Function at 0x49f130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
mov eax, dword [0x4be450]
cmp byte [eax], 0
je 0x49f179
cmp bl, 0xff
je 0x49f179
cmp bl, 0xfe
je 0x49f179
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, ebx
call fcn.0049ece4
mov byte [ebp - 9], al
jmp 0x49f480
test bl, bl
jge 0x49f35a
movsx eax, bl
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bec00]
cmp word [edx + eax*2 + 0x250], 0
je 0x49f480
mov eax, dword [ebp - 8]
dec eax
mov ecx, 0x7f
cdq
idiv ecx
inc eax
mov word [ebp - 0x1e], ax
mov ax, word [ebp - 0x1e]
test ax, ax
jbe 0x49f34f
mov word [ebp - 0x22], ax
mov si, 1
movsx eax, bl
push eax
push 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowWord
cmp si, word [ebp - 0x1e]
jae 0x49f1e6
mov edi, 0x7f
jmp 0x49f1f5
mov eax, dword [ebp - 8]
dec eax
mov ecx, 0x7f
cdq
idiv ecx
mov edi, edx
inc edi
push edi
push 2
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowWord
movzx eax, si
dec eax
mov edx, eax
shl eax, 7
sub eax, edx
add eax, dword [ebp - 4]
push eax
mov eax, dword [0x4be798]
movzx eax, word [eax]
push eax
mov eax, dword [0x4be450]
movzx eax, byte [eax]
mov edx, eax
shl eax, 3
sub eax, edx
add eax, 0x401
push eax
mov eax, dword [0x4beb98]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x49f31a
mov edx, dword [0x4be450]
cmp byte [edx], 0
jne 0x49f293
movsx edx, bl
mov ecx, dword [0x4becf0]
movzx edx, word [ecx + edx*2 + 0x54]
imul edx, edi
push edx
movsx edx, bl
mov ecx, dword [0x4becf0]
movzx edx, word [ecx + edx*2 + 0x54]
movzx ecx, si
dec ecx
mov edi, ecx
shl ecx, 7
sub ecx, edi
imul edx, ecx
add edx, dword [ebp + 0xc]
xchg edx, eax
pop ecx
call fcn.004066dc
mov byte [ebp - 0x20], 1
jmp 0x49f31e
push 0
mov eax, dword [0x4beae0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll__lopen
mov dword [ebp - 0x1c], eax
movsx eax, bl
mov edx, dword [0x4becf0]
movzx eax, word [edx + eax*2 + 0x54]
imul edi
push eax
movsx eax, bl
mov edx, dword [0x4becf0]
movzx eax, word [edx + eax*2 + 0x54]
movzx edx, si
dec edx
mov ecx, edx
shl edx, 7
sub edx, ecx
imul edx
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll__lread
mov edx, dword [0x4be6b0]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4beae0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
movsx eax, bl
mov edx, dword [0x4becf0]
movzx eax, word [edx + eax*2 + 0x54]
imul edi
mov edx, dword [0x4be6b0]
cmp eax, dword [edx]
sete byte [ebp - 0x20]
jmp 0x49f31e
mov byte [ebp - 0x20], 0
mov eax, dword [0x4be450]
cmp byte [eax], 0
jne 0x49f33e
push 0
push 0
push 0x402
mov eax, dword [0x4beb98]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebp - 0x20], 0
je 0x49f34f
inc esi
dec word [ebp - 0x22]
jne 0x49f1c6
mov al, byte [ebp - 0x20]
mov byte [ebp - 9], al
jmp 0x49f480
movsx edi, bl
mov eax, dword [0x4be4fc]
cmp byte [eax + edi - 1], 4
jne 0x49f3a7
lea edx, [ebp - 0x1f]
mov eax, ebx
call fcn.00413840
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x4becf0]
movzx eax, word [eax + edi*2 + 0x54]
imul dword [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x1f]
mov edx, dword [0x4bea40]
mov eax, dword [edx + eax*4 - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004132f4
mov byte [ebp - 9], al
jmp 0x49f480
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x4bdd3c
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x49f480
mov eax, dword [ebp - 4]
mov dword [ebp - 0x13], eax
mov ax, word [ebp - 8]
mov word [ebp - 0xf], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd], eax
mov eax, dword [0x4be4fc]
cmp byte [eax + edi - 1], 3
jge 0x49f431
dec ebx
movsx eax, bl
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xffff
lea eax, [ebp - 0x13]
mov dword [ebp - 0x40], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 2
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x49f426
test byte [ebp - 0x28], 1
je 0x49f42a
xor eax, eax
jmp 0x49f42c
mov al, 1
mov byte [ebp - 9], al
jmp 0x49f47a
mov dword [ebp - 0x34], 0x7305
lea eax, [ebp - 0x13]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 0x1c
lea eax, [ebp - 0x40]
push eax
push 6
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x49f471
test byte [ebp - 0x28], 1
je 0x49f475
xor eax, eax
jmp 0x49f477
mov al, 1
mov byte [ebp - 9], al
push esi
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8