Function at 0x4f79e5
Capabilities:
Create directory
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x310], ecx
mov dword [0x5b852c], 0
push 0x5b8f20
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00401fca
add esp, 4
mov ecx, dword [ebp - 0x310]
call fcn.0050e709
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f812c
add esp, 4
test eax, eax
je 0x4f7a3c
jmp 0x4f8126
mov ecx, dword [ebp - 0x310]
call fcn.0050e75d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004f9b07
add esp, 8
test eax, eax
je 0x4f7a84
push 0x407
mov ecx, dword [ebp - 0x310]
call sub.MFC42.DLL_CWnd::IsDlgButtonChecked
cmp eax, 1
jne 0x4f7a7f
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x310]
call fcn.0050ecd7
jmp 0x4f8126
mov ecx, dword [ebp - 0x310]
call fcn.0050e7b1
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.___
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, dword [ebp - 0x310]
add ecx, 0x3c0
call fcn.0050f650
push str.Trojan.Swisyn.AE
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.Trojan.Swisyn.AF
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.Trojan.Swisyn.AG
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.Trojan.Swisyn.AH
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.Trojan.Swisyn.AI
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.W32.Neshta.A
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7b78
push str.W32.Synaptics
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f7b7d
jmp 0x4f8126
push 0x5b8f24
lea eax, [ebp - 0x308]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
movsx edx, byte [ebp - 0x206]
cmp edx, 0x5c
jne 0x4f7bdf
movsx eax, byte [ebp - 0x205]
test eax, eax
jne 0x4f7bdf
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x208]
push edx
push 0x5a8b1c
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4f7bff
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x208]
push edx
push 0x5a8b24
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x403
mov ecx, dword [ebp - 0x310]
call sub.MFC42.DLL_CWnd::IsDlgButtonChecked
test eax, eax
jne 0x4f7cb0
lea ecx, [ebp - 0x308]
push ecx
push 0x5b6404
push str.Detectado__s_en_el_fichero:_n_s_n_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 4
push 0x5a8b60
push 0x5b6504
mov ecx, dword [ebp - 0x310]
call sub.MFC42.DLL_CWnd::MessageBoxA
cmp eax, 7
jne 0x4f7cb0
lea edx, [ebp - 0x308]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str._____Infectado_
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a8b84
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4f8126
lea eax, [ebp - 0x308]
push eax
call fcn.00402131
add esp, 4
push 0
lea ecx, [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
cmp dword [0x5b852c], 0
je 0x4f7d41
lea edx, [ebp - 0x308]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str._____Limpiado_
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a8b98
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [ebp + 8]
push eax
call fcn.0050c6fa
add esp, 4
jmp 0x4f811b
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
test eax, eax
je 0x4f7e02
push 0
push 0
push str.No_ha_sido_posible_Eliminar_Fichero_Infectado._nEn_el_siguiente_Reinicio_se_completar
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a8c00
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x100]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
lea ecx, [ebp - 0x308]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str._____Acceso_Denegado_
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push str.__Reiniciar_para_Completar_la_Limpieza__n
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4f8126
lea edx, [ebp - 0x308]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str._____Eliminado_
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a8c60
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.DownLoader.Unruy.C
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f7e8b
push str.DownLoader.Unruy.H
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f800c
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x104]
movsx edx, byte [ecx - 4]
cmp edx, 0x2e
jne 0x4f7ee0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x104]
movsx ecx, byte [eax - 3]
cmp ecx, 0x76
je 0x4f7ed3
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x104]
movsx eax, byte [edx - 3]
cmp eax, 0x56
jne 0x4f7ee0
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x104]
mov byte [ecx - 4], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x104], eax
mov edx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x104]
mov dword [edx + 0x17c], eax
jmp 0x4f7f37
mov ecx, dword [ebp - 0x310]
mov edx, dword [ecx + 0x17c]
sub edx, 1
mov eax, dword [ebp - 0x310]
mov dword [eax + 0x17c], edx
mov ecx, dword [ebp - 0x310]
cmp dword [ecx + 0x17c], 0
jl 0x4f7fac
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0x17c]
movsx ecx, byte [ebp + eax - 0x100]
cmp ecx, 0x2e
jne 0x4f7fa7
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0x17c]
movsx ecx, byte [ebp + eax - 0xff]
cmp ecx, 0x65
je 0x4f7f91
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0x17c]
movsx ecx, byte [ebp + eax - 0xff]
cmp ecx, 0x45
jne 0x4f7fa7
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0x17c]
mov byte [ebp + eax - 0x100], 0
jmp 0x4f7fac
jmp 0x4f7f1c
push str._.EXE
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
test eax, eax
jne 0x4f800c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x208]
push eax
push 0x5a8c94
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.Pws.Kates.AD
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f8091
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x30c], esp
lea edx, [ebp - 0x308]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x314], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x4f8091
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0
push str.Detectado_Troyano_Pws.Kates.AD_nEn_el_Siguiente_Reinicio_del_Sistema__nse_completar
call sub.MFC42.DLL_AfxMessageBox
push 0
lea ecx, [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.004ae964
push str.W32.Grenam
push 0x5b6404
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f811b
mov edx, dword [ebp + 8]
push edx
push 0x5a8d30
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
test eax, eax
jne 0x4f811b
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x208]
push eax
push str._s_s_____Renombrado_a___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov ecx, dword [ebp - 0x310]
call fcn.0050e805
mov esp, ebp
pop ebp
ret 8