Function at 0x47a650
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
cmp dword [eax], 2
jne 0x47a697
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp + 0xc]
add edx, 0xc
push edx
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x10]
jmp 0x47ab95
mov eax, dword [ebp + 0xc]
add eax, 0x214
push eax
call fcn.00497750
add esp, 4
mov dword [ebp - 0x1c], 0
push str.IsWow64Process
push 0x566b24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x47a6dd
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x18]
xor edx, edx
cmp dword [ebp - 0x1c], 0
setne dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x47a850
mov dword [ebp - 0x20], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x8456
mov dword [ebp - 0x30], 0x4287
mov dword [ebp - 0x28], 0x332
mov dword [ebp - 0x2c], 0x3678
mov dword [ebp - 0x38], 0x12
jmp 0x47a729
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x28]
and eax, ecx
mov edx, dword [ebp - 0x2c]
imul edx, edx, 0x12
and edx, 0x23
xor eax, edx
or eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
and ecx, dword [ebp - 0x2c]
or eax, ecx
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x47a757
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x38]
xor edx, 0x19b
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x24]
xor eax, ecx
or edx, eax
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x38], edx
jmp 0x47a77f
mov edx, dword [ebp - 0x34]
add edx, 5
sub edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x38]
and edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
imul eax, eax, 0x48
sar eax, 2
or edx, eax
mov ecx, dword [ebp - 0x20]
sub ecx, edx
mov dword [ebp - 0x20], ecx
jmp 0x47a7a7
mov edx, dword [ebp - 0x30]
add edx, 0x12
xor edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x20]
or edx, eax
mov ecx, dword [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x2c], ecx
jmp 0x47a7c7
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
shl eax, cl
and edx, eax
and edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
jmp 0x47a7e3
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x30]
and ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cdq
idiv dword [ebp - 0x28]
mov esi, edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 0x12
cdq
mov edi, 0x18
idiv edi
and esi, edx
xor ecx, esi
and ecx, dword [ebp - 0x38]
mov dword [ebp - 0x38], ecx
jmp 0x47a817
mov eax, dword [ebp - 0x34]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x2c]
xor eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x24]
and edx, ecx
or eax, edx
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x47a845
mov edx, dword [ebp - 0x20]
mov dword [ebp - 8], edx
jmp 0x47aa17
mov dword [ebp - 0x3c], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x8456
mov dword [ebp - 0x4c], 0x4287
mov dword [ebp - 0x44], 0x332
mov dword [ebp - 0x48], 0x3678
mov dword [ebp - 0x54], 0x12
jmp 0x47a886
pushaw
mov eax, dword [ebp - 0x50]
jmp 0x47a88f
mov ebx, dword [ebp - 0x4c]
jmp 0x47a895
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x54]
jmp 0x47a8a2
mov edi, dword [ebp - 0x44]
and eax, ebx
jmp 0x47a8ab
or eax, esi
and ebx, dword [ebp - 0x40]
jmp 0x47a8b4
add ebx, eax
sub ecx, eax
sub esi, eax
mov dword [ebp - 0x3c], ebx
jmp 0x47a8c0
add edi, esi
and ebx, eax
jmp 0x47a8c9
xor esi, edi
add esi, ebx
jmp 0x47a8d0
sub ecx, esi
add edi, ebx
jmp 0x47a8d8
xor ecx, edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
jmp 0x47a8e4
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x54], esi
jmp 0x47a8f0
popaw
jmp 0x47a8f5
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x44]
and eax, ecx
mov edx, dword [ebp - 0x48]
imul edx, edx, 0x12
and edx, 0x23
xor eax, edx
or eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x48]
or eax, ecx
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
jmp 0x47a923
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x54]
xor edx, 0x19b
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x40]
xor eax, ecx
or edx, eax
add edx, dword [ebp - 0x54]
mov dword [ebp - 0x54], edx
jmp 0x47a94b
mov edx, dword [ebp - 0x50]
add edx, 5
sub edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x54]
and edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
imul eax, eax, 3
imul eax, eax, 0x48
sar eax, 2
or edx, eax
mov ecx, dword [ebp - 0x3c]
sub ecx, edx
mov dword [ebp - 0x3c], ecx
jmp 0x47a973
mov edx, dword [ebp - 0x4c]
add edx, 0x12
xor edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
and eax, dword [ebp - 0x40]
xor eax, dword [ebp - 0x3c]
or edx, eax
mov ecx, dword [ebp - 0x48]
sub ecx, edx
mov dword [ebp - 0x48], ecx
jmp 0x47a993
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
shl eax, cl
and edx, eax
and edx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], edx
jmp 0x47a9af
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x4c]
and ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
cdq
idiv dword [ebp - 0x44]
mov esi, edx
mov eax, dword [ebp - 0x48]
imul eax, eax, 0x12
cdq
mov edi, 0x18
idiv edi
and esi, edx
xor ecx, esi
and ecx, dword [ebp - 0x54]
mov dword [ebp - 0x54], ecx
jmp 0x47a9e3
mov eax, dword [ebp - 0x50]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x48]
xor eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x40]
and edx, ecx
or eax, edx
or eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x47aa11
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00402f90
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403c50
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403d40
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.CryptDiskProtectedSetProcess:_pid_d
call fcn.0047c040
add esp, 8
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
add ecx, 0x214
push ecx
call fcn.0047a540
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47aae5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
je 0x47aa96
cmp dword [ebp - 0x58], 4
je 0x47aac4
jmp 0x47aae3
push 0
push 0
mov ecx, dword [ebp + 0xc]
add ecx, 0x624
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x214
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x41c
push eax
call fcn.0049c3f0
add esp, 0x14
mov dword [ebp - 0xc], eax
jmp 0x47aae3
mov ecx, dword [ebp + 0xc]
add ecx, 0x624
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x214
push edx
call fcn.0049ca60
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x47ab4d
cmp dword [ebp - 4], 1
jne 0x47ab4d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x5c], 1
je 0x47ab01
cmp dword [ebp - 0x5c], 4
je 0x47ab2f
jmp 0x47ab4d
push 0
push 0
mov edx, dword [ebp + 0xc]
add edx, 0x624
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x214
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x41c
push ecx
call fcn.0049b710
add esp, 0x14
mov dword [ebp - 0xc], eax
jmp 0x47ab4d
mov edx, dword [ebp + 0xc]
add edx, 0x624
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x214
push eax
call fcn.0049bf90
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
push ecx
call fcn.00496ad0
add esp, 4
test eax, eax
je 0x47ab6f
mov edx, dword [ebp + 0xc]
add edx, 0xc
push edx
call fcn.00484490
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00403d50
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.CryptDiskProtectedDelProcess:_pid_d
call fcn.0047c040
add esp, 8
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret