Function at 0x1000839a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10039720]
mov eax, dword [eax + 0x1898]
sub esp, 0x84
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
test al, 0x82
je 0x1000841d
mov eax, 0x454
call fcn.10012cb7
mov dword [esp + 0x10], eax
mov eax, 0xd1b
call fcn.10012cb7
mov dword [esp + 0x14], eax
cmp dword [esp + 0x10], ebx
je 0x1000841d
cmp eax, ebx
je 0x1000841d
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
test eax, eax
jne 0x100083fc
push dword [esp + 0x14]
call edi
test eax, eax
je 0x100083ff
xor esi, esi
inc esi
lea eax, [esp + 0x10]
call fcn.1000b9f4
lea eax, [esp + 0x14]
call fcn.1000b9f4
cmp esi, ebx
je 0x1000841d
or eax, 0xffffffff
jmp 0x10008898
call fcn.100082e9
test eax, eax
je 0x10008415
push 0xaf0
push 0x10
push 0x100336e0
call fcn.1000f138
mov esi, dword [ebp + 8]
add esp, 0xc
push ebx
mov dword [0x10039798], eax
mov eax, dword [0x10039720]
push ebx
lea ecx, [eax + 0x114]
mov eax, dword [eax + 0x110]
push esi
push ecx
push dword [eax]
call fcn.10007d83
mov ecx, dword [0x10039720]
add esp, 0x14
cmp dword [ecx + 0x101c], 3
je 0x1000848e
mov eax, dword [ecx + 0x214]
cmp eax, 3
je 0x1000848e
cmp dword [ecx + 4], 6
jae 0x10008787
cmp eax, 2
jne 0x10008787
xor eax, eax
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x40], esi
mov eax, dword [ecx + 0x214]
mov dword [esp + 0x3c], eax
mov eax, dword [0x10039798]
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x100084c3
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
push 1
push ebx
push ebx
call eax
lea eax, [esp + 0x3c]
push eax
call fcn.10012f2b
pop ecx
cmp dword [0x10039828], ebx
jbe 0x10008787
mov eax, dword [0x10039798]
cmp dword [eax + 8], ebx
je 0x100084f1
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x100084f1
push dword [esp + 0x44]
call eax
push ebx
call fcn.1000cef9
pop ecx
cmp edx, ebx
jg 0x10008513
jl 0x10008505
cmp eax, 0x2bcf
jae 0x10008513
push ebx
push ebx
push str.olv.WHUv3eXAqGxWLBDcfnTub4rluW9L47L6OkxHXqGSTcFV.uQudyDeu_hZWfFDrVeP_P1dDZi1StiISZZw22kL2lqoz3sLSYQghbB_E_o3C5NZOjabPIv6tI_glm_PpDwwViivgqoKs3PbKdxoc95CatBblCRKUnoRAPD36CeKYaW_GbYIVW5ahIwyGBv_ojkbAGz7.DQOoz0aC_aAY_WENYLQKD3LhwdfwFS2Wz2zz.S_Fda_trlloUwnIdJk_EBHNaEBFoBd1Zb_ZRDw_Ncl9UAa4qjkBjbb34dtasrjyYoBrBWA6ejLrbxVOuWv4uB2ZL44tChP_Ofz9a6GwZdL._MtvaLOM2XangY88aP.jByrT9fdsVu3q2d9C7_rYMjgS3VZCZJYDaMbcwOLlWraNRU0wieqgomCMIhgo16Tq5Kq5j8I4kcb73F6SbuXD_ef_6dXh0_uxm.q6uBpEVlPA_NCfjuD7s_.WEaAoIOeDNNU_pDeppvkHhuIdkI.n.LiJh_YN_H_41bZ665grOQdla7tZqyZts5nx_ttCGsTEn2nAvS4lIOvK4sIxrPEXqk1I3AtbdxaZaP2m2c52_ZseIYI8aST_m_CAx_k9y8OruYBtCZpr6._kj_Ipuc4bSMDXcCbvJXsRvO_FViSwQyEschzbtWLKN2ZsUBnLDmEdGb3D_Xbd7mDgvlDUzlSEzDqnY7Jrb1QM2IjY7ar10c_Q_BTgDLKnvleH_4KnAk.Udd869i8Km.z6tOyAen_QGO8DTQ9BGFJggfSgvwYwd4I.YkU_c8XGmKi6VZv_2UZl_3WJMUs_AOpR8L8F6wlyg3p6_owzjzd0SYgyEosIQ5HmdF_s5BRO_clatm6xePFQs.B4_CTyBBVd_4xyFVmXnx_iBfdd5ql_
push ebx
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileA]
mov eax, dword [0x10039720]
cmp dword [eax + 0x214], 3
je 0x10008787
cmp dword [eax + 4], 6
jae 0x10008648
push 0xa
push 7
push 0x4b
push 0xd
push 0x14
push 0x18
push 0x14
push 0x22
push ebx
call dword [sym.imp.GDI32.dll_ArcTo]
mov eax, dword [0x10039720]
cmp dword [eax + 0x214], 2
jne 0x10008787
push 0x5b
push 0x14
push 0x50
push 0x59
push 0x18
push 0x57
push 7
push 0x5f
push ebx
call dword [sym.imp.GDI32.dll_Arc]
call fcn.100082cf
xor eax, eax
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x10039740]
call dword [eax + 0xd8]
mov eax, dword [esp + 0x36]
add eax, 2
movzx eax, ax
cdq
push 0x3c
pop ecx
idiv ecx
mov esi, 0x1000
push esi
add eax, dword [esp + 0x38]
movzx edi, ax
movzx eax, dx
mov dword [esp + 0x18], eax
call fcn.1000ac58
pop ecx
push ebx
mov dword [esp + 0x14], eax
call fcn.1000cef9
pop ecx
cmp edx, ebx
jg 0x100085de
jl 0x100085d0
cmp eax, 0x2bcf
jae 0x100085de
push ebx
push ebx
push str.Qgx_u7tBxqn_hDJwl3os4WpB.kjtZn_urJKm694ytQ_FYoXf1AS_B2zk0m87zHRux.UU31Xd.sbvflWnStt3Jzku2ibo9b82drf.B_22_PDjUwSZHKsyJ.sKtPg_tFy_QNYDT3uu43l5rHLFZn4aZLx_d3xMoXh8oqRen1sfbv0F8TF5VOQG_2n_zkIqpdDyHnnicqFSr0rK9L7S9Hd1Jn4VDmjiab_jfhVYAYWzccgFzacu00jUJ1z4uK5Fa.NeXhvd_vTLY4GeJJV_MbdGa_AM0rcLyDWjPw_aCAki2jW5KphMyXj4GpGhLbDxYX6F4SGyhY_4EJEqgM79lAJqND26XMNp1r398fFtcUxF8EURwUgdQBwFrrjoe9JA7Nr74DL3i4qh38PWlGjB6f9TuL7WFis56h4_uh13t5vYvRDGVkpa3duCLaKuy8N_J6Fn.gu.2S_OzWPFyY3KZ_J.JNHBo0MWyZAwmdoei90H_i5_NkEDGuO47fvuGB1Ken_IhRunekbEU8MtF4je10Nr_59_Z1tueL58q19DCMP.rDq_psSHtlBzNEvp_R09mbl2hUCRGSeWbhR3OSXedtmdapzEwST8lBYT_JiDh_4dbWrlJuM0j_X_wcKKdyTK60BGgMvU2bl2r_7FPARoP8rlXoQ50EskrmIVLv84_7Ij_cUhzwPOA1Lj3tLufP.RyYorp3.LNaaRe3yrXIVFPTDvl0RMzbUr2wDAkxUJNVJbNRuiAULg4B3vpUYvHZf3SfSLIGQPD0Sy4LpX4i_Ys_1GIvyXEj2azQa_8WbhF9YiSqgGm1MAUe8ASJPnP.5N5kYpVPvfa7WOaCSMwkjj4_DQ98p4LL_fYVd_Wo.BNFDbIMquIsLe_8oxFS5wrwsiiTYYTwqYei2_raUrSLIM_0i4_TCCccaa.O3iIK5AL_2F2Rmwd9Q9zkVNJ_5YXWUaLK545F3cCdpIGAcQ__HSIy._2L25S15r9khvvQ45kIcj2k.qjD9_3BZbo2ywTS3Yj2Y_HUe_VjfXtyv_U_Fs_03XAEeBkfyHKaQd6v0_ByeKFfDtQmPiPs2jYnq_WtY_d_DPy.hcj.Brh7lp4_rlMaNbQrlWpSOK4JNJIngalb_942jCm4x1tdwtbEdZNOyYkC_2tZy_24pH2oMQS.Ootp3tp5KvR8mWiTQag61O21NMYjUgoczOWK.aOElBesp1E9RrQmXT44oqg2.OffikFWoSJ.pqZn3_OWjFRpMBR8fUQ4loAAZZcxxdHeLk31I0PxagTaaxF6Zem8obqOO7lt_ECt_KaE0fd5pOiuNoEag9TrETSfE_VQDJgeb5Mx0UchbJ4QvDKJX9.skSK12_Is_o9PbK7BvgOVHoJRP_MyCux7DJw_o1udtPnVMDkyLf.R1p4_pCS2kg6w1pUtL44kXsrWSmh7HIxrYIDukz1DgmKH1eGElenNV7RmddCFgVkxwgTtlW2P.04Fx0DOtH__X8_tC1czV_MNTHjy_NGMJe_ObEOja._daGZMJbrT_Hdo_Yj_sMlCwWgC_QEinDx8._InQ5_kdWT8xiFnrMiGW4yxev4eN_ACm_W1HD5OBw49pBf4RX8ytgKRyQ8I
push ebx
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileA]
cmp dword [esp + 0x10], ebx
je 0x10008896
push 0x274
call fcn.10012cce
pop ecx
mov ecx, dword [0x10039720]
add ecx, 0x228
push ecx
movzx ecx, word [esp + 0x18]
push ecx
push edi
push eax
push esi
push dword [esp + 0x24]
mov dword [esp + 0x30], eax
call fcn.1000ce46
lea eax, [esp + 0x30]
push eax
call fcn.1000ba86
add esp, 0x1c
push 1
push 0xbb8
push ebx
push dword [esp + 0x1c]
call fcn.1000baa0
lea eax, [esp + 0x20]
push 0xfffffffffffffffe
push eax
call fcn.1000ab81
add esp, 0x18
jmp 0x10008896
cmp dword [eax + 0x101c], 3
jne 0x10008787
call fcn.100082cf
xor eax, eax
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x10039740]
call dword [eax + 0xd8]
mov ecx, dword [esp + 0x36]
lea eax, [ecx + 2]
movzx eax, ax
cdq
push 0x3c
pop esi
idiv esi
mov esi, dword [esp + 0x34]
add ecx, 0xe
push 0x3c
add eax, esi
movzx eax, ax
mov dword [esp + 0x28], eax
movzx eax, cx
mov dword [esp + 0x24], edx
cdq
pop ecx
idiv ecx
add eax, esi
movzx eax, ax
mov esi, 0x1000
push esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.1000ac58
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x10008896
push 0x2aa
call fcn.10008af1
mov dword [esp + 0x18], eax
mov eax, dword [0x10039720]
pop ecx
add eax, 0x648
push eax
push 0xa
push 7
push 2
lea edi, [esp + 0x60]
call fcn.1000b4be
mov eax, dword [0x10039720]
push dword [eax + 0xa0]
add eax, 0x228
push 1
push eax
call fcn.10001091
add esp, 0x1c
mov dword [esp + 0x28], eax
cmp eax, ebx
je 0x10008774
movzx ecx, word [esp + 0x18]
push ecx
movzx ecx, word [esp + 0x20]
push ecx
movzx ecx, word [esp + 0x28]
push ecx
movzx ecx, word [esp + 0x30]
push ecx
push eax
mov eax, edi
push eax
mov eax, dword [0x10039720]
add eax, 0x1020
push eax
push dword [esp + 0x30]
push esi
push dword [esp + 0x34]
call fcn.1000ce46
lea eax, [esp + 0x3c]
push eax
call fcn.1000ba86
add esp, 0x2c
push 1
push 0xbb8
push ebx
push dword [esp + 0x1c]
call fcn.1000baa0
lea eax, [esp + 0x38]
push 0xfffffffffffffffe
push eax
call fcn.1000ab81
add esp, 0x18
lea eax, [esp + 0x10]
push 0xfffffffffffffffe
push eax
call fcn.1000ab81
pop ecx
pop ecx
jmp 0x10008896
push 0xb91
call fcn.10012cce
pop ecx
push ebx
push eax
mov dword [esp + 0x2c], eax
mov eax, dword [0x10039720]
add eax, 0x228
push eax
call fcn.1000b60a
mov esi, eax
add esp, 0xc
mov dword [esp + 0x28], esi
cmp esi, ebx
je 0x100087d5
push esi
call fcn.1000b081
pop ecx
test eax, eax
je 0x100087c7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x28]
push 0xfffffffffffffffe
push eax
call fcn.1000ab81
pop ecx
pop ecx
lea eax, [esp + 0x24]
push eax
call fcn.1000ba86
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str._3ly6W7GX1fhZBjN4_ya0awMIBF7Gf6Lgcgr8_vmiYEmwAlhKeL_oHA6Xs3DigE_NDTHT_pemQJdZ6Au_kV96o_yxGeltwROEp9CPI_s66bCyhIEIbhcH2tRrvIR_D_SiaWm1J_z_QPinNP_yRgm4GcCLDViq_47uNChZcZbbHL8_4M_EBZzFabUxG1TRk0FBI_Tg_D5Zyq6oG_Yq0lI_6j8044H8mqnXc3YQvA7gvjAS4urQ8tr0kRSGIyb5nXdo4yP79d_Dt_9MWs_LzmvNc4DoQANkWXHAyl_7_MS6BCPhW_Ul9v7Jh9A53mFj4VFhPJ9p2M30hiaTvm_VOwWbY60t9iGZi9p.ohhzZaNhIrx18h.I73b2_n52q2m1NX_p.foOu4KHRqOKOe6IvK11tEqhg__QyM0PiWhU.wA9uvtAjVFyIgd2Y9wyySqMm1zcM8Rje_SVX0_PhHeS88_Nyui_37QV1_GrwsDb5XzeCZae4Rz1tu44Eb_l1tpQdtaPeJfSic2DGdAJZtbqHNqtnmm4wzuq_FfOU_vKh__EPB_EUHKieUmc_6eHBda5_HAZuBX.jFgtP_AoMamcLYVJK_Fzo4BDxJdXmiYpdRYaGY7EqQjE_tOO7Tsi_I9ln_JxNH_XBz4fJAZ6Qxya9_QxZhrsvUVSCUV0OYnILFiI4iGg_5Z7QmBLKkgZaWWRamgDn0_ftT5A8LUrKJ_iMmulAFbmLwgtYocIzcwR_B2mQm_jBD6hLIbr__hAVuac4ag_gifz84xe_owGUW864oqaNynn38nQOSnY_w5pFlmbCMFE2z_e70C6YtalC_rRj80Ooc2rZV6jJUZnZgRsZ_PLOI9PE1_SjNQtcFXfl6c.7z8nwHIgNzGXWx_rL2DYca0d4_OC7OqIoNCWQyEiWwBDH67uCf_YJdLCthGx33u30pYHu6rSdEmQn.7AcCLtvia2oYRf__4fT7oV.8f1ABU4iFUgTeWJVcIjBZvDJ7Oye7ZrWpViz2Wzx_Xj1uoOLclvbqvELSB_j_VlK9SW3_MnkThjRp7ZOF1ArV5VA_6S9.nckhEEKTT71jf4XELqsZ46Uu_zhImzN0rS6_KO6Hx_4vbjl1oFfm0jXzoQqBKPlg.3z0Mr.05MYYVJ_GwfljHSq_JarqnvuUBkd3ZV3aznYRrAjsIumxLpu6JnY_LThLSNB14KAxMTd_3n0o_Pmt.iQ_yGMn
call fcn.1000acd6
pop ecx
push 0xf
pop esi
cmp eax, esi
ja 0x100087fa
mov esi, eax
mov byte [esp + 0x3b], bl
mov dword [esp + 0x10], ebx
cmp esi, ebx
jbe 0x10008831
mov eax, dword [esp + 0x10]
lea ecx, [eax + 0x42]
push 0x20
mov byte [esp + eax + 0x30], cl
lea eax, [esp + 0x54]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jb 0x10008806
mov eax, dword [0x10039720]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, 0x20a
push edi
push dword [0x1003978c]
add eax, 0x438
push eax
call esi
mov eax, dword [0x10039720]
push edi
push dword [0x10039794]
add eax, 0x228
push eax
call esi
mov esi, dword [0x10039720]
lea eax, [esi + 0x228]
call fcn.1000b494
push 0xfffffffffffffffe
push 0x1003978c
mov dword [esi + 0x434], eax
call fcn.1000ab81
push 0xfffffffffffffffe
push 0x10039794
call fcn.1000ab81
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret