Function at 0x447930
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e9a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1218
call fcn.004c27a0
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
call fcn.004de1bf
mov eax, dword [0x5581a0]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.004dd1bf
push 0x5f
push 0x2f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004d375b
push 0x5f
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004d375b
lea edx, [ebp + 0xc]
push 0xe851
push edx
call fcn.0042e0a0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 4], 3
call fcn.004d3ecc
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.004dd151
mov eax, dword [ebp - 0x1c]
push 0
mov ebx, 6
push str.Executable_files__.exe_
push ebx
push eax
push 0x555be0
push 0
lea ecx, [ebp - 0x228]
call fcn.004d4400
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 4
call fcn.004d4562
cmp eax, 1
je 0x447a10
mov byte [ebp - 4], 5
jmp 0x447c18
call fcn.004f7df8
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x8c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004dd1bf
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004d3b24
cmp eax, 0xffffffff
jne 0x447a48
push 0x55cec0
lea ecx, [ebp - 0x14]
call fcn.004dd2da
jmp 0x447a7a
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004d3b24
inc eax
lea edx, [ebp + 0xc]
push eax
push 0
push edx
lea ecx, [ebp - 0x14]
call fcn.004d396f
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004dd28a
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.004dd151
push str.newstub.exe
lea ecx, [ebp - 0x14]
call fcn.004dd52d
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push eax
call fcn.004d463d
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd151
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x228]
push edx
mov dword [ebp + 0xc], 0xffffffff
mov byte [ebp - 4], 8
call fcn.004d463d
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004de371
lea ecx, [ebp - 0x30]
mov esi, eax
mov byte [ebp - 4], 8
call fcn.004dd151
test esi, esi
je 0x447c05
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1228]
push 0x1000
push eax
lea ecx, [ebp - 0x2c]
call fcn.004de48e
test eax, eax
je 0x447b99
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x1228]
inc eax
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x447b81
lea ecx, [ebp - 0x228]
sub ecx, ebx
push ecx
push 0x49
push ebx
call fcn.004c4950
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x447b81
cmp byte [ebx], 0
je 0x447b81
mov esi, str.IdOfSiteInSM
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447b75
test cl, cl
je 0x447b71
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447b75
add eax, 2
add esi, 2
test cl, cl
jne 0x447b51
xor eax, eax
jmp 0x447b7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447b99
inc ebx
jmp 0x447b27
xor eax, eax
test eax, eax
jne 0x447b99
mov ecx, 0x400
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
jmp 0x447b02
test ebx, ebx
je 0x447c6c
cmp byte [ebx], 0
je 0x447c6c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1228]
shl eax, 0xc
sub eax, ecx
push 0
add eax, ebx
lea ecx, [ebp - 0x2c]
push eax
call fcn.004de513
mov edx, dword [ebp + 8]
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x1228]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x1228]
push 0x555bb8
push eax
call fcn.004c28ad
add esp, 0xc
lea ecx, [ebp - 0x1228]
push 0xc
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004de4c8
lea ecx, [ebp - 0x2c]
call fcn.004de58c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 4
call fcn.004dd151
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.004dd151
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.004d8e19
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004dd151
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004dd151
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004de2b4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x2c]
call fcn.004de58c
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x228]
push edx
call fcn.004d463d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp + 0xc]
call fcn.004dd151
lea eax, [ebp + 0xc]
push 0xf2ae
push eax
call fcn.0042e0a0
add esp, 8
mov eax, dword [eax]
push 0
push 0
push eax
mov byte [ebp - 4], 0xa
call fcn.004e54ce
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.004dd151
jmp 0x447c05