Function at 0x4ff176
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x5b7db4
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.USERINIT.EXE
lea ecx, [ebp - 0x100]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7db4
lea edx, [ebp - 0x300]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.USERINI.EXE
lea eax, [ebp - 0x300]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7db4
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.INIT32.EXE
lea edx, [ebp - 0x200]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7db4
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.WIN32X.EXE
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.004f9b07
add esp, 8
test eax, eax
jne 0x4ff494
lea eax, [ebp - 0x100]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5aafb8
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
push 0
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x4ff302
lea ecx, [ebp - 0x100]
push ecx
push str._s_____DownLoader.Obitel.A__Eliminado._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x100]
push edx
push 0x5aafe8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0
push str.Eliminado_DownLoader.Obitel.A
call sub.MFC42.DLL_AfxMessageBox
jmp 0x4ff494
push 0
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x4ff391
lea eax, [ebp - 0x100]
push eax
push str._s_____Trojan.Agent.AYBD__Eliminado._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x100]
push ecx
push 0x5ab044
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0
push str.Eliminado_Trojan.Agent.AYBD
call sub.MFC42.DLL_AfxMessageBox
jmp 0x4ff494
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x4ff41d
lea edx, [ebp - 0x100]
push edx
push str._s_____Spambot.Tedroo.A__Eliminado._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x100]
push eax
push str._s_____Restaurado._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0
push str.Eliminado_Spambot.Tedroo.A
call sub.MFC42.DLL_AfxMessageBox
jmp 0x4ff494
lea edx, [ebp - 0x100]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str..vir
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x100]
push eax
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
push 0
push 0
push str.USERINIT.EXE_Infectado._nReinicie_para_Completar_la_Limpieza.
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [ebp - 0x100]
push ecx
push str._s_____Infectado_nReinicie_para_Completar_la_Limpieza._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
mov esp, ebp
pop ebp
ret