Function at 0x447c70
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ece9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1218
call fcn.004c2a90
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
call fcn.004de4bb
mov eax, dword [0x5580c0]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.004dd4bb
push 0x5f
push 0x2f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004d3a57
push 0x5f
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004d3a57
lea edx, [ebp + 0xc]
push 0xe851
push edx
call fcn.0042e2e0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 4], 3
call fcn.004d41c8
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.004dd44d
mov eax, dword [ebp - 0x1c]
push 0
mov ebx, 6
push str.Executable_files__.exe_
push ebx
push eax
push 0x555ae0
push 0
lea ecx, [ebp - 0x228]
call fcn.004d46fc
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 4
call fcn.004d485e
cmp eax, 1
je 0x447d50
mov byte [ebp - 4], 5
jmp 0x447f58
call fcn.004f80f4
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x8c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004dd4bb
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d3e20
cmp eax, 0xffffffff
jne 0x447d88
push 0x55cde0
lea ecx, [ebp - 0x14]
call fcn.004dd5d6
jmp 0x447dba
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004d3e20
inc eax
lea edx, [ebp + 0xc]
push eax
push 0
push edx
lea ecx, [ebp - 0x14]
call fcn.004d3c6b
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004dd586
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.004dd44d
push str.newstub.exe
lea ecx, [ebp - 0x14]
call fcn.004dd829
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push eax
call fcn.004d4939
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd44d
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x228]
push edx
mov dword [ebp + 0xc], 0xffffffff
mov byte [ebp - 4], 8
call fcn.004d4939
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004de66d
lea ecx, [ebp - 0x30]
mov esi, eax
mov byte [ebp - 4], 8
call fcn.004dd44d
test esi, esi
je 0x447f45
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1228]
push 0x1000
push eax
lea ecx, [ebp - 0x2c]
call fcn.004de78a
test eax, eax
je 0x447ed9
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x1228]
inc eax
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x447ec1
lea ecx, [ebp - 0x228]
sub ecx, ebx
push ecx
push 0x49
push ebx
call fcn.004c4c40
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x447ec1
cmp byte [ebx], 0
je 0x447ec1
mov esi, str.IdOfSiteInSM
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447eb5
test cl, cl
je 0x447eb1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447eb5
add eax, 2
add esi, 2
test cl, cl
jne 0x447e91
xor eax, eax
jmp 0x447eba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447ed9
inc ebx
jmp 0x447e67
xor eax, eax
test eax, eax
jne 0x447ed9
mov ecx, 0x400
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
jmp 0x447e42
test ebx, ebx
je 0x447fac
cmp byte [ebx], 0
je 0x447fac
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1228]
shl eax, 0xc
sub eax, ecx
push 0
add eax, ebx
lea ecx, [ebp - 0x2c]
push eax
call fcn.004de80f
mov edx, dword [ebp + 8]
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x1228]
push 0x555ab8
push eax
call fcn.004c2b9d
add esp, 0xc
lea ecx, [ebp - 0x1228]
push 0xc
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004de7c4
lea ecx, [ebp - 0x2c]
call fcn.004de888
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 4
call fcn.004dd44d
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.004dd44d
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.004d9115
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004dd44d
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004dd44d
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004de5b0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x2c]
call fcn.004de888
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push edx
call fcn.004d4939
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd44d
lea eax, [ebp + 0xc]
push 0xf2ae
push eax
call fcn.0042e2e0
add esp, 8
mov eax, dword [eax]
push 0
push 0
push eax
mov byte [ebp - 4], 0xa
call fcn.004e57ca
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.004dd44d
jmp 0x447f45