Function at 0x50bd44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0x5b7cb4
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b3278
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.0050c456
add esp, 4
test eax, eax
je 0x50bdb2
push 0x5b3288
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x50bdb0
xor eax, eax
jmp 0x50c34c
jmp 0x50bdda
push 0x5b328c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x50bdda
xor eax, eax
jmp 0x50c34c
mov dword [ebp - 0x404], 1
jmp 0x50bdf5
mov edx, dword [ebp - 0x404]
add edx, 1
mov dword [ebp - 0x404], edx
mov dword [0x5b84b8], 0
jmp 0x50be0e
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x50be2a
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x400], 0
jmp 0x50be01
mov edx, dword [ebp - 0x408]
push edx
push 0x200
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
lea ecx, [ebp - 0x400]
push ecx
call fcn.00401fca
add esp, 4
cmp dword [ebp - 0x404], 1
jne 0x50beba
push str.8.25_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x50be8e
push str.CREATEOBJECT__WSCRIPT.SHELL__.RUN__.VBE__n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50beba
push str.AutoRun.AL_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 4
jne 0x50bf07
push str.CRON.COPYFILE__.CRSSCR.EXE____SY___CRSSCR.EXE___n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50bf07
push str.AutoRun.CRSSCR_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 1
jne 0x50bf6e
push str._SCRIPT_LANGUAGE_VBSCRIPT__V_S__
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50bf42
push str._SCRIPT_LANGUAGE_VBSCRIPT__VCHR_115__
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50bf6e
push str.AutoRun.VBSCuban_hta_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 2
jne 0x50bfd5
push str.V_O__
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50bfa9
push str.VCHR_111__
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50bfd5
push str.AutoRun.VBSCuban_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 7
jne 0x50c022
push str.RUNHIDE.RUN__WINDOWS.BAT_HIDE_ME__VBHIDE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c022
push str.AutoRun.WinBat_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 3
jne 0x50c087
push str.OSHELL.RUN__SYSTEMM4.EXE__n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x50c05b
push str.OSHELL.RUN__SYSTEMM7.EXE__n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c087
push str.Agent.GXI_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 0xc
jne 0x50c0d5
push str.JELLYBEAN_MAGICALJELLYBEAN.COM
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50c0d5
push str.FindKeyXp_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 1
jne 0x50c122
push str.MY_NAME_IS_SLOW_BUT_SURE_V0.05_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c122
push 0x5b3498
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 2
jne 0x50c16f
push str.REM_121206__DO_U_STILL_REMEMBER_DIS_DAY_US_3__n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c16f
push str.IE_Title_o_Solow_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 2
jne 0x50c1bc
push str.WS.RUN__SYS32.EXE___START__0_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c1bc
push str.Spamta.Worm_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 4
jne 0x50c223
push str.WSHSHELL.RUN__
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50c223
push str.:USBINIT32.EXE__n
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50c223
push str.Trojan.Gibi.CN_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 1
jne 0x50c271
push str.DIM_FSO__DC__D__A__EJE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50c271
push str.Trojan.Swisyn.AECH_html_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 0xc
jne 0x50c2be
push str.MSG___HACK_BY_DEBUGGER______n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c2be
push 0x5b35b8
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
cmp dword [ebp - 0x404], 3
jne 0x50c308
push str.DIM_MSCMSGBGWWQK_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c308
push str.Worm.Pica_vbs_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x50c34c
mov edx, dword [ebp - 0x408]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x50c31a
jmp 0x50c32a
cmp dword [ebp - 0x404], 0xc
jne 0x50c325
jmp 0x50c32a
jmp 0x50bde6
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret