Function at 0x64607ac6
Capabilities:
Delete file
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x3d4], eax
lea edi, [ebp - 0x3f4]
xor eax, eax
mov dword [ebp - 0x3b8], esi
mov dword [ebp - 0x3c8], eax
mov ebx, eax
mov dword [ebp - 0x3cc], eax
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3e8], 0x14
mov dword [ebp - 0x3e4], edi
mov dword [ebp - 0x3e0], edi
mov dword [ebp - 0x3dc], edi
mov dword [ebp - 0x3d8], edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607b88
test dword [eax + 0x1c], 0x200
je 0x64607b88
cmp byte [eax + 0x19], 4
jb 0x64607b88
push dword [eax + 0x14]
mov edx, 0x64601f68
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.64604453
mov ecx, dword [ebp - 0x3bc]
push edi
push edi
push dword [ecx]
push edi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
mov dword [ebp - 0x3d0], edi
test edi, edi
jne 0x64607bee
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607be4
test dword [eax + 0x1c], 0x200
je 0x64607be4
cmp byte [eax + 0x19], 2
jb 0x64607be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x646016a0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
mov edx, 0x64601f68
pop ecx
call fcn.64604495
mov ebx, 0x2cfb
jmp 0x646081cf
push 0x40
lea eax, [ebp - 0x14c]
push eax
push 0x2d17
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x3e4], eax
call fcn.6460611d
test eax, eax
je 0x64607be4
lea eax, [ebp - 0x354]
mov dword [ebp - 0x3dc], 0x646016b4
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x3e8]
push eax
push edi
call dword [sym.imp.GDI32.dll_StartDocW]
test eax, eax
jg 0x64607c88
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607be4
test dword [eax + 0x1c], 0x200
je 0x64607be4
cmp byte [eax + 0x19], 2
jb 0x64607be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x646016bc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
jmp 0x64607bd9
test esi, esi
je 0x64607cba
mov esi, dword [esi]
xor eax, eax
push eax
push eax
push eax
mov ecx, dword [esi + 0x14]
push eax
push dword [ebp - 0x3b8]
call dword [0x64618384]
call dword [esi + 0x14]
test eax, eax
jns 0x64607cb4
mov ebx, 0x2cf2
jmp 0x646081cf
mov esi, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [eax + 8], ecx
jne 0x64607e23
mov edx, dword [ebp - 0x3c4]
test edx, edx
je 0x64607e23
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3b8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607ce4
sub ecx, dword [ebp - 0x3b8]
sar ecx, 1
je 0x64607e1b
mov ecx, edx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607d06
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x80]
mov ecx, eax
mov dword [ebp - 0x3b8], eax
call fcn.6460cd43
mov dword [ebp - 0x3c0], eax
test eax, eax
jne 0x64607d41
mov ebx, 0x2cfd
jmp 0x646081cf
push 0x40
lea eax, [ebp - 0xcc]
push eax
push 0x2cff
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x64607db5
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607d9e
test dword [eax + 0x1c], 0x200
je 0x64607d9e
cmp byte [eax + 0x19], 2
jb 0x64607d9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f68
push 0x646016d0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.64604495
push 0x646016e8
lea eax, [ebp - 0xcc]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x3c4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x3b8]
push dword [ebp - 0x3c0]
call fcn.64605b76
mov ecx, eax
add esp, 0x10
test ecx, ecx
jns 0x64607e1b
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607e11
test dword [eax + 0x1c], 0x200
je 0x64607e11
cmp byte [eax + 0x19], 2
jb 0x64607e11
push ecx
push 0x646016f0
push dword [eax + 0x14]
mov edx, 0x64601f68
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.64604495
mov ebx, 0x2cfe
jmp 0x646081cf
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
je 0x64608144
test esi, esi
je 0x64607e47
lea eax, [ebp - 0x3cc]
push eax
push ecx
push esi
call dword [sym.imp.MAPI32.dll_Ordinal_185]
test eax, eax
js 0x64607caa
xor eax, eax
push eax
push dword [0x64617404]
push eax
push eax
push eax
push eax
push eax
push eax
push 4
push 0x646012ec
push 0x64601710
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp - 0x3b8], esi
test esi, esi
jne 0x64607eba
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607be4
test dword [eax + 0x1c], 0x200
je 0x64607be4
cmp byte [eax + 0x19], 2
jb 0x64607be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x64601728
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
jmp 0x64607bd9
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x64607fc5
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607ecd
sub ecx, edx
sar ecx, 1
je 0x64607fc5
push dword [ebp - 0x3c0]
xor eax, eax
push eax
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x3b4]
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0x3bc]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3b4], 0x5c
mov dword [ebp - 0x3b0], 0xa800000f
cmp dword [edx + 0x28], 0x2bc
movzx eax, byte [edx + 0x2e]
setge cl
neg eax
push 0x1f
sbb eax, eax
and eax, 8
or ecx, eax
movzx eax, byte [edx + 0x2d]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
movzx eax, byte [edx + 0x2c]
neg eax
sbb eax, eax
and eax, 2
or ecx, eax
mov eax, dword [edx + 0x18]
cdq
xor eax, edx
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp - 0x3bc]
sub eax, edx
imul eax, eax, 0x14
mov dword [ebp - 0x3a8], eax
mov al, byte [ecx + 0x2f]
mov byte [ebp - 0x39c], al
mov al, byte [ecx + 0x33]
mov byte [ebp - 0x39b], al
lea eax, [ecx + 0x34]
push eax
lea eax, [ebp - 0x39a]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
lea eax, [ebp - 0x3b4]
push eax
push 4
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3cc]
test eax, eax
je 0x64607ff7
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x3f4]
push eax
push 0xc002
push 0x449
push esi
mov dword [ebp - 0x3ec], 0x64606b20
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x40
push eax
lea eax, [ebp - 0x4c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x1f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x646080bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6460805f
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64608055
test dword [eax + 0x1c], 0x200
je 0x64608055
cmp byte [eax + 0x19], 5
jb 0x64608055
push dword [eax + 0x14]
mov edx, 0x64601f68
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.64604453
mov ebx, 0x2d03
jmp 0x646081cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x64608134
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646081cf
test dword [ecx + 0x1c], 0x200
je 0x646081cf
cmp byte [ecx + 0x19], 2
jb 0x646081cf
push ebx
push 0x64601748
push dword [ecx + 0x14]
mov edx, 0x64601f68
push dword [ecx + 0x10]
push 0x30
pop ecx
call fcn.64604495
jmp 0x646081cf
lea esi, [ebp - 0x4c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x646080c5
sub esi, ecx
sar esi, 1
cmp esi, 0x1e
jae 0x6460812e
mov dword [ebp - 0x3c4], edx
lea edi, [ebp - 0x4c]
test esi, esi
je 0x64608118
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x64608104
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswcntrl]
pop ecx
test eax, eax
je 0x64608128
mov eax, dword [ebp - 0x3c4]
add edi, 2
inc eax
mov dword [ebp - 0x3c4], eax
cmp eax, esi
jb 0x646080e6
mov edi, dword [ebp - 0x3d0]
mov ebx, 0x2d03
jmp 0x646081cf
mov edi, dword [ebp - 0x3d0]
mov esi, dword [ebp - 0x3b8]
push edi
push esi
call fcn.64622c54
test eax, eax
jne 0x64608158
jmp 0x64607be4
push eax
push dword [ebp - 0x3c0]
push esi
push edi
call fcn.64606496
mov ebx, eax
test ebx, ebx
jne 0x646081cf
push edi
push ecx
mov ecx, dword [ebp - 0x3bc]
mov ecx, dword [ecx]
call fcn.6460d4ec
test eax, eax
jle 0x646081cf
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x646081cf
xor ebx, ebx
mov edi, ebx
cmp word [ebp - 0x354], bx
je 0x646081cf
lea ecx, [ebp - 0x354]
call fcn.6460e5b9
mov ecx, eax
mov eax, dword [ebp - 0x3d4]
mov dword [eax], ecx
test ecx, ecx
je 0x64607d37
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646081cf
test dword [eax + 0x1c], 0x200
je 0x646081cf
cmp byte [eax + 0x19], 5
jb 0x646081cf
push ecx
push dword [eax + 0x14]
mov edx, 0x64601f68
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.64605ef1
mov ecx, dword [ebp - 0x3cc]
test ecx, ecx
je 0x646081e9
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x64618384]
call esi
test edi, edi
je 0x646081f4
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x3c0]
call fcn.6460cda9
test ebx, ebx
je 0x6460826f
lea ecx, [ebp - 0x354]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x6460820e
sub ecx, edx
sar ecx, 1
je 0x6460826f
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x6460826f
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6460826f
test dword [eax + 0x1c], 0x200
je 0x6460826f
cmp byte [eax + 0x19], 2
jb 0x6460826f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f68
push 0x64601668
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.64604495
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615dc0
leave
ret 0x14