Function at 0x64607ad3
Capabilities:
Delete file
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x3d4], eax
lea edi, [ebp - 0x3f4]
xor eax, eax
mov dword [ebp - 0x3b8], esi
mov dword [ebp - 0x3c8], eax
mov ebx, eax
mov dword [ebp - 0x3cc], eax
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3e8], 0x14
mov dword [ebp - 0x3e4], edi
mov dword [ebp - 0x3e0], edi
mov dword [ebp - 0x3dc], edi
mov dword [ebp - 0x3d8], edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607b95
test dword [eax + 0x1c], 0x200
je 0x64607b95
cmp byte [eax + 0x19], 4
jb 0x64607b95
push dword [eax + 0x14]
mov edx, 0x64601f58
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.64604423
mov ecx, dword [ebp - 0x3bc]
push edi
push edi
push dword [ecx]
push edi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
mov dword [ebp - 0x3d0], edi
test edi, edi
jne 0x64607bfb
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607bf1
test dword [eax + 0x1c], 0x200
je 0x64607bf1
cmp byte [eax + 0x19], 2
jb 0x64607bf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x64601690
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
mov edx, 0x64601f58
pop ecx
call fcn.64604465
mov ebx, 0x2cfb
jmp 0x646081dc
push 0x40
lea eax, [ebp - 0x14c]
push eax
push 0x2d17
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x3e4], eax
call fcn.64606101
test eax, eax
je 0x64607bf1
lea eax, [ebp - 0x354]
mov dword [ebp - 0x3dc], 0x646016a4
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x3e8]
push eax
push edi
call dword [sym.imp.GDI32.dll_StartDocW]
test eax, eax
jg 0x64607c95
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607bf1
test dword [eax + 0x1c], 0x200
je 0x64607bf1
cmp byte [eax + 0x19], 2
jb 0x64607bf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x646016ac
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
jmp 0x64607be6
test esi, esi
je 0x64607cc7
mov esi, dword [esi]
xor eax, eax
push eax
push eax
push eax
mov ecx, dword [esi + 0x14]
push eax
push dword [ebp - 0x3b8]
call dword [0x64618384]
call dword [esi + 0x14]
test eax, eax
jns 0x64607cc1
mov ebx, 0x2cf2
jmp 0x646081dc
mov esi, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [eax + 8], ecx
jne 0x64607e30
mov edx, dword [ebp - 0x3c4]
test edx, edx
je 0x64607e30
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3b8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607cf1
sub ecx, dword [ebp - 0x3b8]
sar ecx, 1
je 0x64607e28
mov ecx, edx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607d13
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x80]
mov ecx, eax
mov dword [ebp - 0x3b8], eax
call fcn.6460cdda
mov dword [ebp - 0x3c0], eax
test eax, eax
jne 0x64607d4e
mov ebx, 0x2cfd
jmp 0x646081dc
push 0x40
lea eax, [ebp - 0xcc]
push eax
push 0x2cff
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x64607dc2
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607dab
test dword [eax + 0x1c], 0x200
je 0x64607dab
cmp byte [eax + 0x19], 2
jb 0x64607dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f58
push 0x646016c0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.64604465
push 0x646016d8
lea eax, [ebp - 0xcc]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x3c4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x3b8]
push dword [ebp - 0x3c0]
call fcn.64605b47
mov ecx, eax
add esp, 0x10
test ecx, ecx
jns 0x64607e28
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607e1e
test dword [eax + 0x1c], 0x200
je 0x64607e1e
cmp byte [eax + 0x19], 2
jb 0x64607e1e
push ecx
push 0x646016e0
push dword [eax + 0x14]
mov edx, 0x64601f58
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.64604465
mov ebx, 0x2cfe
jmp 0x646081dc
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
je 0x64608151
test esi, esi
je 0x64607e54
lea eax, [ebp - 0x3cc]
push eax
push ecx
push esi
call dword [sym.imp.MAPI32.dll_Ordinal_185]
test eax, eax
js 0x64607cb7
xor eax, eax
push eax
push dword [0x64617404]
push eax
push eax
push eax
push eax
push eax
push eax
push 4
push 0x646012dc
push 0x64601700
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp - 0x3b8], esi
test esi, esi
jne 0x64607ec7
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607bf1
test dword [eax + 0x1c], 0x200
je 0x64607bf1
cmp byte [eax + 0x19], 2
jb 0x64607bf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x64601718
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
jmp 0x64607be6
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x64607fd2
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607eda
sub ecx, edx
sar ecx, 1
je 0x64607fd2
push dword [ebp - 0x3c0]
xor eax, eax
push eax
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x3b4]
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0x3bc]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3b4], 0x5c
mov dword [ebp - 0x3b0], 0xa800000f
cmp dword [edx + 0x28], 0x2bc
movzx eax, byte [edx + 0x2e]
setge cl
neg eax
push 0x1f
sbb eax, eax
and eax, 8
or ecx, eax
movzx eax, byte [edx + 0x2d]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
movzx eax, byte [edx + 0x2c]
neg eax
sbb eax, eax
and eax, 2
or ecx, eax
mov eax, dword [edx + 0x18]
cdq
xor eax, edx
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp - 0x3bc]
sub eax, edx
imul eax, eax, 0x14
mov dword [ebp - 0x3a8], eax
mov al, byte [ecx + 0x2f]
mov byte [ebp - 0x39c], al
mov al, byte [ecx + 0x33]
mov byte [ebp - 0x39b], al
lea eax, [ecx + 0x34]
push eax
lea eax, [ebp - 0x39a]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
lea eax, [ebp - 0x3b4]
push eax
push 4
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3cc]
test eax, eax
je 0x64608004
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x3f4]
push eax
push 0xc002
push 0x449
push esi
mov dword [ebp - 0x3ec], 0x64606b10
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x40
push eax
lea eax, [ebp - 0x4c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x1f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x646080ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6460806c
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64608062
test dword [eax + 0x1c], 0x200
je 0x64608062
cmp byte [eax + 0x19], 5
jb 0x64608062
push dword [eax + 0x14]
mov edx, 0x64601f58
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.64604423
mov ebx, 0x2d03
jmp 0x646081dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x64608141
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646081dc
test dword [ecx + 0x1c], 0x200
je 0x646081dc
cmp byte [ecx + 0x19], 2
jb 0x646081dc
push ebx
push 0x64601738
push dword [ecx + 0x14]
mov edx, 0x64601f58
push dword [ecx + 0x10]
push 0x30
pop ecx
call fcn.64604465
jmp 0x646081dc
lea esi, [ebp - 0x4c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x646080d2
sub esi, ecx
sar esi, 1
cmp esi, 0x1e
jae 0x6460813b
mov dword [ebp - 0x3c4], edx
lea edi, [ebp - 0x4c]
test esi, esi
je 0x64608125
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x64608111
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswcntrl]
pop ecx
test eax, eax
je 0x64608135
mov eax, dword [ebp - 0x3c4]
add edi, 2
inc eax
mov dword [ebp - 0x3c4], eax
cmp eax, esi
jb 0x646080f3
mov edi, dword [ebp - 0x3d0]
mov ebx, 0x2d03
jmp 0x646081dc
mov edi, dword [ebp - 0x3d0]
mov esi, dword [ebp - 0x3b8]
push edi
push esi
call fcn.64622f9c
test eax, eax
jne 0x64608165
jmp 0x64607bf1
push eax
push dword [ebp - 0x3c0]
push esi
push edi
call fcn.6460647e
mov ebx, eax
test ebx, ebx
jne 0x646081dc
push edi
push ecx
mov ecx, dword [ebp - 0x3bc]
mov ecx, dword [ecx]
call fcn.6460d5c5
test eax, eax
jle 0x646081dc
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x646081dc
xor ebx, ebx
mov edi, ebx
cmp word [ebp - 0x354], bx
je 0x646081dc
lea ecx, [ebp - 0x354]
call fcn.6460e6a4
mov ecx, eax
mov eax, dword [ebp - 0x3d4]
mov dword [eax], ecx
test ecx, ecx
je 0x64607d44
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646081dc
test dword [eax + 0x1c], 0x200
je 0x646081dc
cmp byte [eax + 0x19], 5
jb 0x646081dc
push ecx
push dword [eax + 0x14]
mov edx, 0x64601f58
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.64605ed3
mov ecx, dword [ebp - 0x3cc]
test ecx, ecx
je 0x646081f6
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x64618384]
call esi
test edi, edi
je 0x64608201
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x3c0]
call fcn.6460ce5b
test ebx, ebx
je 0x6460827c
lea ecx, [ebp - 0x354]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x6460821b
sub ecx, edx
sar ecx, 1
je 0x6460827c
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x6460827c
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6460827c
test dword [eax + 0x1c], 0x200
je 0x6460827c
cmp byte [eax + 0x19], 2
jb 0x6460827c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f58
push 0x64601658
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.64604465
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615f50
mov esp, ebp
pop ebp
ret 0x14