Function at 0x4f0e3c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4f0e44
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f10d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.004f10e4
mov edx, esi
mov eax, dword [0x54974c]
call fcn.004ef5d4
test al, al
je 0x4f0e84
lea eax, [ebx + 8]
mov edx, esi
call fcn.004051f8
jmp 0x4f0e99
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040af48
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.004051f8
lea eax, [ebx + 0x72]
xor ecx, ecx
mov edx, 0xc
call fcn.004039c4
lea eax, [ebx + 0x7e]
xor ecx, ecx
mov edx, 0x324
call fcn.004039c4
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4f0ec7
mov dword [ebx + 0x7e], 0x7fffffff
jmp 0x4f0eca
mov dword [ebx + 0x7e], eax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x4f0edd
mov dword [ebx + 0x82], 0x7fffffff
jmp 0x4f0ee3
mov dword [ebx + 0x82], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x86], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x8a], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x8e], eax
mov dword [ebx + 0x96], 1
movzx eax, word [ebx + 0x28]
mov word [ebx + 0x9e], ax
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x96]
mov eax, ebx
call fcn.004f0a8c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xa0]
call fcn.0040b124
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.0040aec8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x1a0]
call fcn.0040b124
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 8]
call fcn.0040addc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x2a0]
call fcn.0040b124
mov byte [ebp - 1], 0
cmp word [ebx + 0x42], 0
je 0x4f0f89
push 0
lea eax, [ebp - 1]
push eax
lea ecx, [ebx + 0x7e]
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebp - 1], 0
jne 0x4f10af
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.00405414
cmp dword [ebp - 0x18], 0
je 0x4f0fe9
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040f560
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x2a0]
call fcn.0040b124
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x24]
call fcn.0040aa78
lea eax, [ebp - 0x34]
lea edx, [ebx + 0x2a0]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea edx, [ebx + 0x1a0]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov edx, 1
call fcn.004efb28
mov eax, dword [ebp - 0x28]
call fcn.00405650
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [ebx + 0x3a2], eax
xor eax, eax
mov dword [ebx + 0x3a6], eax
xor eax, eax
mov dword [ebx + 0x3aa], eax
push ebx
lea eax, [ebx + 0x7e]
push eax
mov eax, 0x4f0340
push eax
mov eax, 0x4f0314
push eax
mov eax, 0x4f02fc
push eax
mov eax, 0x4f02ec
push eax
mov eax, 0x4f02d4
push eax
mov eax, 0x4f02bc
push eax
mov eax, 0x4f02a4
push eax
mov eax, 0x4f0294
push eax
mov eax, 0x4f0284
push eax
mov eax, 0x4f0350
push eax
lea eax, [ebx + 0x72]
push eax
call fcn.004eef84
add esp, 0x34
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
setne dl
mov eax, ebx
call fcn.004f08d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f10de
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004051c8
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.004051c8
ret