Function at 0x4d5324
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffa60
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x15a0], edx
mov dword [ebp - 0x159c], edx
mov dword [ebp - 0x1598], edx
mov dword [ebp - 0x1594], edx
mov dword [ebp - 0x1590], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4d573b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x52], 1
mov esi, 4
mov dword [ebp - 0x38], 0x300000
mov dword [ebp - 0x34], 0
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x3cc]
call fcn.00406974
mov edx, dword [ebp - 4]
mov eax, dword [0x4d03c8]
call fcn.004d2abc
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004069ac
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d53ec
mov ebx, 1
jmp 0x4d5710
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1589]
xor ecx, ecx
mov edx, 0x1401
call fcn.004047ec
cmp byte [ebp - 0x52], 0
je 0x4d541b
mov byte [ebp - 0x52], 0
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
push edi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x1400
lea eax, [ebp - 0x1589]
push eax
push edi
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4d5449
mov dword [ebp - 0x24], 2
jmp 0x4d5703
cmp dword [ebp - 0x1c], 0x1400
je 0x4d545e
mov dword [ebp - 0x24], 2
jmp 0x4d5703
cmp dword [ebp - 0x1c], 0
jbe 0x4d56f6
mov eax, dword [ebp - 0x1c]
shr eax, 9
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x39], 1
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4d56ea
inc ebx
lea eax, [ebp - 0x188]
xor ecx, ecx
mov edx, 0x130
call fcn.004047ec
mov eax, dword [ebp - 0x30]
lea eax, [ebp + eax - 0x1589]
lea edx, [ebp - 0x188]
mov ecx, 0x130
call fcn.0040438c
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
add eax, 0x200
adc edx, 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
add eax, 0x200
adc edx, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push 0x4d5758
lea edx, [ebp - 0x1590]
mov eax, esi
call fcn.00412a84
push dword [ebp - 0x1590]
push 0x4d5758
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406ed8
lea eax, [ebp - 0x1594]
lea edx, [ebp - 0x188]
mov ecx, 0x14
call fcn.00406b08
mov eax, dword [ebp - 0x1594]
mov edx, dword [ebp - 8]
call fcn.00406ff8
jne 0x4d56e3
inc esi
mov byte [ebp - 0x52], 1
cmp dword [ebp - 0x6c], 0
jne 0x4d554b
cmp dword [ebp - 0x70], 0
jbe 0x4d56e3
jmp 0x4d5551
jle 0x4d56e3
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov eax, esi
dec eax
push eax
lea ecx, [ebp - 0x188]
mov edx, edi
mov eax, dword [ebp - 0x18]
call fcn.004d47b0
test eax, eax
jle 0x4d5585
mov dword [ebp - 0x24], 3
mov byte [ebp - 0x39], 0
jmp 0x4d56ea
push 0
push 0x200
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
call fcn.00407b48
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0
jne 0x4d55ab
cmp dword [ebp - 0x48], 0
jbe 0x4d55c0
jmp 0x4d55ad
jle 0x4d55c0
mov eax, 0x200
xor edx, edx
sub eax, dword [ebp - 0x48]
sbb edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
add eax, dword [ebp - 0x38]
adc edx, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
cmp esi, 5
jne 0x4d56ea
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.004d4a38
push dword [ebp - 0x10]
push 0x4d5774
lea eax, [ebp - 0x1598]
lea edx, [ebp - 0x174]
mov ecx, 0x82
call fcn.00406b20
push dword [ebp - 0x1598]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00406ed8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00406974
cmp byte [ebp - 0x60], 1
jne 0x4d5678
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4d5657
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4d5657
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.004062b4
mov ebx, eax
test ebx, ebx
je 0x4d5662
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00407060
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.004d5794
cmp byte [ebp - 0x60], 1
jne 0x4d56dd
lea edx, [ebp - 0x159c]
mov eax, dword [0x4d03c8]
call fcn.004d0eb8
mov edx, dword [ebp - 0x159c]
lea eax, [ebp - 0xc]
mov ecx, 0x4d5784
call fcn.00406df4
lea edx, [ebp - 0x15a0]
mov eax, dword [ebp - 0x18]
call fcn.004d4a38
mov eax, dword [ebp - 0x15a0]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004d4c6c
mov eax, dword [ebp - 0x10]
call fcn.004069ac
push eax
call sub.kernel32.dll_DeleteFileW
mov byte [ebp - 0x51], 1
jmp 0x4d56ea
dec ebx
jne 0x4d548c
cmp byte [ebp - 0x39], 0
je 0x4d5703
cmp byte [ebp - 0x51], 0
jne 0x4d5703
cmp dword [ebp - 0x1c], 0x1400
je 0x4d53ec
test edi, edi
je 0x4d570d
push edi
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5742
lea eax, [ebp - 0x15a0]
mov edx, 5
call fcn.00406918
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00406918
ret