Function at 0x56d974
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x56d97c
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56e105
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [0x583c90]
call fcn.00512820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x870]
mov edx, dword [eax + 0x68]
mov eax, dword [eax + 0x254]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x57b6b8]
cmp byte [eax], 1
jae 0x56d9d7
mov eax, 0x57afe0
mov edx, 0x56e120
call fcn.0040549c
push 0x56e12c
push dword [0x57afe0]
push 0x56e13c
push dword [0x57afe0]
push 0x56e158
mov eax, 0x583cc4
mov edx, 5
call fcn.004057cc
mov eax, dword [0x583c90]
mov eax, dword [eax + 0x368]
call fcn.0047ac78
mov dword [0x583de8], eax
mov dl, 1
mov eax, dword [0x49c5fc]
call fcn.0049da68
mov dword [0x583c94], eax
xor edx, edx
mov eax, dword [0x583c94]
call fcn.0049e358
mov eax, dword [0x583c94]
mov eax, dword [eax + 0x54]
mov edx, dword [0x583d64]
call fcn.0042d91c
mov eax, dword [0x583c94]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0x551b94
mov dl, 1
mov eax, dword [0x432948]
call fcn.0043c354
mov dword [0x583d88], eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4d5420]
call fcn.004d5478
mov dword [0x583d34], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004728f8
push eax
call sub.shell32.dll_DragAcceptFiles
lea eax, [ebp - 0x30]
push eax
mov eax, 0x56e178
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
lea ecx, [ebp - 0x4c]
mov edx, 0x50
mov al, 0x20
call fcn.00405bf8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
mov eax, 0x56e188
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
lea edx, [ebp - 0x48]
mov ecx, 2
mov eax, 0x56e194
call fcn.0040e7d0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004689f4
lea eax, [ebp - 0x50]
push eax
mov eax, 0x56e178
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
mov eax, 0x56e188
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
lea edx, [ebp - 0x60]
mov ecx, 1
mov eax, 0x56e1c0
call fcn.0040e7d0
mov edx, dword [ebp - 0x50]
mov eax, dword [0x57b5b0]
mov eax, dword [eax]
call fcn.0048c818
push 0xbff00000
push 0
call fcn.005541b4
push 0xbff00000
push 0
call fcn.00554038
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.00564bf4
xor eax, eax
call fcn.00552a80
xor eax, eax
call fcn.00552ac4
xor eax, eax
call fcn.00552b1c
xor eax, eax
call fcn.00552b6c
xor eax, eax
call fcn.005529d4
xor eax, eax
call fcn.00552a24
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00564b1c
mov eax, 0x583eb0
xor edx, edx
call fcn.00553f5c
xor eax, eax
call fcn.00552bd0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00553ed4
mov dword [0x583eb4], 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x65c]
mov dword [0x583ec0], eax
lea eax, [ebp - 8]
call fcn.0056d510
lea eax, [ebp - 8]
mov edx, 0x56e1d4
call fcn.00569460
mov eax, dword [ebp - 4]
call fcn.005675c4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00554cac
mov eax, dword [ebp - 0x68]
push eax
mov eax, 0x56e1e0
mov dword [ebp - 0x70], eax
mov eax, 0x56e1f4
mov dword [ebp - 0x6c], eax
lea edx, [ebp - 0x70]
mov ecx, 1
pop eax
call fcn.00510624
mov edx, dword [ebp - 0x64]
mov eax, 0x583e80
call fcn.0040549c
call fcn.0055c5e8
mov byte [ebp - 0xa], 0
mov eax, 0x10
call fcn.0050fb08
test al, al
jne 0x56dc2a
push ebp
call fcn.0056d6f0
pop ecx
mov byte [ebp - 0xa], al
jmp 0x56dc3c
mov ecx, 5
mov edx, 0x56e208
mov eax, dword [ebp - 4]
call fcn.00569ce8
mov eax, 0x11
call fcn.0050fb08
test al, al
jne 0x56dc71
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5a8]
cmp byte [eax + 0x38], 0
je 0x56dc71
mov eax, dword [0x57b240]
mov eax, dword [eax]
cmp byte [eax + 8], 0
jne 0x56dc71
mov byte [ebp - 9], 0
mov byte [0x583e7c], 1
movzx ebx, byte [ebp - 0xa]
xor bl, 1
test bl, bl
je 0x56dc86
mov eax, dword [0x583e14]
call fcn.0054c65c
lea eax, [ebp - 8]
xor edx, edx
call fcn.00569460
cmp byte [0x583e7c], 0
jne 0x56dd42
test bl, bl
je 0x56dd19
call fcn.0054b700
call fcn.00568e68
test al, al
jne 0x56dd19
mov ecx, dword [0x583c90]
mov dl, 1
mov eax, dword [0x539a04]
call fcn.00481f94
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x56dd12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xfc]
cmp eax, 6
jne 0x56dcfc
call fcn.00569098
test al, al
jne 0x56dcfc
xor ecx, ecx
mov edx, 0x10
mov eax, 0x56e21c
call fcn.0050b1f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56dd19
mov eax, dword [ebp - 0x10]
call fcn.004044ec
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5dc]
cmp byte [eax + 0x38], 0
je 0x56dd42
mov eax, 0x583cbc
xor edx, edx
call fcn.0050e104
test al, al
je 0x56dd42
mov eax, dword [0x583cbc]
call fcn.00548ef4
push 0
lea eax, [ebp - 0x74]
call fcn.0050e468
mov ebx, dword [ebp - 0x74]
mov eax, ebx
call fcn.00406878
push eax
mov edx, ebx
mov eax, dword [0x583ca8]
pop ecx
call fcn.0050b448
test al, al
jne 0x56dd78
lea eax, [ebp - 0x78]
call fcn.0049d60c
mov eax, dword [ebp - 0x78]
call fcn.00548ef4
mov dl, 1
mov eax, dword [0x4d4d80]
call fcn.004d4df4
mov dword [0x583e60], eax
mov eax, dword [0x583e60]
mov byte [eax + 0x29], 1
mov eax, dword [ebp - 4]
call fcn.00553d38
mov eax, dword [0x57b5b0]
mov eax, dword [eax]
mov dword [eax + 0x78], 0x64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x734]
mov byte [eax + 0x19c], 0
mov byte [eax + 0x19c], 1
mov edx, dword [eax]
call dword [edx + 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7b0]
mov eax, dword [eax + 0x4c]
mov dword [0x583f7c], eax
cmp byte [0x583e7c], 0
jne 0x56df5f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e4]
cmp byte [eax + 0x38], 0
je 0x56de0e
lea eax, [ebp - 0x7c]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [0x583cb0]
call fcn.00545c84
mov eax, dword [ebp - 0x7c]
call fcn.0050f5cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4dc]
cmp byte [eax + 0x38], 0
je 0x56de54
mov eax, dword [0x583d14]
call fcn.0040d810
test al, al
jne 0x56de54
lea eax, [ebp - 0x80]
mov ecx, 0x56e25c
mov edx, dword [0x583d14]
call fcn.00405758
mov eax, dword [ebp - 0x80]
call fcn.0040d810
test al, al
jne 0x56de54
mov eax, 0x583d14
call fcn.00405448
mov eax, 0x56e26c
call fcn.0050efb8
fstp qword [ebp - 0x70]
wait
mov eax, dword [0x583d14]
call fcn.0050efb8
fcomp qword [ebp - 0x70]
wait
fnstsw ax
sahf
jae 0x56df51
xor ecx, ecx
mov edx, 0x34
mov eax, 0x56e280
call fcn.0050b1f8
cmp eax, 6
jne 0x56df51
mov ecx, 0x56e25c
lea eax, [ebp - 0x84]
mov edx, dword [0x583d14]
call fcn.00405758
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov eax, dword [0x583d14]
mov dword [ebp - 0x1c], eax
mov ecx, 0x56e25c
lea eax, [ebp - 0x88]
mov edx, dword [0x583d14]
call fcn.00405758
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
call fcn.0040590c
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x56df42
mov eax, dword [0x583d14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
call fcn.0040590c
push eax
mov eax, 0x56e26c
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x29], al
jmp 0x56df51
mov eax, 0x583d14
mov edx, 0x56e26c
call fcn.0040549c
mov edx, dword [0x583d14]
mov eax, dword [ebp - 4]
call fcn.0056636c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00569704
cmp byte [0x583e7c], 0
jne 0x56dfce
cmp byte [ebp - 0xa], 0
jne 0x56df88
movzx edx, byte [0x57afdc]
mov eax, dword [ebp - 4]
call fcn.005672dc
mov edx, dword [0x583d88]
mov eax, dword [0x583d34]
call fcn.004d5594
mov eax, dword [0x583d34]
mov edx, dword [ebp - 4]
mov dword [eax + 0x1fc], edx
mov dword [eax + 0x1f8], 0x561bf8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x468]
cmp byte [eax + 0x38], 0
je 0x56dfce
call fcn.00543a30
mov eax, dword [0x583d34]
call fcn.004d56a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov dl, 1
call fcn.004521f4
mov byte [0x583ea8], 1
cmp byte [0x583e7c], 0
je 0x56e006
mov eax, dword [0x57b5b0]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov eax, dword [ebp - 4]
call fcn.004882a0
jmp 0x56e0a9
mov eax, dword [ebp - 4]
call fcn.0048848c
push ebp
mov eax, dword [0x583e90]
call fcn.0056d874
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
cmp byte [eax + 0x38], 0
je 0x56e035
mov eax, dword [0x57b5b0]
mov eax, dword [eax]
call fcn.0048c514
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5dc]
cmp byte [eax + 0x38], 0
je 0x56e05f
cmp dword [0x583cbc], 0
jne 0x56e05f
mov ecx, 0x1e
mov edx, 0x56e2ec
mov eax, dword [ebp - 4]
call fcn.00569ce8
call fcn.0054bb34
push ebp
call fcn.0056d634
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7a4]
mov edx, dword [eax]
call dword [edx + 0xd4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00552da4
cmp byte [0x583e85], 0
jne 0x56e094
call fcn.0054c56c
lea eax, [ebp - 0x8c]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x56e318
call fcn.00520968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56e10c
lea eax, [ebp - 0x8c]
mov edx, 6
call fcn.0040546c
lea eax, [ebp - 0x74]
mov edx, dword [0x407934]
call fcn.00406b2c
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.0040546c
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.0040546c
lea eax, [ebp - 0x30]
call fcn.00405448
lea eax, [ebp - 8]
mov edx, dword [0x407934]
call fcn.00406b2c
ret