Function at 0x4dddec
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x158]
mov esi, ecx
push ebx
xor ebx, ebx
sub esp, 0x16c
mov dword [esp], edi
call fcn.004a8b76
mov eax, dword [ebp - 0x158]
mov dword [esp + 4], 0x527ac7
mov dword [ebp - 0x144], 0
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x148], eax
test eax, eax
je 0x4de071
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4ddef7
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x148]
xor ebx, ebx
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x4011f00d
call fcn.0050c744
push ecx
push ecx
test al, al
jne 0x4dde81
mov dword [esp + 4], str.ERROR:_could_not_write_magic
jmp 0x4ddebf
call sub.msvcrt.dll_rand
lea edx, [ebp - 0x140]
mov dword [edx + ebx*4], eax
inc ebx
cmp ebx, 4
jne 0x4dde81
mov dword [esp], edx
lea ecx, [ebp - 0x148]
mov dword [esp + 4], 0x20
call fcn.0050c744
test al, al
push edx
push edx
lea edx, [ebp - 0x140]
jne 0x4dded8
mov dword [esp + 4], str.ERROR:_could_not_write_nonce
mov dword [esp], 0x569500
call fcn.004c8bb5
mov dword [esp], eax
call fcn.004c8fa3
jmp 0x4de027
lea eax, [esi + 0x54]
mov dword [esp], edx
lea ebx, [ebp - 0x120]
mov dword [esp + 4], eax
mov ecx, ebx
call fcn.0050ac20
mov dword [ebp - 0x144], ebx
push eax
push eax
lea eax, [ebp - 0x154]
lea ecx, [ebp - 0x148]
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [ebp - 0x154], 0xc01df00d
call fcn.0050c744
mov ebx, eax
push ecx
push ecx
test al, al
jne 0x4ddf46
mov dword [esp + 4], str.ERROR:_could_not_write_magic
mov dword [esp], 0x569500
call fcn.004c8bb5
mov dword [esp], eax
call fcn.004c8fa3
jmp 0x4de071
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
lea edx, [esi + 0x10]
cmp eax, edx
mov dword [ebp - 0x15c], eax
je 0x4de02b
lea ebx, [ebp - 0x140]
mov ecx, ebx
call fcn.004c7448
mov eax, dword [ebp - 0x15c]
mov dword [esp], ebx
lea ecx, [eax + 0x10]
call fcn.00428420
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], 4
mov dword [esp], eax
call fcn.0050c744
push edx
push edx
test al, al
jne 0x4ddfc3
mov dword [esp + 4], str.ERROR:_could_not_write_size
jmp 0x4ddfef
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call fcn.0050c744
push edx
push edx
test al, al
jne 0x4de010
mov dword [esp + 4], str.ERROR:_could_not_write_msg
mov dword [esp], 0x569500
call fcn.004c8bb5
mov dword [esp], eax
call fcn.004c8fa3
lea ecx, [ebp - 0x140]
call fcn.004c7456
jmp 0x4de027
mov ecx, ebx
call fcn.004c7456
lea ecx, [ebp - 0x150]
call fcn.004c799e
jmp 0x4ddf4f
xor ebx, ebx
jmp 0x4de071
mov eax, dword [ebp - 0x148]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp + 8]
mov dword [esp + 8], 3
mov dword [ebp - 0x148], 0
mov eax, dword [eax]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
sub esp, 0xc
test eax, eax
setne bl
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x4de083
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, edi
call fcn.004c641a
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8