [ebp - 8]
push 0x4e322c
push dword [ebp - 0x10]
push 0x4e3244
push dword [ebp - 0x10]
push 0x4e3270
lea ecx, [ebp - 0x14c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
mov edx, dword [ebp - 0x14c]
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x1c]
call fcn.004ea644
mov eax, dword [ebp - 0x148]
mov edx, 1
call fcn.00411af8
dec eax
lea edx, [ebp - 0x144]
call fcn.00411860
push dword [ebp - 0x144]
push 0x4e329c
lea eax, [ebp - 0x140]
mov edx, 0xc
call fcn.00406e3c
mov eax, dword [ebp - 0x140]
xor edx, edx
call fcn.004d72d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e21b1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x47c]
call fcn.00406900
push eax
call sub.kernel32.dll_DeleteFileW
ret
mov byte [ebp - 0x1e], 1
mov eax, dword [ebp - 0x1c]
call fcn.004eb238
test al, al
jne 0x4e2c51
cmp byte [ebp + 0xc], 0
jne 0x4e2246
lea ecx, [ebp - 0x150]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x150]
mov edx, 0x4e2ed8
call fcn.00406c98
mov ebx, dword [ebp - 0x150]
lea ecx, [ebp - 0x154]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x154]
mov edx, 0x4e32ac
call fcn.00406c98
mov esi, dword [ebp - 0x154]
mov dword [ebp - 0x158], esi
mov eax, dword [ebp - 0x158]
call fcn.00406900
push eax
mov dword [ebp - 0x15c], ebx
mov eax, dword [ebp - 0x15c]
call fcn.00406900
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x160]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x160]
mov edx, 0x4e2ed8
call fcn.00406c98
mov eax, dword [ebp - 0x160]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
lea ecx, [ebp - 0x164]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x164]
mov edx, 0x4e2ed8
call fcn.00406c98
mov ecx, dword [ebp - 0x164]
mov edx, 0x4e2ed8
mov eax, 0x4e31a8
call fcn.004d912c
cmp byte [ebp - 0x1d], 0
je 0x4e22ea
cmp dword [ebp + 8], 0
je 0x4e22ea
lea ecx, [ebp - 0x168]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x168]
mov edx, 0x4e2ed8
call fcn.00406c98
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp + 8]
call fcn.004d9a94
push 7
lea ecx, [ebp - 0x16c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x16c]
mov edx, 0x4e2ed8
call fcn.00406c98
mov eax, dword [ebp - 0x16c]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
call fcn.004d8fdc
test al, al
je 0x4e2448
cmp byte [ebp + 0xc], 0
jne 0x4e23ab
lea ecx, [ebp - 0x170]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x170]
mov edx, 0x4e32c8
call fcn.00406c98
mov ebx, dword [ebp - 0x170]
lea ecx, [ebp - 0x174]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x174]
mov edx, 0x4e32e8
call fcn.00406c98
mov esi, dword [ebp - 0x174]
mov dword [ebp - 0x158], esi
mov eax, dword [ebp - 0x158]
call fcn.00406900
push eax
mov dword [ebp - 0x15c], ebx
mov eax, dword [ebp - 0x15c]
call fcn.00406900
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x178]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x178]
mov edx, 0x4e32c8
call fcn.00406c98
mov eax, dword [ebp - 0x178]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
lea ecx, [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x17c]
mov edx, 0x4e32c8
call fcn.00406c98
mov ecx, dword [ebp - 0x17c]
mov edx, 0x4e3308
mov eax, 0x4e31a8
call fcn.004d912c
push 7
lea ecx, [ebp - 0x180]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x180]
mov edx, 0x4e32c8
call fcn.00406c98
mov eax, dword [ebp - 0x180]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp byte [ebp + 0xc], 0
jne 0x4e24c9
lea ecx, [ebp - 0x184]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x184]
mov edx, 0x4e331c
call fcn.00406c98
mov ebx, dword [ebp - 0x184]
lea ecx, [ebp - 0x188]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x188]
mov edx, 0x4e333c
call fcn.00406c98
mov esi, dword [ebp - 0x188]
mov dword [ebp - 0x158], esi
mov eax, dword [ebp - 0x158]
call fcn.00406900
push eax
mov dword [ebp - 0x15c], ebx
mov eax, dword [ebp - 0x15c]
call fcn.00406900
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
push 0
lea ecx, [ebp - 0x18c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x18c]
mov edx, 0x4e331c
call fcn.00406c98
mov eax, dword [ebp - 0x18c]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
lea ecx, [ebp - 0x190]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x190]
mov edx, 0x4e331c
call fcn.00406c98
mov ecx, dword [ebp - 0x190]
mov edx, 0x4e335c
mov eax, 0x4e31a8
call fcn.004d912c
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4e25c2
lea eax, [ebp - 0x194]
call fcn.004d8eb4
mov edx, dword [ebp - 0x194]
lea eax, [ebp - 0x14]
mov ecx, 0x4e3370
call fcn.00406d58
push 1
mov ecx, dword [ebp - 0x14]
mov edx, 0x4e3390
mov eax, 0x4e31a8
call fcn.004d912c
mov eax, dword [ebp - 0x14]
call fcn.00411eb8
test al, al
je 0x4e25c2
lea ecx, [ebp - 0x198]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x198]
mov edx, 0x4e331c
call fcn.00406c98
mov eax, dword [ebp - 0x198]
mov edx, dword [ebp - 0x14]
call fcn.004dd284
mov eax, dword [ebp - 0x14]
call fcn.00406900
push eax
call sub.kernel32.dll_DeleteFileW
cmp byte [ebp - 0x1d], 0
je 0x4e2b0a
lea edx, [ebp - 0x19c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x480]
call fcn.00412324
mov eax, dword [ebp - 0x19c]
call fcn.004d9e0c
push 7
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x480]
call fcn.00412360
mov eax, dword [ebp - 0x1a0]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x480]
mov cl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004e6074
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x6cc], 1
mov dl, 1
mov eax, dword [0x427864]
call fcn.004331e0
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x4e28ab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1b0]
call fcn.004d8e88
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.00412420
mov edx, dword [ebp - 0x1ac]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
call fcn.004ea740
mov eax, dword [ebp - 0x1a8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c8]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
lea eax, [ebp - 0x1bc]
call fcn.004d8e88
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x480]
mov dword [ebp - 0x1b4], eax
lea edx, [ebp - 0x1b8]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004e5ca8
xor al, 1
push eax
push 0x4e33b0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c]
add edx, 0x4a8
mov ecx, 0x105
call fcn.00406a84
lea eax, [ebp - 0x1c0]
mov edx, 0x4e33c8
call fcn.00406c98
mov edx, dword [ebp - 0x1c0]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
call fcn.004e928c
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x1c4]
mov edx, dword [ebp - 0x1c]
add edx, 0x4a8
mov ecx, 0x105
call fcn.00406a84
lea eax, [ebp - 0x1c4]
mov edx, 0x4e33e4
call fcn.00406c98
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
call dword [edx + 0x44]
push 1
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d4]
call fcn.004d8e88
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.00412420
mov edx, dword [ebp - 0x1d0]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
call fcn.004ea740
mov eax, dword [ebp - 0x1cc]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c8]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
lea eax, [ebp - 0x1d8]
call fcn.004d8e88
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x480]
mov dword [ebp - 0x1b4], eax
lea edx, [ebp - 0x1b8]
mov ecx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004e5ca8
xor al, 1
push eax
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1dc]
mov edx, dword [ebp - 0x1c]
add edx, 0x4a8
mov ecx, 0x105
call fcn.00406a84
lea eax, [ebp - 0x1dc]
mov edx, 0x4e3400
call fcn.00406c98
mov edx, dword [ebp - 0x1dc]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
call fcn.004e928c
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x1e0]
mov edx, dword [ebp - 0x1c]
add edx, 0x4a8
mov ecx, 0x105
call fcn.00406a84
lea eax, [ebp - 0x1e0]
mov edx, 0x4e341c
call fcn.00406c98
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e28b2
mov eax, dword [ebp - 0x28]
call fcn.00404da0
ret
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x394]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4e2c1e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x468]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x4e2c1e
cmp byte [ebp - 0x1d], 0
jne 0x4e2c1e
mov dl, 1
mov eax, dword [0x427864]
call fcn.004331e0
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x4e2c17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x214]
call fcn.004de930
mov edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x218]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 0x18]
mov ecx, 0x4e3438
call fcn.00406d58
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 0
push 0x4fafda34
mov eax, dword [ebp - 0x18]
call fcn.004da840
mov eax, dword [ebp - 0x18]
call fcn.00411eb8
test al, al
je 0x4e2c01
lea ecx, [ebp - 0x21c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x21c]
mov edx, 0x4e331c
call fcn.00406c98
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x18]
call fcn.004dd284
mov eax, dword [ebp - 0x18]
call fcn.00406900
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2c1e
mov eax, dword [ebp - 0x2c]
call fcn.00404da0
ret
push 7
lea ecx, [ebp - 0x220]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004e9c78
lea eax, [ebp - 0x220]
mov edx, 0x4e331c
call fcn.00406c98
mov eax, dword [ebp - 0x220]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2c69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2d9f
lea eax, [ebp - 0x220]
mov edx, 0x1a
call fcn.0040686c
lea eax, [ebp - 0x1b0]
mov edx, 0x15
call fcn.0040686c
lea eax, [ebp - 0x154]
mov edx, 6
call fcn.0040686c
lea eax, [ebp - 0x13c]
call fcn.00406864
lea eax, [ebp - 0x138]
mov edx, 0xe
call fcn.0040686c
lea eax, [ebp - 0x100]
call fcn.0041c258
lea eax, [ebp - 0xf0]
call fcn.00406864
lea eax, [ebp - 0xec]
call fcn.0041c258
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.0040686c
lea eax, [ebp - 0xd4]
call fcn.0041c258
lea eax, [ebp - 0xc4]
mov edx, 5
call fcn.0040686c
lea eax, [ebp - 0xb0]
call fcn.0041c258
lea eax, [ebp - 0xa0]
call fcn.00406864
lea eax, [ebp - 0x9c]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x7c]
call fcn.00406864
lea eax, [ebp - 0x78]
call fcn.00406864
lea eax, [ebp - 0x74]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x54]
call fcn.00406864
lea eax, [ebp - 0x50]
call fcn.00406864
lea eax, [ebp - 0x4c]
mov edx, dword [0x401278]
mov ecx, 2
call fcn.0040763c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040686c
lea eax, [ebp + 8]
call fcn.00406864
ret