Function at 0x454f90
Capabilities:
Contain obfuscated stackstrings
Copy file
Delete file
Get hostname
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba1dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6b4
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x2be]
mov word [ebp - 0x2c0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x1404c10]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x2c0]
push eax
push ecx
mov dword [ebp - 4], ebx
mov word [ebp - 0x22], bx
mov word [ebp - 0x24], 1
mov word [ebp - 0x52], bx
mov word [ebp - 0x54], 3
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x44]
push edx
call sub.MFC42u.DLL_CString::CString_2
push str.soft_new.cfg
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x2c0]
lea ecx, [ebp - 0x2c]
push eax
call sub.MFC42u.DLL_CString::CString_2
push str.soft_old.cfg
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [ebp - 0x70]
call fcn.004b0208
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.004b0208
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x50]
call sub.MFC42u.DLL_CString::CString_2
push str.soft_change.cfg
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call sub.MFC42u.DLL_CString::operator_1
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x4c]
push edx
call sub.MFC42u.DLL_CString::CString_2
push str.soft_mini.cfg
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x2c0]
lea ecx, [ebp - 0x48]
push eax
call sub.MFC42u.DLL_CString::CString_2
push str.software.cfg
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 7
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [ebp - 0xac]
call fcn.004b0574
push ebx
mov byte [ebp - 4], 8
push 0x1002
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0xac]
call sub.MFC42u.DLL_CStdioFile::Open
cmp eax, ebx
jne 0x455156
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 7
call sub.MFC42u.DLL_CStdioFile::CStdioFile
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x6be]
mov word [ebp - 0x6c0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x88]
lea eax, [ebp - 0x6c0]
push edx
push eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x88], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0x6c0]
push ecx
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CString::operator_1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x30]
push edx
call sub.MFC42u.DLL_CString::operator_1
push 0x52ff14
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x30]
push eax
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00455c00
add esp, 4
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.004b0394
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call sub.MFC42u.DLL_CString::CString
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x30]
push edx
call sub.MFC42u.DLL_CString::operator_1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x5c]
call sub.MFC42u.DLL_CString::CString_2
mov byte [ebp - 4], 0xb
xor esi, esi
cmp esi, 4
mov dword [ebp - 0x1c], esi
jge 0x4554ab
cmp esi, 1
mov eax, reloc.WS2_32.dll_bind
mov ecx, 0x20119
jne 0x45522d
jmp 0x455248
cmp esi, 2
jne 0x45523e
mov eax, reloc.WS2_32.dll_accept
mov ecx, 0x20119
jmp 0x45524d
cmp esi, 3
jne 0x45524d
mov eax, reloc.WS2_32.dll_accept
mov ecx, 0x20019
lea edx, [ebp - 0x34]
push edx
push ecx
mov ecx, dword [ebp - 0x5c]
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4554a5
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x4be]
mov word [ebp - 0x4c0], 0
lea edx, [ebp - 0x4c0]
push 0x1fe
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x34]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xd
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c0]
push str.DisplayName
push ecx
push edx
mov byte [ebp - 4], 0xf
call fcn.00423da0
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.004b0454
mov eax, dword [ebp - 0x14]
push 0x4e28c0
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x455465
mov ecx, dword [ebp - 0x14]
push str.WebFldrs
push ecx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x455465
mov edx, dword [ebp - 0x20]
push 0x4e28c0
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x455356
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x4c0]
push str.UninstallString
push eax
push ecx
call fcn.00423da0
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
call fcn.004b0454
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x4c0]
push str.Publisher
push edx
push eax
call fcn.00423da0
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.004b0454
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c0]
push str.DisplayVersion
push ecx
push edx
call fcn.00423da0
add esp, 0xc
lea ecx, [ebp - 0x40]
push eax
call fcn.004b0454
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x24]
push ecx
push edx
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
push eax
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
push edx
push eax
push ecx
lea edx, [ebp - 0x3c]
push str._s_s_s_s_s_s_s_s
push edx
mov byte [ebp - 4], 0x10
call sub.MFC42u.DLL_CString::Format
mov eax, dword [ebp - 0x14]
add esp, 0x28
push 0x4dc28c
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x4553f7
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004b0394
push 0x4d0edc
push 0x4d39dc
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::Replace
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x3c]
push edx
push eax
lea ecx, [ebp - 0x70]
call sub.MFC42u.DLL_CStringArray::SetAtGrow
push 0x4d39d8
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00428bd0
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [ebp - 0xac]
call sub.MFC42u.DLL_CStdioFile::Write
push esi
call fcn.00428c40
add esp, 4
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xf
call sub.MFC42u.DLL_CString::CString
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x40]
inc ebx
mov byte [ebp - 4], 0xe
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xd
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call sub.MFC42u.DLL_CString::CString
cmp dword [ebp - 0x38], 0x103
jne 0x455268
xor ebx, ebx
inc esi
jmp 0x455210
lea ecx, [ebp - 0xac]
call sub.MFC42u.DLL_CStdioFile::Close
lea ecx, [ebp - 0x98]
call sub.MFC42u.DLL_CFile::CFile
mov edx, dword [ebp - 0x4c]
push ebx
push 0x1002
push edx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x11
call sub.MFC42u.DLL_CFile::Open
cmp eax, ebx
je 0x455519
mov eax, dword [ebp - 0x30]
push eax
call fcn.00428bd0
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [ebp - 0x98]
call sub.MFC42u.DLL_CFile::Write
lea ecx, [ebp - 0x98]
call sub.MFC42u.DLL_CFile::Close
push esi
call fcn.00428c40
add esp, 4
push ecx
lea edx, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x38], esp
push edx
call sub.MFC42u.DLL_CString::CString_3
lea eax, [ebp - 0x58]
push eax
call fcn.00427c70
add esp, 8
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x12
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x4d39d8
call sub.MFC42u.DLL_CString::CString_2
push ecx
lea edx, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
mov byte [ebp - 4], 0x13
call sub.MFC42u.DLL_CString::CString_3
mov byte [ebp - 4], 0x12
call fcn.004224e0
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
test ecx, ecx
jne 0x455660
lea ecx, [ebp - 0xc0]
call fcn.004b0574
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
push eax
push ecx
mov byte [ebp - 4], 0x14
call sub.MFC42u.DLL_CFile::Rename
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x12
call sub.MFC42u.DLL_CStdioFile::CStdioFile
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x11
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
call fcn.004b0436
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 9
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 7
call sub.MFC42u.DLL_CStdioFile::CStdioFile
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CStringArray::CStringArray
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
test ecx, ecx
jle 0x455668
mov al, 1
test al, al
mov byte [ebp - 0x25], 0
je 0x4559d8
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], ecx
jge 0x455748
xor esi, esi
mov dword [ebp - 0x20], esi
cmp esi, dword [ebp - 0x68]
jge 0x45572b
lea ecx, [ebp - 0x18]
push esi
push ecx
lea ecx, [ebp - 0x70]
call fcn.00401460
mov ebx, dword [eax]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push edx
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x15
call fcn.00401460
mov edi, dword [eax]
lea ecx, [ebp - 0x38]
push esi
push ecx
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x16
call fcn.00401460
mov esi, dword [eax]
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0x10
lea ecx, [ebp - 0x38]
test eax, eax
sete bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x12
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x45573a
mov edx, dword [ebp - 0x14]
push 1
push edx
lea ecx, [ebp - 0x84]
call sub.MFC42u.DLL_CStringArray::RemoveAt
mov eax, dword [ebp - 0x20]
push 1
push eax
lea ecx, [ebp - 0x70]
call sub.MFC42u.DLL_CStringArray::RemoveAt
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x45567b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov esi, eax
jmp 0x455689
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString_1
mov byte [ebp - 4], 0x17
xor esi, esi
mov bl, 0x1a
cmp esi, dword [ebp - 0x7c]
jge 0x45583e
lea ecx, [ebp - 0x34]
push esi
push ecx
lea ecx, [ebp - 0x84]
call fcn.00401460
mov edi, eax
lea edx, [ebp - 0x20]
mov byte [ebp - 4], 0x18
push edx
call fcn.00422360
add esp, 4
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x40]
push ecx
push eax
push edx
mov byte [ebp - 4], 0x19
call sub.MFC42u.DLL_operator_4
push str.Removed
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], bl
push eax
call sub.MFC42u.DLL_operator_4
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x38]
push ecx
push eax
push edx
mov byte [ebp - 4], 0x1b
call sub.MFC42u.DLL_operator_4
push edi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
push eax
call sub.MFC42u.DLL_operator
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x22
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x21
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x20
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1f
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1e
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::operator_1
push ecx
lea edx, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
call sub.MFC42u.DLL_CString::CString_3
push str.soft_change.cfg
call fcn.00425820
add esp, 8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x17
call sub.MFC42u.DLL_CString::CString
inc esi
jmp 0x455758
xor esi, esi
mov bl, 0x25
mov eax, dword [ebp - 0x68]
cmp esi, eax
jge 0x455927
lea eax, [ebp - 0x34]
push esi
push eax
lea ecx, [ebp - 0x70]
call fcn.00401460
mov edi, eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x23
push ecx
call fcn.00422360
add esp, 4
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x24
push edx
push eax
lea eax, [ebp - 0x40]
push eax
call sub.MFC42u.DLL_operator_4
push str.Added
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_operator_4
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0x26
push edx
push eax
lea eax, [ebp - 0x38]
push eax
call sub.MFC42u.DLL_operator_4
push edi
lea ecx, [ebp - 0x18]
push eax
push ecx
mov byte [ebp - 4], 0x27
call sub.MFC42u.DLL_operator
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2d
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x2c
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x2b
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x2a
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x29
call sub.MFC42u.DLL_CString::CString
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x18]
push edx
call sub.MFC42u.DLL_CString::operator_1
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call sub.MFC42u.DLL_CString::CString_3
push str.soft_change.cfg
call fcn.00425820
add esp, 8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x17
call sub.MFC42u.DLL_CString::CString
inc esi
jmp 0x455842
mov ecx, dword [ebp - 0x7c]
test ecx, ecx
jg 0x455932
test eax, eax
jle 0x4559a5
push str.software
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerTHCLockSeting
call fcn.00423d10
add esp, 8
lea ecx, [ebp - 0x18]
push eax
call sub.MFC42u.DLL_CString::CString_2
push 0x4cf25c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x2e
call sub.MFC42u.DLL_CString::CString_4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
lea ecx, [ebp - 0x1c]
test eax, eax
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x455995
mov eax, dword [0x52ff54]
push 0
push 0
push 0x4c9
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x25], 1
mov byte [ebp - 4], 0x17
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call sub.MFC42u.DLL_CString::CString
mov al, byte [ebp - 0x25]
test al, al
je 0x4559d8
push 0x4dc258
push str.32770
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 2
push 0x46d
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
push edx
push eax
call sub.MFC42u.DLL_CFile::Rename
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4555b4