Function at 0x4d4140
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d674a
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x634254]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x494], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, SysReAllocString
test eax, eax
jne 0x4d421c
add edi, 8
lea eax, [ebp + 8]
cmp edi, eax
je 0x4d420f
cmp dword [ebp + 0x1c], 8
mov ecx, dword [edi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x498], ecx
cmp eax, ecx
ja 0x4d4266
mov dword [ebp - 0x498], edi
mov edx, edi
cmp ecx, 8
jb 0x4d41e8
mov edx, dword [edi]
mov dword [ebp - 0x498], edx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
push dword [ebp - 0x49c]
push edx
call fcn.00570d00
mov eax, dword [ebp - 0x498]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov esi, SysReAllocString
mov edi, dword [ebp - 0x4a8]
mov dword [edi + 4], 2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4d4968
mov eax, 0x5c
mov dword [ebp - 0x30], 0
mov word [ebp - 0x34], ax
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 2
jb 0x4d4ba2
jmp 0x4d4386
cmp eax, 0x7ffffffe
ja 0x4d4ba7
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4d428a
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4d42c4
mov edx, ecx
mov eax, SysReAllocString
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4d42a5
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4d42c4
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x4d4bce
add eax, eax
cmp eax, 0x1000
jb 0x4d42ed
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4d4bce
push ecx
call fcn.005a1c68
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4d4bac
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4d430c
test eax, eax
je 0x4d430a
push eax
call fcn.005a1c68
add esp, 4
mov dword [ebp - 0x494], eax
test eax, eax
je 0x4d4bbd
jmp 0x4d4312
xor eax, eax
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x4a4]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ecx
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x49c]
push eax
call fcn.00570780
mov eax, dword [ebp - 0x494]
xor ecx, ecx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x498]
cmp ecx, 8
jb 0x4d437f
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4d436f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4bd3
mov eax, edx
push ecx
push eax
call fcn.0056d0c8
mov eax, dword [ebp - 0x494]
add esp, 8
mov dword [edi], eax
jmp 0x4d420a
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 2
cmovae eax, dword [ebp + 8]
push 0x614200
push ecx
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x28]
call fcn.004448b5
mov edi, 1
mov dword [ebp - 0x494], edi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x48c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004cf680
mov byte [ebp - 4], 1
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4d4412
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4d4408
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4bd3
push edx
push ecx
call fcn.0056d0c8
add esp, 8
test esi, esi
je 0x4d4760
mov ecx, dword [ebp - 0x2c]
nop dword [eax]
xor edx, edx
test ecx, ecx
je 0x4d445e
mov eax, dword [ebp - 0x48c]
shr eax, 4
and eax, 1
je 0x4d445e
cmp word [ebp - 0x460], 0x2e
jne 0x4d445e
mov ax, word [ebp - 0x45e]
test ax, ax
je 0x4d4459
cmp ax, 0x2e
jne 0x4d445e
cmp word [ebp - 0x45c], dx
jne 0x4d445e
mov edx, 1
test edx, edx
jne 0x4d473a
mov byte [ebp - 4], 3
call fcn.0040b05c
mov ecx, eax
test ecx, ecx
je 0x4d4be2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
or edi, 2
cmp dword [ebp - 0x2c], 0
mov dword [ebp - 0x494], edi
lea esi, [eax + 0x10]
mov dword [ebp - 0x498], esi
je 0x4d45eb
lea edi, [ebp - 0x460]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4d44a5
sub edi, ecx
sar edi, 1
jne 0x4d4514
cmp dword [esi - 0xc], 0
lea edx, [esi - 0x10]
mov edi, dword [edx]
je 0x4d45e5
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x4d44e9
cmp dword [esi - 8], 0
jl 0x4d4bd8
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x4d45e5
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4d44fd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x498], esi
jmp 0x4d45e5
mov eax, dword [esi - 0xc]
lea edx, [ebp - 0x460]
sub edx, esi
mov dword [ebp - 0x49c], eax
sar edx, 1
mov dword [ebp - 0x4a4], edx
test edi, edi
js 0x4d4bd8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4d455e
push edi
lea ecx, [ebp - 0x498]
call fcn.0040b85d
mov esi, dword [ebp - 0x498]
mov edx, dword [ebp - 0x4a4]
lea ecx, [edi + edi]
mov eax, dword [esi - 8]
cmp edx, dword [ebp - 0x49c]
ja 0x4d4597
lea edx, [esi + edx*2]
test ecx, ecx
je 0x4d45d3
test edx, edx
jne 0x4d4584
call fcn.0058f2ca
mov dword [eax], 0x16
jmp 0x4d45cb
add eax, eax
cmp eax, ecx
jb 0x4d45c0
push ecx
push edx
push esi
call fcn.00570d00
add esp, 0xc
jmp 0x4d45d0
add eax, eax
test ecx, ecx
je 0x4d45d3
cmp eax, ecx
jb 0x4d45b4
push ecx
lea eax, [ebp - 0x460]
push eax
push esi
call fcn.00570780
add esp, 0xc
jmp 0x4d45d0
push eax
push 0
push esi
call fcn.005713c0
add esp, 0xc
call fcn.0058f2ca
mov dword [eax], 0x22
call fcn.0057b1f1
lea ecx, [edi + edi]
cmp edi, dword [esi - 8]
jg 0x4d4bd8
xor eax, eax
mov dword [esi - 0xc], edi
mov word [ecx + esi], ax
mov edi, dword [ebp - 0x494]
mov ecx, dword [ebp + 0x18]
mov eax, SysReAllocString
sub eax, ecx
cmp eax, 1
jb 0x4d4ba7
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 1
cmovae eax, dword [ebp + 8]
push 0x6058cc
push ecx
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x28]
call fcn.004448b5
or edi, 4
mov dword [ebp - 0x494], edi
mov ecx, esi
mov byte [ebp - 4], 4
sub esp, 0x18
mov dword [ebp - 0x4ac], esp
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d4640
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004092f8
mov ecx, dword [ebp - 0x4ac]
or edi, 8
mov dword [ebp - 0x494], edi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x4a8]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
call fcn.004d4140
test eax, eax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x14]
sete byte [ebp - 0x48d]
cmp edx, 8
jb 0x4d46f1
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4d46e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4bd3
push edx
push ecx
call fcn.0056d0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
and edi, 0xfffffffd
mov word [ebp - 0x28], ax
mov dword [ebp - 0x14], 7
add esi, 0xfffffff0
mov dword [ebp - 0x494], edi
or eax, 0xffffffff
mov byte [ebp - 4], 1
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4d472a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x48d], 0
jne 0x4d4938
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4d4760
test ecx, ecx
je 0x4d4760
lea ecx, [ebp - 0x48c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
mov ecx, eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
jne 0x4d4420
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x4d493c
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov esi, dword [ebp - 0x4a8]
lea eax, [ebp + 8]
add esi, 8
cmp esi, eax
je 0x4d4929
cmp dword [ebp + 0x1c], 8
mov ecx, dword [esi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a4], ecx
cmp eax, ecx
ja 0x4d4803
mov edi, esi
cmp ecx, 8
jb 0x4d47d1
mov edi, dword [esi]
mov dword [esi + 0x10], eax
lea esi, [eax + eax]
push esi
push dword [ebp - 0x49c]
push edi
call fcn.00570d00
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x4a8]
xor esi, esi
mov dword [ecx + 4], eax
jmp 0x4d4941
cmp eax, 0x7ffffffe
ja 0x4d4bec
mov edi, eax
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x4d482c
mov dword [ebp - 0x498], SysStringLen
mov eax, 0xfffffffe
jmp 0x4d4870
mov eax, ecx
mov edx, SysReAllocString
shr eax, 1
sub edx, eax
cmp ecx, edx
jbe 0x4d484c
mov dword [ebp - 0x498], SysStringLen
mov eax, 0xfffffffe
jmp 0x4d4870
add eax, ecx
cmp edi, eax
cmovb edi, eax
mov dword [ebp - 0x498], edi
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x4d4bce
add eax, eax
cmp eax, 0x1000
jb 0x4d4897
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4d4bce
push ecx
call fcn.005a1c68
add esp, 4
test eax, eax
je 0x4d4bf1
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4d48b2
test eax, eax
je 0x4d48b0
push eax
call fcn.005a1c68
mov edi, eax
add esp, 4
test edi, edi
je 0x4d4c02
jmp 0x4d48b2
xor edi, edi
mov ecx, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x498]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x49c]
push edi
call fcn.00570780
xor eax, eax
add esp, 0xc
mov word [edi + esi], ax
mov eax, dword [ebp - 0x4a4]
cmp eax, 8
jb 0x4d4920
lea ecx, [eax*2 + 2]
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax + 8]
cmp ecx, 0x1000
jb 0x4d4916
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4bd3
mov eax, edx
push ecx
push eax
call fcn.0056d0c8
add esp, 8
mov eax, dword [ebp - 0x4a8]
mov dword [eax + 8], edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx + 4], eax
xor esi, esi
jmp 0x4d4941
mov esi, 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0
test eax, eax
je 0x4d4b49
cmp eax, 0xffffffff
je 0x4d4b49
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x4d4b49
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x4a4], eax
test eax, eax
jne 0x4d4b43
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov dword [ebp - 0x4a4], eax
test eax, eax
jne 0x4d4b43
add edi, 8
lea eax, [ebp + 8]
cmp edi, eax
je 0x4d4b34
cmp dword [ebp + 0x1c], 8
mov ecx, dword [edi + 0x14]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x49c], ecx
cmp eax, ecx
ja 0x4d4a1a
mov dword [ebp - 0x49c], edi
mov edx, edi
cmp ecx, 8
jb 0x4d49f3
mov edx, dword [edi]
mov dword [ebp - 0x49c], edx
lea esi, [eax + eax]
mov dword [edi + 0x10], eax
push esi
push dword [ebp - 0x498]
push edx
call fcn.00570d00
mov eax, dword [ebp - 0x49c]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x4d4b34
cmp eax, 0x7ffffffe
ja 0x4d4c13
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4d4a3e
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4d4a77
mov eax, ecx
mov edx, SysReAllocString
shr eax, 1
sub edx, eax
cmp ecx, edx
jbe 0x4d4a59
mov esi, SysReAllocString
mov eax, 0xfffffffe
jmp 0x4d4a77
add eax, ecx
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x4d4bce
add eax, eax
cmp eax, 0x1000
jb 0x4d4aa0
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4d4bce
push ecx
call fcn.005a1c68
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4d4c18
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4d4abf
test eax, eax
je 0x4d4abd
push eax
call fcn.005a1c68
add esp, 4
mov dword [ebp - 0x494], eax
test eax, eax
je 0x4d4c29
jmp 0x4d4ac5
xor eax, eax
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ecx
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x498]
push eax
call fcn.00570780
mov eax, dword [ebp - 0x494]
xor ecx, ecx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x49c]
cmp ecx, 8
jb 0x4d4b32
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4d4b22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4bd3
mov eax, edx
push ecx
push eax
call fcn.0056d0c8
mov eax, dword [ebp - 0x494]
add esp, 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x4a4]
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4d4b83
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4d4b79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d4c3a
push edx
push ecx
call fcn.0056d0c8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d855
mov esp, ebp
pop ebp
ret 0x18
call fcn.004072dc
call fcn.004072dc
push 0x630328
lea eax, [ebp - 0x48d]
push eax
call fcn.0057134b
push 0x630328
lea eax, [ebp - 0x49d]
push eax
call fcn.0057134b
call fcn.00407541
call fcn.0057b201
push 0x80070057
call fcn.0040b92b
push 0x80004005
call fcn.0040b92b
call fcn.004072dc
push 0x630328
lea eax, [ebp - 0x49d]
push eax
call fcn.0057134b
push 0x630328
lea eax, [ebp - 0x48d]
push eax
call fcn.0057134b
call fcn.004072dc
push 0x630328
lea eax, [ebp - 0x49d]
push eax
call fcn.0057134b
push 0x630328
lea eax, [ebp - 0x48d]
push eax
call fcn.0057134b
call fcn.0057b201
int3