Function at 0x48115e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0046e5c1
mov eax, dword [esi + 0x190]
or eax, dword [esi + 0x194]
jne 0x481190
mov eax, dword [0x548aa8]
mov dword [esi + 0x190], eax
mov eax, dword [0x548aac]
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x18c]
mov edx, eax
or edx, ecx
push 0
pop ebx
je 0x481213
cmp dword [esi + 0xc8], ebx
je 0x481213
mov edi, dword [esi + 0x194]
cmp edi, ebx
mov edx, dword [esi + 0x190]
jl 0x4811df
jg 0x4811c3
cmp edx, ebx
jbe 0x4811df
sub eax, dword [0x548aa8]
sbb ecx, dword [0x548aac]
add eax, edx
adc ecx, edi
mov dword [esi + 0x188], eax
mov dword [esi + 0x18c], ecx
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x18c]
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov edx, dword [0x548aa8]
add edx, eax
mov eax, dword [0x548aac]
adc eax, ecx
mov ecx, dword [esi + 0xc8]
push eax
push edx
call fcn.004275f4
test byte [esi + 0xf5], 1
jne 0x481236
cmp dword [esi + 0xc8], ebx
jne 0x481236
cmp dword [esi + 0xc4], ebx
ja 0x481268
jb 0x481236
cmp dword [esi + 0xc0], ebx
ja 0x481268
mov ecx, dword [esi + 0x190]
add ecx, dword [esi + 0x188]
mov eax, dword [esi + 0x194]
adc eax, dword [esi + 0x18c]
mov edx, dword [0x548aac]
cmp edx, eax
jl 0x481268
jg 0x481263
mov eax, dword [0x548aa8]
cmp eax, ecx
jb 0x481268
mov byte [ebp - 1], bl
jmp 0x48126c
mov byte [ebp - 1], 1
test byte [ebp + 8], 2
je 0x48128d
and byte [esi + 0xf4], 0xfe
lea ecx, [esi + 0xb0]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [ebp - 1], bl
call fcn.00428610
lea ecx, [esi + 0xf4]
mov al, byte [ecx]
test al, 1
jne 0x481461
or al, 1
mov byte [ecx], al
mov ecx, esi
call fcn.0047d389
cmp byte [ebp - 1], bl
jne 0x4812c7
mov ecx, esi
call fcn.0047e422
lea edi, [esi + 0x94]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4812c7
call fcn.00447fa4
mov dword [edi], ebx
lea eax, [esi + 0xf0]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x4812d8
mov dword [ecx + 0x40], ebx
mov dword [eax], ebx
mov ecx, esi
call fcn.0047fee3
cmp dword [esi + 0x70], 2
jne 0x4812ee
mov ecx, esi
call fcn.0047e1a0
jmp 0x481308
mov eax, dword [esi + 0xc8]
cmp eax, ebx
je 0x481308
test byte [eax + 0x1cb], 0x80
je 0x481308
or byte [eax + 0x1be], 0x40
mov ecx, dword [esi + 0xc8]
cmp ecx, ebx
je 0x48134b
lea eax, [esi + 4]
push eax
call fcn.0040d268
mov eax, dword [esi + 0xc8]
inc dword [eax + 0x504]
mov eax, dword [esi + 0xc8]
test byte [eax + 0x1cb], 0x80
je 0x481345
cmp dword [eax + 0x2d0], ebx
jne 0x481345
mov byte [eax + 0x508], 3
mov dword [esi + 0xc8], ebx
lea edi, [esi + 0x98]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x48135e
call fcn.00447fa4
mov dword [edi], ebx
lea ecx, [esi + 0x9c]
cmp dword [ecx], 0xffffffff
je 0x48136e
call fcn.0047230d
cmp byte [ebp - 1], bl
jne 0x481397
lea ecx, [esi + 0xa0]
mov eax, dword [ecx]
cmp eax, ebx
je 0x481397
xor edx, edx
cmp word [eax], bx
sete dl
cmp dl, bl
jne 0x481397
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x481435
or byte [esi + 0xf5], 2
mov al, byte [esi + 0xf5]
cmp byte [ebp - 1], bl
je 0x4813cf
and al, 0xfd
mov byte [esi + 0xf5], al
call fcn.0047ccf5
push ebx
push 0x258
lea ecx, [esi + 8]
call fcn.0047ce9b
test byte [ebp + 8], 1
je 0x4813ff
mov ecx, dword [esi + 0x10]
push ebx
push 5
push 1
call fcn.0046f7b5
mov ecx, dword [esi + 0x10]
call fcn.0046f8c4
mov ecx, dword [esi + 0x10]
call fcn.0047069e
lea ecx, [esi + 0xb0]
call fcn.00428610
jmp 0x481430
cmp byte [esi + 0x44], bl
je 0x481421
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x10]
add eax, eax
push eax
add ecx, 0x48
call fcn.0047cec2
mov eax, dword [esi + 0x10]
or dword [eax + 0x80], 0xffffffff
jmp 0x481428
mov ecx, esi
call fcn.0047d389
mov ecx, dword [esi + 0x10]
call fcn.0047069e
mov dword [esi + 0x10], ebx
jmp 0x481461
cmp byte [ebp - 1], bl
je 0x48144a
push ebx
push 0x258
lea ecx, [esi + 8]
call fcn.0047ce9b
jmp 0x481461
test byte [ebp + 8], 4
jne 0x481461
test byte [esi + 0xf5], 2
jne 0x481461
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
call fcn.0046e5dd
pop edi
pop esi
pop ebx
leave
ret 4