Function at 0x4c7ab750
Capabilities:
Check if file exists
Delete file
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf10
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x832]
push esi
push eax
mov dword [ebp - 4], esi
xor ebx, ebx
mov word [ebp - 0x834], si
call sub.msvcrt.dll_memset
push 0x206
lea ecx, [ebp - 0x422]
push esi
push ecx
mov word [ebp - 0x424], si
call sub.msvcrt.dll_memset
push 0x206
lea edx, [ebp - 0x21a]
push esi
push edx
mov word [ebp - 0x21c], si
call sub.msvcrt.dll_memset
push 0x206
lea eax, [ebp - 0xf0e]
push esi
push eax
mov word [ebp - 0xf10], si
call sub.msvcrt.dll_memset
push 0x206
lea ecx, [ebp - 0x62a]
push esi
push ecx
mov word [ebp - 0x62c], si
call sub.msvcrt.dll_memset
push 0x206
lea edx, [ebp - 0xd06]
push esi
push edx
mov word [ebp - 0xd08], si
call sub.msvcrt.dll_memset
add esp, 0x48
push 0x2c8
lea eax, [ebp - 0xafe]
push esi
push eax
mov word [ebp - 0xb00], si
call sub.msvcrt.dll_memset
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [edi + 0x20c]
lea edx, [ebp - 0x834]
add esp, 0xc
mov word [ebp - 0x14], si
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x4c7ab840
lea eax, [edi + 4]
lea edx, [ebp - 0x424]
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x4c7ab860
lea eax, [edi + 0x414]
lea edx, [ebp - 0x21c]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x4c7ab880
lea eax, [edi + 0x61c]
lea edx, [ebp - 0xf10]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x4c7ab8a0
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x834]
push eax
call fcn.4c7ac700
test eax, eax
lea ecx, [ebp - 0x424]
push ecx
jne 0x4c7ab994
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7ab91b
call esi
cmp eax, 2
je 0x4c7ab936
push 0x33
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea edx, [ebp - 0x424]
push edx
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
jmp 0x4c7ab936
push 0x3b
push 0x4c782c18
lea eax, [ebp - 0x424]
push eax
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
lea ecx, [ebp - 0x21c]
push ecx
call edi
test eax, eax
jne 0x4c7ab981
call esi
cmp eax, 2
je 0x4c7abd93
push 0x40
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea edx, [ebp - 0x21c]
push edx
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x48
push 0x4c782c18
lea eax, [ebp - 0x21c]
push eax
jmp 0x4c7abd86
lea edx, [ebp - 0x62c]
push edx
call fcn.4c7ac270
test eax, eax
jne 0x4c7aba6b
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x424]
push eax
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7ab9f2
call esi
cmp eax, 2
je 0x4c7aba0d
push 0x56
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea ecx, [ebp - 0x424]
push ecx
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
jmp 0x4c7aba0d
push 0x5e
push 0x4c782c18
lea edx, [ebp - 0x424]
push edx
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
call edi
test eax, eax
jne 0x4c7aba58
call esi
cmp eax, 2
je 0x4c7abd93
push 0x63
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea ecx, [ebp - 0x21c]
push ecx
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x6b
push 0x4c782c18
lea edx, [ebp - 0x21c]
push edx
jmp 0x4c7abd86
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 8]
movzx edx, word [ebp - 0xa]
movzx eax, word [ebp - 0xc]
push ecx
movzx ecx, word [ebp - 0xe]
push edx
movzx edx, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push ecx
push edx
push eax
lea ecx, [ebp - 0xd08]
push 0x4c782bdc
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
add esp, 0x20
lea edx, [ebp - 4]
push edx
push esi
call edi
test eax, eax
jne 0x4c7abaf4
mov eax, dword [ebp - 4]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MFC42.dll_operatornew
mov ebx, eax
add esp, 4
lea eax, [ebp - 4]
push eax
push ebx
call edi
test eax, eax
jne 0x4c7abaf4
push 0x202
push esi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x4c7abb00
movzx ecx, word [ebp + eax - 0xd08]
mov word [ebp + eax - 0xb00], cx
add eax, 2
cmp cx, si
jne 0x4c7abb00
mov edi, dword [sym.imp.msvcrt.dll_wcsncpy]
push 0x50
lea ecx, [ebp - 0xf10]
push ecx
lea edx, [ebp - 0xad8]
push edx
call edi
push 0x3c
lea eax, [ebp - 0xa38]
push ebx
push eax
call edi
add esp, 0x18
cmp ebx, esi
je 0x4c7abb4c
push ebx
call sub.MFC42.dll_operatordelete
add esp, 4
push 0x140
lea ecx, [ebp - 0xb00]
push ecx
lea edx, [ebp - 0x62c]
push edx
call fcn.4c7acbf0
test eax, eax
jne 0x4c7abc0f
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x834]
push eax
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7abbb9
call esi
cmp eax, 2
je 0x4c7abbd7
push 0x98
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea ecx, [ebp - 0x424]
push ecx
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
jmp 0x4c7abbd7
push 0xa0
push 0x4c782c18
lea edx, [ebp - 0x424]
push edx
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
call edi
test eax, eax
jne 0x4c7abbf9
call esi
cmp eax, 2
je 0x4c7abd93
push 0xa5
jmp 0x4c7aba27
push 0xad
push 0x4c782c18
lea edx, [ebp - 0x21c]
push edx
jmp 0x4c7abd86
push 0xe8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x62c]
push ecx
call fcn.4c7ac8a0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jne 0x4c7abcc6
lea edx, [ebp - 0x834]
push edx
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7abc7c
call esi
cmp eax, 2
je 0x4c7abc9a
push 0xb9
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea eax, [ebp - 0x424]
push eax
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
jmp 0x4c7abc9a
push 0xc1
push 0x4c782c18
lea ecx, [ebp - 0x424]
push ecx
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
lea edx, [ebp - 0x21c]
push edx
call edi
test eax, eax
jne 0x4c7abcbc
call esi
cmp eax, 2
je 0x4c7abd93
push 0xc6
jmp 0x4c7abd44
push 0xce
jmp 0x4c7abd7a
lea edx, [ebp - 0x424]
push edx
call edi
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4c7abd0d
call esi
cmp eax, 2
je 0x4c7abd2b
push 0xd7
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea eax, [ebp - 0x424]
push eax
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
jmp 0x4c7abd2b
push 0xdf
push 0x4c782c18
lea ecx, [ebp - 0x424]
push ecx
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
lea edx, [ebp - 0x21c]
push edx
call edi
test eax, eax
jne 0x4c7abd75
call esi
cmp eax, 2
je 0x4c7abd93
push 0xe4
push 0x4c782c18
call esi
push eax
push 0x4c78142c
call fcn.4c7c02b0
lea eax, [ebp - 0x21c]
push eax
push 0x4c782788
call fcn.4c7c02b0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xec
push 0x4c782c18
lea ecx, [ebp - 0x21c]
push ecx
push 0x4c782760
call fcn.4c7c02b0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4