Function at 0x4c1b68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c1de0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1d8]
cmp byte [eax + 0x21], 2
jne 0x4c1bb4
lea eax, [ebx + 0x2a8]
mov edx, dword [ebx + 0x1a8]
call fcn.0040568c
push 0
mov ecx, dword [ebx + 0x12c]
inc ecx
lea edx, [ebx + 0x2a8]
mov eax, ebx
call fcn.004b8160
mov eax, dword [ebx + 0x1d8]
cmp byte [eax + 0x21], 1
jne 0x4c1c3d
lea ecx, [ebx + 0x2a8]
mov edx, dword [ebx + 0x12c]
inc edx
mov eax, ebx
call fcn.004b7fd0
cmp dword [ebx + 0x2a8], 0
jne 0x4c1bfe
lea edx, [ebp - 4]
mov eax, 0xbb
call fcn.0040d288
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4b4a68]
call fcn.0041194c
call fcn.00404fa8
mov eax, dword [ebx + 0x2a8]
call fcn.0040d3dc
test al, al
je 0x4c1c1e
mov eax, dword [ebx + 0x2a8]
call fcn.00405ad8
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp word [ebx + 0x232], 0
je 0x4c1c3d
mov ecx, dword [ebx + 0x12c]
inc ecx
mov edx, ebx
mov eax, dword [ebx + 0x234]
call dword [ebx + 0x230]
cmp byte [ebx + 0x10c], 0
jne 0x4c1c74
push 0xffff
movzx eax, byte [ebx + 0x105]
push eax
mov eax, dword [ebx + 0x108]
push eax
mov ecx, dword [ebx + 0x2a8]
mov dl, 1
mov eax, dword [0x4a6b5c]
call fcn.004a6cd4
mov dword [ebx + 0x284], eax
jmp 0x4c1c9d
cmp byte [ebx + 0x270], 0
je 0x4c1c91
mov dl, 1
mov eax, dword [0x41fbc0]
call fcn.004046c4
mov dword [ebx + 0x284], eax
jmp 0x4c1c9d
mov eax, dword [ebx + 0x130]
mov dword [ebx + 0x284], eax
cmp byte [ebx + 0x271], 0
je 0x4c1cc1
mov esi, dword [ebx + 0x274]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, esi
mov eax, dword [ebx + 0x284]
call fcn.004249f8
mov cl, 2
mov dl, 1
mov eax, dword [0x4a872c]
call fcn.004aa724
mov esi, eax
mov dword [ebx + 0x298], esi
mov byte [esi + 0x18], 0
mov byte [esi + 4], 0
mov cl, 2
mov dl, 1
mov eax, dword [0x4a872c]
call fcn.004aa724
mov esi, eax
mov dword [ebx + 0x29c], esi
mov byte [esi + 0x18], 7
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
mov eax, ebx
call fcn.004b7f14
add esi, eax
mov edx, esi
mov eax, dword [ebx + 0x298]
call fcn.004a617c
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
mov eax, ebx
call fcn.004b7f14
add esi, eax
mov edx, esi
mov eax, dword [ebx + 0x29c]
call fcn.004a617c
mov dl, 1
mov eax, dword [0x4a861c]
call fcn.004a9e28
mov dword [ebx + 0x2a0], eax
cmp byte [ebx + 0x270], 0
jne 0x4c1d60
mov eax, dword [ebx + 0x158]
cmp byte [eax + 0x28], 0
je 0x4c1dc5
mov edx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx + 0x2a0]
cmp word [eax + 0x18], 0
jbe 0x4c1d9f
cmp dword [eax + 0x1c], 0
jne 0x4c1d9f
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004b691c
mov eax, dword [ebp - 8]
call fcn.004a7f28
mov edx, dword [ebx + 0x2a0]
mov dword [edx + 0x1c], eax
push 0
push 0
mov eax, dword [ebx + 0x2a0]
call fcn.004aa528
xor edx, edx
mov eax, dword [ebx + 0x2a0]
call fcn.004aa4a4
mov eax, dword [ebx + 0x2a0]
mov byte [eax + 0x28], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1de7
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040565c
ret