Function at 0x100011bc
Capabilities:
Delete file
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005fa4d
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebx
push esi
mov esi, edx
push edi
cmp byte [esi], 0x50
jne 0x100017b4
cmp byte [esi + 1], 0x4b
jne 0x100017b4
movzx edi, byte [esi + 2]
movzx eax, byte [esi + 3]
add edi, 4
add eax, 0x18
add eax, edi
mov dword [esp + 0x18], eax
mov ecx, dword [edi + esi + 0x14]
mov edx, dword [edi + esi]
call fcn.100011b0
push 3
lea ecx, [esp + 0x6c]
mov dword [esp + 0x28], eax
call fcn.100017ce
xor ebx, ebx
lea ecx, [esp + 0x5c]
push 2
mov dword [esp + 0xc0], ebx
call fcn.100017ce
mov dword [esp + 0x1c], 0xa77c8748
mov dword [esp + 0xc], ebx
jmp 0x10001259
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10001246
mov dword [esp + 0xc], ebx
jmp 0x10001279
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xb8c3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10001266
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10001291
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov eax, dword [esp + 0x5c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x1c], 0xfffffffa
call fcn.10001830
or dword [esp + 0xbc], 0xffffffff
lea ecx, [esp + 0x68]
call fcn.10001830
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x44]
add eax, esi
mov dword [esp + 0x14], 0xca4f833f
push 3
mov dword [esp + 0x38], eax
call fcn.100017ce
mov dword [esp + 0xc], ebx
jmp 0x100012f6
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x44]
mov dword [eax + ecx*4], 0xe60f951
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100012e3
cmp dword [esp + 0x14], ebx
je 0x10001314
mov dword [esp + 0x18], 0xffffffff
inc dword [esp + 0x18]
jmp 0x100013ba
mov dword [esp + 0xc], 0xfffffff9
xor ecx, ecx
mov dword [esp + 0x20], 0xffffffff
xor edx, edx
mov dword [esp + 0x1c], 0xffffffff
inc edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp eax, edx
setg cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
sub ecx, eax
jne 0x10001365
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jg 0x100013ba
mov edx, 0xa1dd7933
mov dword [esp + 0x14], ebx
jmp 0x10001396
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa0], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10001383
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x44]
mov dword [eax + ecx*4], edx
mov dword [esp + 0xa8], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1000137d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100013d7
push 0x8b9
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x44]
call fcn.10001830
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x14], ebx
jmp 0x10001406
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2c], 0xfff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100013f6
mov dword [esp + 0xc], 0x12
jmp 0x10001421
cmp dword [esp + 0xc], ebx
jne 0x10001428
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1a
jne 0x10001417
mov dword [esp + 0xc], ebx
jmp 0x100014f5
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x18], 0x267e
mov dword [esp + 0x28], 0xae215169
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2c], ecx
mov dword [esp + 0x14], ebx
jmp 0x100014e6
mov dword [esp + 0x1c], 0x8716
mov dword [esp + 0x20], 0x5db2b058
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x2c], ebx
jne 0x100014f1
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x2c]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x28]
je 0x100014dc
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x2c], ebx
je 0x100014dc
xor eax, eax
inc eax
jmp 0x100014de
mov eax, ebx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x10001462
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jle 0x10001431
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x24]
push 2
mov dword [eax], ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x10], 0xfffffff7
call fcn.100017ce
mov dword [esp + 0xbc], 1
mov dword [esp + 0x20], 0xbf90350d
mov dword [esp + 0x14], ebx
jmp 0x10001548
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0x9ac54c97
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10001535
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10001564
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov dword [esp + 0xc], ebx
jmp 0x10001652
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x50]
mov dword [esp + 0x18], 0xffffffff
push 4
call fcn.100017ce
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
jmp 0x100015a5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 0xcee34edf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10001592
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc dword [esp + 0x20]
cmp eax, ecx
jne 0x100015c5
xor edx, edx
inc edx
jmp 0x100015c7
mov edx, ebx
mov eax, dword [esp + 0x74]
mov ecx, dword [eax]
mov eax, dword [esp + 0x50]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp edx, 1
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, dword [esp + 0x18]
jle 0x10001623
mov eax, dword [esp + 0x50]
cmp dword [eax + 4], ebx
je 0x10001623
xor edx, edx
inc edx
jmp 0x10001625
mov edx, ebx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
sub ecx, 0x3cf6547d
cmp ecx, 0x1943
lea ecx, [esp + 0x50]
setl al
mov dword [esp + 0x28], eax
call fcn.10001830
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffe
jl 0x1000156d
or dword [esp + 0xbc], 0xffffffff
lea ecx, [esp + 0x74]
call fcn.10001830
mov eax, dword [esp + 0x24]
shr eax, 2
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [edi + esi]
mov dword [esp + 0x80], eax
mov eax, dword [edi + esi + 4]
mov dword [esp + 0x84], eax
mov eax, dword [edi + esi + 8]
mov dword [esp + 0x88], eax
mov eax, dword [edi + esi + 0xc]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x28], 0x9ac78948
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100016c6
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100016de
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x24]
mov edi, ebx
test ecx, ecx
je 0x100017b9
sub esi, dword [esp + 0x34]
push dword [esp + 0x28]
movdqa xmm0, xmmword [0x1006e500]
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x40], ebx
push eax
push ebx
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], ebx
movdqu xmmword [esp + 0xa0], xmm0
mov dword [esp + 0x50], ebx
call fcn.100018ed
mov dword [esp + 0xc], 0xcb50bf34
mov dword [esp + 0xc], ebx
jmp 0x10001753
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0xc]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x10001739
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10001779
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea ecx, [esp + 0x38]
call fcn.10001830
mov eax, dword [esp + 0x34]
mov edx, edi
and edx, 3
mov ecx, dword [eax]
mov edx, dword [esp + edx*4 + 0x80]
call fcn.100011b0
mov ecx, dword [esp + 0x34]
mov dword [esi + ecx], eax
add ecx, 4
inc edi
mov dword [esp + 0x34], ecx
cmp edi, dword [esp + 0x24]
jb 0x100016f0
jmp 0x100017b9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret