Function at 0x4c0f2c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4c0f34
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c1b34
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x17c], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x4c1aff
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.0040c940
cmp dword [ebp - 0x44], 0
jne 0x4c0f97
mov eax, dword [ebp - 4]
cmp dword [eax + 0x130], 0
je 0x4c1aff
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004b6bdc
mov byte [ebp - 0x31], al
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x12c], edx
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
je 0x4c0fd2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x20], eax
jmp 0x4c0fef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
test eax, eax
je 0x4c0fef
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x114]
je 0x4c0fef
call fcn.004046f4
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x38]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x49]
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x49], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x114]
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 7
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b6bec
mov byte [ebp - 0x3d], al
xor edx, edx
push ebp
push 0x4c1af5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x4c1059
mov dl, 1
mov eax, dword [0x41f898]
call fcn.004046c4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4c1094
mov eax, dword [ebp - 4]
cmp byte [eax + 0x184], 0
jne 0x4c1094
mov eax, dword [ebp - 4]
cmp byte [eax + 0x185], 0
jne 0x4c1094
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4c1094
mov eax, dword [ebp - 4]
call fcn.004bf584
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4c1126
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4c1126
mov byte [ebp - 0x23], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0x1fa], 0
je 0x4c10ff
mov eax, dword [ebp - 4]
push dword [eax + 0x1b4]
push dword [eax + 0x1b0]
mov eax, dword [ebp - 4]
add eax, 0x2a0
push eax
lea eax, [ebp - 0x23]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, eax
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1fc]
call dword [ebx + 0x1f8]
cmp byte [ebp - 0x23], 0
je 0x4c1126
lea edx, [ebp - 0x4c]
mov eax, 0xbb
call fcn.0040d288
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x4b4a68]
call fcn.0041194c
call fcn.00404fa8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4c113e
mov eax, dword [ebp - 4]
call fcn.004b7f14
test eax, eax
jg 0x4c1164
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 0x50]
call fcn.004a7b4c
test al, al
je 0x4c11b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
jne 0x4c11b9
mov eax, dword [ebp - 4]
mov byte [eax + 0x270], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c11a0
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 4]
call fcn.004c3e54
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.004a80f4
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
add eax, 0x2a8
call fcn.0040568c
mov eax, dword [ebp - 4]
call fcn.004c1b68
mov eax, dword [ebp - 4]
call fcn.004b6bfc
push ebp
call fcn.004c060c
pop ecx
jmp 0x4c11f2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c11e0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 4]
add eax, 0x2a8
call fcn.0040568c
mov eax, dword [ebp - 4]
mov byte [eax + 0x270], 0
mov eax, dword [ebp - 4]
call fcn.004c1b68
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1d8]
cmp byte [ebx + 0x21], 0
je 0x4c12f1
cmp byte [ebx + 0x20], 0
je 0x4c12f1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x26c]
mov eax, dword [eax + 0x268]
add eax, 0x2e
adc edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
cdq
call fcn.004068b4
add eax, dword [ebx + 0x18]
adc edx, dword [ebx + 0x1c]
add eax, 0x16
adc edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, word [eax + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x800
adc edx, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4c12f1
xor eax, eax
push ebp
push 0x4c12c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040d884
lea eax, [ebp - 0x60]
mov edx, 0x4c1b50
call fcn.00405914
mov eax, dword [ebp - 0x60]
call fcn.004bdd40
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c12d8
mov eax, ebx
xor edx, edx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
add eax, dword [ecx + 0x18]
adc edx, dword [ecx + 0x1c]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1d8]
movzx eax, byte [ecx + 0x21]
cmp al, 1
jne 0x4c132a
mov eax, dword [ebp - 4]
call fcn.004c1df0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1d8]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
jmp 0x4c137b
cmp al, 2
jne 0x4c137b
cmp dword [ecx + 0x14], 0
jne 0x4c1357
cmp dword [ecx + 0x10], 0
jne 0x4c1357
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
jmp 0x4c137b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
sub eax, dword [ecx + 0x18]
sbb edx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x260], eax
mov dword [ecx + 0x264], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4c13c0
mov eax, dword [ebp - 4]
fild qword [eax + 0x1b0]
fmul dword [0x4c1b54]
mov eax, dword [ebp - 4]
fistp qword [eax + 0x1b0]
wait
mov dword [ebp - 0x38], 0x8074b50
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
mov ecx, 4
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2b0], 0
jne 0x4c14c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4c14c8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x184], 0
jne 0x4c141a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4c14c8
inc ebx
xor esi, esi
push ebp
mov eax, esi
call fcn.004c0e40
pop ecx
inc esi
dec ebx
jne 0x4c1408
jmp 0x4c14c8
push ebp
xor eax, eax
call fcn.004c0e40
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x280], 0
je 0x4c143d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x180]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x180], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x252], 0
je 0x4c14b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x18]
call fcn.00405638
mov eax, dword [ebp - 4]
cmp word [eax + 0x252], 0
je 0x4c1494
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x180]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x254]
call dword [ebx + 0x250]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x180]
test eax, eax
je 0x4c14b8
push 0
push 0
call fcn.0042477c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x180], 0
jne 0x4c141a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0042475c
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa608
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa460
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa5cc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ebx, dword [eax + 0xc]
dec ebx
test ebx, ebx
jl 0x4c1645
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov edx, esi
call fcn.004a5fc8
mov edx, dword [0x4a856c]
call fcn.004048a4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2a4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4c15f8
mov eax, dword [ebp - 4]
call fcn.004c1e78
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a4]
call fcn.004a9cc4
cdq
cmp edx, dword [esp + 4]
jne 0x4c158d
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4c15f8
jmp 0x4c1591
pop edx
pop eax
jle 0x4c15f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0042475c
sub eax, dword [ebp - 0x30]
add dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 4]
call fcn.004c1f8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
xor edx, edx
call fcn.004aa4a4
test esi, esi
jne 0x4c15f8
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa608
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa460
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x270]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x130]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x284]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a4]
call fcn.004a9498
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x2a0]
mov eax, edi
call fcn.004aa488
mov edx, eax
inc edx
mov eax, edi
call fcn.004aa4a4
inc esi
dec ebx
jne 0x4c152e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.0042475c
sub eax, dword [ebp - 0x30]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa57c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4c16b0
mov eax, dword [ebp - 4]
call fcn.004c1e78
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa3f8
cdq
cmp edx, dword [esp + 4]
jne 0x4c16a4
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4c16b0
jmp 0x4c16a8
pop edx
pop eax
jle 0x4c16b0
mov eax, dword [ebp - 4]
call fcn.004c1f8c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa41c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x284]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004aa01c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4c16f5
mov eax, dword [ebp - 4]
call fcn.004c1eb4
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1aff
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c177e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 0
je 0x4c1765
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
call fcn.004aa648
cmp eax, 1
jne 0x4c1765
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebp - 0x3c], 0x30304b50
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
mov ecx, 4
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x284], edx
cmp byte [ebp - 0x19], 0
je 0x4c1a39
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c17ab
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c17ab
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c17cb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x270], 0
je 0x4c17cb
mov eax, dword [ebp - 4]
call fcn.004b6fdc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 2
jne 0x4c1843
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
call fcn.004056d0
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x12c]
inc ecx
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004b8160
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov ebx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ebx
mov eax, dword [ebp - 0x6c]
call fcn.00405ad8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.00405ad8
push eax
call sub.kernel32.dll_MoveFileA_1
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4c1866
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c1866
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c1866
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x270], 0
je 0x4c187c
mov eax, dword [ebp - 4]
call fcn.004c3800
jmp 0x4c1893
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4c1893
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x284], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c5], 0
je 0x4c18a6
push ebp
call fcn.004c0384
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c18ed
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x114], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 7
jmp 0x4c1912
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x29c], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x118], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x4c1947
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c1947
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 0x70]
call fcn.004a7a28
mov eax, dword [ebp - 4]
fstp qword [eax + 0x120]
wait
cmp byte [ebp - 0x21], 0
je 0x4c1967
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c1967
movzx edx, byte [ebp - 0x21]
mov eax, dword [ebp - 4]
call fcn.004b7e5c
jmp 0x4c1990
mov eax, dword [ebp - 4]
cmp byte [eax + 0x271], 0
jne 0x4c1990
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
mov edx, dword [ebp - 4]
mov dword [edx + 0x118], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x298], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x12c]
inc edx
mov eax, dword [ebp - 4]
call fcn.004b6bc8
mov eax, dword [ebp - 4]
cmp word [eax + 0xca], 0
je 0x4c19c6
mov ebx, dword [ebp - 4]
mov ecx, 0x64
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xcc]
call dword [ebx + 0xc8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1d8]
cmp byte [ebx + 0x21], 0
je 0x4c1a66
cmp byte [ebx + 0x20], 0
je 0x4c1a66
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
call fcn.004aa400
test eax, eax
jbe 0x4c1a66
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4c1a11
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004b6ca8
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
call fcn.004b62a8
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x74]
mov edx, 0x4c1b60
call fcn.0040d768
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.004c3990
jmp 0x4c1a66
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x29c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a8]
call fcn.00405ad8
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [ebp - 4]
movzx edx, byte [ebp - 0x21]
mov byte [eax + 0x38], dl
mov eax, dword [ebp - 4]
movzx edx, byte [ebp - 0x22]
mov byte [eax + 0x49], dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x298], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
call fcn.004046f4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2a0], edx
mov eax, dword [ebp - 4]
call fcn.004b6c80
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
je 0x4c1ad1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x130]
mov eax, dword [ebp - 4]
call fcn.004b7528
movzx edx, byte [ebp - 0x31]
mov eax, dword [ebp - 4]
call fcn.004b6bdc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx edx, byte [ebp - 0x3d]
mov eax, dword [ebp - 4]
call fcn.004b6bec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1b3b
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040565c
lea eax, [ebp - 0x68]
mov edx, 0xa
call fcn.0040565c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040565c
ret