Function at 0x4fdd94
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x5864
call fcn.0059fbd0
push ebx
push esi
push edi
push 0x5bd560
lea eax, [esp + 0x2d4]
push eax
call fcn.00401b52
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x4d8]
push eax
mov eax, ebx
call fcn.00401016
lea eax, [esp + 0x6e0]
push eax
lea eax, [esp + 0x2d4]
call fcn.00401016
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x4dc]
call fcn.0040847c
xor edi, edi
cmp dword [esp + 0x18], edi
jne 0x4fde1a
lea eax, [esp + 0x2d0]
push eax
call fcn.00401b98
test al, al
jne 0x4fde1a
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x4fe530
lea edx, [esp + 0x2d0]
lea eax, [esp + 0x60]
call fcn.004e8685
lea eax, [esp + 0x60]
push eax
lea esi, [esp + 0x26c]
call fcn.00447460
test al, al
je 0x4fde6d
mov eax, esi
push eax
call fcn.0044741e
mov esi, eax
lea eax, [esp + 0x268]
push eax
bswap esi
call fcn.00447400
lea eax, [esp + 0x268]
push eax
call fcn.00447400
cmp esi, 0x63616666
je 0x4fde89
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 8]
mov dword [esi], 2
jmp 0x4fe517
lea eax, [esp + 0x60]
push eax
call fcn.004e87c6
mov esi, dword [esp + 0x2b8]
cmp esi, 0x30
jbe 0x4fdea2
push 0x30
pop esi
push esi
call fcn.0058f8c4
pop ecx
push edi
push edi
push dword [esp + 0x2bc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push dword [esp + 0x2bc]
mov dword [esp + 0x24], eax
push dword [esp + 0x278]
call edi
push esi
push dword [esp + 0x18]
lea eax, [esp + 0x270]
push eax
call fcn.00401f65
cmp dword [esp + 0x280], 0
je 0x4fe4f6
cmp dword [esp + 0x27c], 0
jne 0x4fe4f6
push dword [esp + 0x2ac]
call fcn.0058f8c4
pop ecx
push 0
push 0
push dword [esp + 0x2b0]
mov dword [esp + 0x30], eax
push dword [esp + 0x2b0]
push dword [esp + 0x278]
call edi
push dword [esp + 0x2ac]
mov edi, dword [esp + 0x28]
push edi
lea eax, [esp + 0x270]
push eax
call fcn.00401f65
lea eax, [esp + 0x8e8]
push eax
call fcn.004d6da8
fld qword [esp + 0x26c]
mov ax, word [esp + 0x284]
mov word [esp + 0xac5], ax
mov eax, dword [ebx + 0x410]
movzx ax, byte [eax + 9]
mov word [esp + 0xac7], ax
call fcn.005a6596
shl eax, 0x10
push esi
push dword [esp + 0x18]
mov dword [esp + 0xad1], eax
lea eax, [esp + 0xa97]
push eax
call fcn.005987b0
mov dword [esp + 0xacb], esi
add esp, 0xc
push dword [esp + 0x28c]
add esi, 0xc
mov dword [esp + 0xa86], esi
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x2b0]
lea esi, [esp + 0xb20]
call fcn.0055edd7
xor edx, edx
cmp dword [esp + 0x28c], edx
jbe 0x4fe043
xor eax, eax
cmp edi, eax
jg 0x4fdfe6
mov ecx, dword [esp + 0xb1c]
mov dword [ecx + edx*4], eax
jmp 0x4fe039
cmp edi, 5
mov dword [esp + 0xc], 5
jg 0x4fdff7
mov dword [esp + 0xc], edi
xor esi, esi
mov ecx, dword [esp + 0x10]
mov cl, byte [eax + ecx]
movzx ebx, cl
and ebx, 0x7f
shl esi, 7
or esi, ebx
inc eax
cmp eax, 5
jg 0x4fe41e
test cl, cl
jns 0x4fe01f
cmp eax, dword [esp + 0xc]
jle 0x4fdff9
mov dword [esp + 0xc], eax
mov eax, esi
mov ecx, dword [esp + 0xb1c]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0xc]
add dword [esp + 0x10], eax
sub edi, eax
inc edx
cmp edx, dword [esp + 0x28c]
jb 0x4fdfd4
mov eax, dword [esp + 0x28c]
push 2
pop ebx
push dword [esp + 0xae6]
mov dword [esp + 0xb1c], eax
mov dword [esp + 0xae6], ebx
call fcn.0058f8c9
pop ecx
xor ecx, ecx
push 8
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058f8c4
mov dword [esp + 0xaea], eax
pop ecx
mov ecx, dword [esp + 0x28c]
dec ecx
mov dword [eax], ecx
mov eax, dword [esp + 0xae6]
mov ecx, dword [esp + 0x280]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0xae6]
xor esi, esi
inc esi
mov dword [eax + 8], esi
mov eax, dword [esp + 0x280]
sub eax, dword [esp + 0x2a0]
mov ecx, dword [esp + 0xae6]
mov dword [ecx + 0xc], eax
push dword [esp + 0xaff]
mov dword [esp + 0xaff], ebx
call fcn.0058f8c9
pop ecx
xor ecx, ecx
push 0xc
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058f8c4
pop ecx
mov dword [esp + 0xaff], eax
mov dword [eax], esi
mov eax, dword [esp + 0xaff]
push 6
pop edi
mov dword [eax + 4], edi
mov eax, dword [esp + 0xaff]
push 0
push edi
mov dword [eax + 8], esi
push dword [esp + 0x298]
push dword [esp + 0x298]
call fcn.005a6690
mov ecx, dword [esp + 0xaff]
push 0
inc eax
push edi
mov dword [ecx + 0xc], eax
push dword [esp + 0x298]
push dword [esp + 0x298]
call fcn.005a6bc0
mov ecx, dword [esp + 0xaff]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0xaff]
mov dword [eax + 0x14], esi
fld qword [esp + 0x26c]
call fcn.005a6596
mov ecx, dword [esp + 0x294]
mov edx, dword [esp + 0x298]
mov dword [esp + 0x9e3], eax
mov dword [esp + 0x9e7], ecx
mov dword [esp + 0x9eb], edx
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x97c], esi
lea esi, [edi + 0x414]
push dword [esi]
mov dword [esp + 0x919], eax
lea eax, [esp + 0xb6f]
push eax
mov dword [esp + 0x988], ecx
mov dword [esp + 0x98c], edx
mov dword [esp + 0x921], ecx
mov dword [esp + 0x925], edx
mov dword [esp + 0x953], ebx
call fcn.004fd738
push dword [esi]
lea eax, [esp + 0x584b]
push eax
call fcn.00525275
add edi, 0x208
push edi
lea esi, [esp + 0x10]
call fcn.0044757c
and dword [esp + 0x48], 0
mov eax, 0x4d344120
push 0x1c
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
pop eax
push eax
mov dword [esp + 0x44], 0x66747970
mov dword [esp + 0x3c], 0x607460
mov dword [esp + 0x54], 0x6d703432
mov dword [esp + 0x58], 0x69736f6d
mov dword [esp + 0x60], 3
mov dword [esp + 0x40], eax
call fcn.0058f8c4
pop ecx
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], eax
call fcn.005038e8
push dword [esp + 0x3c]
mov eax, esi
push dword [esp + 0x14]
push eax
call fcn.00402005
mov eax, dword [esp + 0x2c8]
add eax, 8
push 8
mov dword [esp + 0x30], 0x607448
mov dword [esp + 0x38], 0x6d646174
mov dword [esp + 0x34], eax
call fcn.0058f8c4
pop ecx
lea edi, [esp + 0x2c]
mov dword [esp + 0x1c], eax
call fcn.004d62ca
push 8
push dword [esp + 0x20]
mov eax, esi
push eax
call fcn.00402005
xor edi, edi
push edi
push edi
push dword [esp + 0x2cc]
push dword [esp + 0x2cc]
push dword [esp + 0x278]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push edi
push 6
push dword [esp + 0x298]
mov dword [esp + 0x2c], edi
push dword [esp + 0x298]
call fcn.005a6690
inc eax
push eax
lea esi, [esp + 0xb39]
call fcn.0055edd7
xor esi, esi
cmp dword [esp + 0x28c], edi
mov dword [esp + 0xb31], edi
jbe 0x4fe37f
push 6
xor edx, edx
mov eax, esi
pop ecx
div ecx
test edx, edx
jne 0x4fe326
lea eax, [esp + 0xc]
push eax
call fcn.004019a4
mov ecx, dword [esp + 0xb31]
mov edx, dword [esp + 0xb35]
mov dword [edx + ecx*4], eax
inc dword [esp + 0xb31]
mov eax, dword [esp + 0xb1c]
mov eax, dword [eax + esi*4]
add dword [esp + 0x20], eax
push eax
mov dword [esp + 0x2c], eax
call fcn.0058f8c4
pop ecx
push dword [esp + 0x28]
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x270]
push eax
call fcn.00401f65
push dword [esp + 0x28]
lea eax, [esp + 0x10]
push dword [esp + 0x1c]
push eax
call fcn.00402005
push dword [esp + 0x18]
call fcn.0058f8c9
inc esi
cmp esi, dword [esp + 0x290]
pop ecx
jb 0x4fe2f7
mov ecx, dword [esp + 0x2c8]
xor eax, eax
cmp ecx, dword [esp + 0x20]
jne 0x4fe39d
mov ecx, dword [esp + 0x2cc]
cmp ecx, eax
je 0x4fe425
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 8]
push dword [esp + 0x1c]
mov dword [edi], ebx
call fcn.0058f8c9
pop ecx
push dword [esp + 0x10]
call fcn.0058f8c9
cmp dword [esp + 0x10], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
je 0x4fe3d7
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xb39]
push eax
call fcn.004d6e02
lea esi, [esp + 0xa55]
call fcn.004d6685
push dword [esp + 0x24]
call fcn.0058f8c9
pop ecx
push dword [esp + 0x14]
call fcn.0058f8c9
cmp dword [esp + 0x26c], 0xffffffff
pop ecx
je 0x4fe417
push dword [esp + 0x268]
call ebx
mov eax, edi
jmp 0x4fe530
xor eax, eax
jmp 0x4fe025
lea ecx, [esp + 0x8e8]
call fcn.004d6e31
mov ebx, eax
push ebx
call fcn.0058f8c4
pop ecx
mov esi, eax
push esi
lea ecx, [esp + 0x8ec]
call fcn.00503e15
push ebx
push esi
lea eax, [esp + 0x14]
push eax
call fcn.00402005
push esi
call fcn.0058f8c9
cmp dword [esp + 0x26c], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
je 0x4fe47d
push dword [esp + 0x268]
call ebx
or dword [esp + 0x268], 0xffffffff
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
push dword [esp + 0x1c]
mov dword [eax], edi
call fcn.0058f8c9
pop ecx
push dword [esp + 0x10]
call fcn.0058f8c9
cmp dword [esp + 0x10], 0xffffffff
pop ecx
je 0x4fe4b1
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xb39]
push eax
call fcn.004d6e02
lea esi, [esp + 0xa55]
call fcn.004d6685
push dword [esp + 0x24]
call fcn.0058f8c9
pop ecx
push dword [esp + 0x14]
call fcn.0058f8c9
cmp dword [esp + 0x26c], 0xffffffff
pop ecx
je 0x4fe4f1
push dword [esp + 0x268]
call ebx
mov eax, dword [ebp + 8]
jmp 0x4fe530
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 8]
push dword [esp + 0x14]
mov dword [esi], 2
call fcn.0058f8c9
pop ecx
cmp dword [esp + 0x268], 0xffffffff
je 0x4fe52e
push dword [esp + 0x268]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc