Function at 0x4eeb44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ef08d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xb0], edx
mov eax, dword [ebp - 8]
call fcn.004ce370
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
test byte [eax + 0x5f], 1
setne bl
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d], 0
je 0x4eebbd
mov eax, dword [ebp - 8]
test byte [eax + 0x61], 1
je 0x4eebbd
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10c], 0
jne 0x4eebbd
push 1
mov ecx, 0x283e
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
xor edx, edx
push ebp
push 0x4eee82
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.004efa28
mov eax, dword [ebp - 8]
cmp dword [eax + 0xbc], 0
jne 0x4eebf7
push 1
mov ecx, 0x2776
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4eec5e
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 8
jne 0x4eec30
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 0x10
jne 0x4eec30
push 1
mov ecx, 0x283d
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
mov eax, dword [ebp - 8]
movzx edx, word [0x4ef09c]
not edx
and dx, word [eax + 0x60]
or dx, word [0x4ef0a0]
mov eax, dword [ebp - 8]
mov word [eax + 0x60], dx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, 0x4ef0b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x84]
call fcn.004e0e14
mov esi, eax
cmp dword [esi + 0x2c], 0
jne 0x4eec84
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xbc]
mov eax, esi
call fcn.004d4f28
mov eax, dword [esi + 0x70]
xor edx, edx
call fcn.004d029c
mov eax, dword [ebp - 8]
cmp byte [eax + 0x5d], 0
je 0x4eecbf
mov eax, dword [esi + 0x70]
call fcn.004d0294
test al, al
jne 0x4eecbf
test bl, bl
je 0x4eecbf
push 1
mov ecx, 0x2b11
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
mov eax, esi
call fcn.004d9f04
test eax, eax
jne 0x4eeceb
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 8
je 0x4eeceb
push 1
mov ecx, 0x283d
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
mov eax, dword [esi + 0x70]
call fcn.004d0294
test al, al
jne 0x4eecfb
test bl, bl
jne 0x4eed65
mov eax, dword [ebp - 8]
test byte [eax + 0x5f], 4
je 0x4eed1d
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
call fcn.0041437c
mov eax, dword [ebp - 0x10]
call fcn.004c7520
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
call fcn.0041437c
mov eax, dword [ebp - 0x14]
call fcn.004c7074
test al, al
jne 0x4eed65
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
call fcn.0041437c
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x2844
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9260
call fcn.00405940
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xbc]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.004e9554
test al, al
jne 0x4eed9c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
push eax
mov ecx, 0x2b2b
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9260
call fcn.00405940
mov eax, dword [ebp - 8]
call fcn.004ebae0
test eax, eax
jg 0x4eedb5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ef06a
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xbc]
call fcn.00406db4
test bl, bl
je 0x4eedfc
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004e5b74
mov esi, eax
test esi, esi
je 0x4eedfc
mov eax, dword [ebp - 8]
call fcn.004ebb24
push 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9168
call fcn.00405940
test bl, bl
jne 0x4eee2b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
call fcn.004145d0
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 0x20]
mov eax, 0x4ef0c4
call fcn.00412e64
test eax, eax
sete al
jmp 0x4eee2d
xor eax, eax
test al, al
je 0x4eee78
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xbc]
call fcn.00413d00
test al, al
jne 0x4eee78
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xbc]
mov eax, dword [ebp - 8]
call fcn.004e4acc
mov esi, eax
test esi, esi
je 0x4eee78
mov eax, esi
call fcn.004c6f70
push eax
mov ecx, 0x2840
mov dl, 1
mov eax, dword [0x4f8f6c]
call fcn.004f9210
call fcn.00405940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4eeebe
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004cedc0
xor eax, eax
push ebp
push 0x4ef016
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4eef87
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004efe88
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x68
xor edx, edx
call fcn.00406d60
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xe4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004eba78
mov edx, dword [ebp - 8]
mov dword [edx + 0xb0], eax
mov eax, dword [ebp - 8]
add eax, 0x68
xor edx, edx
call fcn.00406d60
test bl, bl
je 0x4eef7d
mov eax, dword [ebp - 8]
cmp dword [eax + 0xb0], 0
jl 0x4eef6f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x84]
cmp dword [eax + 4], 0
jle 0x4eef5a
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 8
jne 0x4eef5e
mov eax, dword [ebp - 8]
test byte [eax + 0x60], 0x10
jne 0x4eef5e
xor ecx, ecx
jmp 0x4eef60
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004e5678
test al, al
je 0x4eef7d
mov eax, dword [ebp - 4]
call fcn.00406dec
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4eefd9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef01d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x114]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004ed560
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef094
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00406d58
lea eax, [ebp - 4]
call fcn.00406d50
ret