Function at 0x4f5440
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4f5449
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040569c
mov eax, dword [ebp - 0xc]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4f59e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
cmp dword [eax + 8], 0
jne 0x4f559a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
mov eax, dword [eax + 0x14]
mov edx, 0x4f5a00
call fcn.004055f8
jne 0x4f54ea
push 0x4f5a0c
push dword [ebp - 8]
push 0x4f5a24
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
jmp 0x4f5512
push 0x4f5a0c
push dword [ebp - 8]
push 0x4f5a40
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ecx, dword [eax + 0x270]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004c7424
test al, al
je 0x4f555a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 0x4f5a64
call fcn.00511784
mov byte [ebp - 0x19], 1
jmp 0x4f5743
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 0x4f5aa8
call fcn.00511784
cmp dword [ebp - 0x14], 5
jne 0x4f5582
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 0x4f5ad8
call fcn.00511784
jmp 0x4f558c
push 0x1388
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jne 0x4f551d
jmp 0x4f5743
push 0x4f5b08
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f5b2c
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004c7364
sub al, 1
jb 0x4f5629
je 0x4f56ac
dec al
je 0x4f566e
jmp 0x4f56e8
push 0x4f5b38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f5b2c
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
mov byte [ebp - 0x19], 1
jmp 0x4f5743
push 0x4f5b7c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f5b2c
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
jmp 0x4f56e8
push 0x4f5bac
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f5b2c
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
cmp dword [ebp - 0x14], 5
jne 0x4f572c
push 0x4f5bdc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
push dword [eax + 8]
push 0x4f5bf4
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
jmp 0x4f5736
push 0x1388
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jne 0x4f55f8
cmp byte [ebp - 0x19], 0
je 0x4f59b2
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x14], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x184]
lea eax, [ebp - 0x24]
mov ecx, 0x4f5c1c
call fcn.004054f8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
or ecx, 0xffffffff
mov edx, dword [ebp - 0xc]
call fcn.004dc128
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4f59b2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x194]
mov edx, dword [ebp - 4]
call fcn.004dbed0
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00422ae8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x20]
mov ecx, 0x4f5c34
mov edx, dword [ebp - 0x24]
call fcn.004054f8
push 0x4f5a0c
push dword [ebp - 8]
push 0x4f5c4c
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x14]
call fcn.00409cec
push dword [ebp - 0x50]
push 0x4f5c60
lea eax, [ebp - 0x4c]
mov edx, 5
call fcn.0040556c
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dx, 0x3e7
call fcn.005117ec
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
push 0x4fe27c
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
push 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.004c6b90
sub al, 1
jb 0x4f5993
je 0x4f5859
dec al
je 0x4f58d1
jmp 0x4f59a5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 0x4f5c70
call fcn.00511784
mov eax, dword [ebp - 0x24]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [eax + 0x184]
lea eax, [ebp - 0x54]
mov ecx, 0x4f5c8c
call fcn.004054f8
mov eax, dword [ebp - 0x54]
call fcn.0047b848
mov edx, eax
mov eax, dword [ebp - 0x20]
call fcn.0047b7a0
mov eax, dword [ebp - 0x24]
call fcn.004056ac
push eax
mov eax, dword [ebp - 0x20]
call fcn.004056ac
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x25], 1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x14], edx
mov byte [ebp - 0xd], 1
jmp 0x4f59b2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004fd7fc
add eax, 0x100000
adc edx, 0
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 4]
jne 0x4f58f3
cmp eax, dword [ecx - 8]
ja 0x4f5945
jmp 0x4f58f5
jg 0x4f5945
mov eax, dword [ebp + 8]
mov dword [eax - 0x14], 5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, 0x238
mov edx, 0x4f5ca0
call fcn.0040523c
push 0x4f5ce4
push dword [ebp - 8]
push 0x4f5d04
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x25], 0
jmp 0x4f59b2
mov eax, dword [ebp + 8]
inc dword [eax - 0x14]
cmp dword [ebp - 0x14], 5
jge 0x4f5979
push 0x4f5d34
push dword [ebp - 8]
push 0x4f5d50
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040556c
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00511784
push 0x1388
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 0x20]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4f59a5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, 0x4f5d68
call fcn.00511784
jmp 0x4f59b2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jne 0x4f57c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f59ee
lea eax, [ebp - 0x5c]
mov edx, 0xc
call fcn.0040520c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040520c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040520c
ret