Function at 0x4f6194
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov dword [ebp - 0x414], 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
push str.SYSTEM32
push 0x5b7db4
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f6254
push 0x5b7eb4
push str._sHosts
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [ebp - 0x204]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x206]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x208]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x20a]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x20e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x210]
and ecx, 0xffff
push ecx
push 0x5b7eb4
push str._sHosts__d__02d__02d__02d_02d_02d_
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
jmp 0x4f62d4
push 0x5b7db4
push str._sdriversetcHosts
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp - 0x204]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x206]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x208]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x20a]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x20e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x210]
and eax, 0xffff
push eax
push 0x5b7db4
push str._sdriversetcHosts__d__02d__02d__02d_02d_02d_
lea ecx, [ebp - 0x614]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
push 0
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push ecx
mov ecx, esp
mov dword [ebp - 0x61c], esp
lea eax, [ebp - 0x410]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x620], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x4f63a3
push 0x5a85f8
mov ecx, 0x5b5b78
call fcn.0050f680
cmp dword [0x5b851c], 0
jne 0x4f63a3
push 4
push str.EliStartPage_v50.12
push str.No_Existe_el_Fichero_HOSTS._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4f634f
jmp 0x4f65a2
push str.Creado_HOSTS_por_el_Original._n
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5a8678
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x618], eax
mov edx, dword [ebp - 0x618]
push edx
push 0x5a867c
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x618]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x4f65a2
push 0x5a8698
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x4f63f5
lea edx, [ebp - 0x410]
push edx
push str.Acceso_Denegado_a:___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4f65a2
mov dword [0x5b84b8], 0
jmp 0x4f640e
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x4f642a
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x200], 0
jmp 0x4f6401
mov edx, dword [ebp - 0x618]
push edx
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
lea ecx, [ebp - 0x200]
push ecx
call fcn.00401fca
add esp, 4
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x4f6467
jmp 0x4f64d8
push 0x5a86b8
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f648b
movsx edx, byte [ebp - 0x200]
cmp edx, 0x23
jne 0x4f648d
jmp 0x4f64cb
push str.127.0.0.1
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f64bf
push str._LOCALHOST
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f64cb
mov dword [ebp - 0x414], 1
jmp 0x4f64d8
mov edx, 1
test edx, edx
jne 0x4f63f5
mov eax, dword [ebp - 0x618]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebp - 0x414], 0
jne 0x4f64f6
jmp 0x4f65a2
push 0x5a86d4
mov ecx, 0x5b5b78
call fcn.0050f680
cmp dword [0x5b851c], 0
jne 0x4f65a2
push 4
push str.EliStartPage_v50.12
push str.Detectado_HOSTS_no_Standar._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4f652d
jmp 0x4f65a2
push str.Restaurado_HOSTS_por_el_Original._n
mov ecx, 0x5b5b78
call fcn.0050f680
push 0
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5a875c
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x618], eax
mov edx, dword [ebp - 0x618]
push edx
push str.127.0.0.1_______localhost_n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x618]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov esp, ebp
pop ebp
ret