Function at 0x4f3740
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7acaa7
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
cmp dword [ebp + 0xc], 1
jne 0x4f395d
push 0
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x248]
mov eax, dword [edx + 0x2c]
call eax
push 1
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 0x248]
add ecx, 0x360
call fcn.00403c80
push eax
lea ecx, [ebp - 0x220]
call fcn.004068d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.006436d0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.00405ef0
mov ecx, dword [ebp - 0x248]
add ecx, 0x3d0
call fcn.00403c80
push eax
lea ecx, [ebp - 0x10]
call fcn.00406470
push eax
call fcn.00723690
add esp, 8
test eax, eax
je 0x4f384c
mov edx, dword [ebp - 0x248]
mov dword [edx + 0x3ec], 2
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov eax, dword [ebp - 0x224]
jmp 0x4f3af3
push 0x7eaf8c
lea ecx, [ebp - 0x240]
call fcn.00403bf0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x248]
add eax, 0x37c
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.006156e0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x240]
call fcn.00403c30
mov edx, dword [ebp - 0x248]
add edx, 0x398
push edx
mov ecx, dword [ebp - 0x248]
add ecx, 0x37c
call fcn.00405350
mov ecx, dword [ebp - 0x248]
add ecx, 0x37c
call fcn.00403c80
push eax
mov ecx, dword [ebp - 0x248]
add ecx, 0x360
call fcn.00403c80
push eax
call fcn.00645ba0
add esp, 8
test eax, eax
jge 0x4f390c
mov eax, dword [ebp - 0x248]
mov dword [eax + 0x3ec], 3
mov dword [ebp - 0x244], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov eax, dword [ebp - 0x244]
jmp 0x4f3af3
push 4
push 0
mov ecx, dword [ebp - 0x248]
add ecx, 0x360
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x248]
mov dword [ecx + 0x3ec], 0
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x248]
call fcn.005a45f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
jmp 0x4f3af1
cmp dword [ebp + 0xc], 2
jne 0x4f3af1
mov edx, dword [ebp - 0x248]
cmp dword [edx + 0x354], 0
je 0x4f3adf
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x354]
call fcn.005be870
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x14
jae 0x4f3a29
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x354]
call fcn.005be880
mov ecx, dword [ebp - 0x248]
cmp dword [ecx + 0x358], 0
je 0x4f3a24
xor edx, edx
mov word [ebp - 0x11c], dx
push 0xfa
push 0
lea eax, [ebp - 0x11a]
push eax
call fcn.007202b0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
push 0x7eafb8
push 0x7e
lea edx, [ebp - 0x11c]
push edx
call fcn.007259fa
add esp, 0x10
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 0x358]
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x358]
mov edx, dword [edx]
mov eax, dword [edx + 0x30]
call eax
jmp 0x4f3add
cmp dword [ebp - 0x14], 0x14
jb 0x4f3acb
cmp dword [ebp - 0x14], 0x5a
jae 0x4f3acb
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x354]
call fcn.005be880
mov ecx, dword [ebp - 0x248]
cmp dword [ecx + 0x358], 0
je 0x4f3ac9
xor edx, edx
mov word [ebp - 0x21c], dx
push 0xfa
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.007202b0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
push 0x7eafc4
push 0x7e
lea edx, [ebp - 0x21c]
push edx
call fcn.007259fa
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 0x358]
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x358]
mov edx, dword [edx]
mov eax, dword [edx + 0x30]
call eax
jmp 0x4f3add
push 2
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4f3af1
push 2
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret 0x10