Function at 0x13a5c176
Capabilities:
Delete file
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x3cc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x3d0], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x3c0]
mov dword [ebp - 0x3c4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x3f0], ebx
lea edi, [ebp - 0x3ec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp - 0x2cc], ax
lea eax, [ebp - 0x2ca]
push ebx
push eax
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x3c8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3e4], 0x14
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3d8], ebx
mov dword [ebp - 0x3d4], ebx
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c250
test dword [eax + 0x1c], 0x200
je 0x13a5c250
cmp byte [eax + 0x19], 4
jb 0x13a5c250
push 0x13a01620
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
push ebx
push ebx
push dword [esi]
push ebx
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3b4], eax
cmp eax, ebx
jne 0x13a5c2a6
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c7e5
test dword [eax + 0x1c], 0x200
je 0x13a5c7e5
cmp byte [eax + 0x19], 2
jb 0x13a5c7e5
call edi
push eax
push 0x13a018a8
push 0x13a01620
push 0x2a
jmp 0x13a5c545
push 0x40
lea eax, [ebp - 0x34c]
push eax
push 0x2d17
push dword [0x13a6e178]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x3e0], eax
push 0x104
lea eax, [ebp - 0x2cc]
push eax
call fcn.13a5ae36
test eax, eax
je 0x13a5c7e5
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x3e4]
push eax
push dword [ebp - 0x3b4]
mov dword [ebp - 0x3d8], 0x13a018a0
call dword [sym.imp.GDI32.dll_StartDocW]
test eax, eax
jg 0x13a5c34d
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c7e5
test dword [eax + 0x1c], 0x200
je 0x13a5c7e5
cmp byte [eax + 0x19], 2
jb 0x13a5c7e5
call edi
push eax
push 0x13a0188c
push 0x13a01620
push 0x2b
jmp 0x13a5c545
mov edi, dword [ebp - 0x3bc]
cmp edi, ebx
je 0x13a5c373
mov eax, dword [edi]
push ebx
push ebx
push dword [ebp - 0x3c0]
push dword [ebp - 0x3c4]
push edi
call dword [eax + 0x14]
test eax, eax
jl 0x13a5c4d2
cmp dword [esi + 8], ebx
jne 0x13a5c4b3
cmp dword [ebp - 0x3b0], ebx
je 0x13a5c4b3
mov eax, dword [ebp - 0x3b0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x13a5c391
sub eax, edx
sar eax, 1
je 0x13a5c4b3
mov eax, dword [ebp - 0x3b0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x13a5c3ae
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x80]
push edi
call fcn.13a6391c
mov dword [ebp - 0x3b8], eax
cmp eax, ebx
je 0x13a5c866
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 0x2cff
push dword [0x13a6e178]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x13a5c449
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c433
test dword [eax + 0x1c], 0x200
je 0x13a5c433
cmp byte [eax + 0x19], 2
jb 0x13a5c433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x13a6e004]
push 0x13a01874
push 0x13a01620
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58ce7
push 0x13a0186c
lea eax, [ebp - 0xc4]
push 0x40
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push dword [ebp - 0x3b0]
lea eax, [ebp - 0xc4]
push eax
push edi
push dword [ebp - 0x3b8]
call fcn.13a5add5
add esp, 0x10
cmp eax, ebx
jge 0x13a5c4ad
mov ecx, dword [0x13a6e004]
cmp ecx, 0x13a6e004
je 0x13a5c49e
test dword [ecx + 0x1c], 0x200
je 0x13a5c49e
cmp byte [ecx + 0x19], 2
jb 0x13a5c49e
push eax
push 0x13a0184c
push 0x13a01620
push 0x2d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.13a58ce7
mov dword [ebp - 0x3ac], 0x2cfe
jmp 0x13a5c8a8
mov edi, dword [ebp - 0x3bc]
cmp dword [ebp + 0xc], ebx
je 0x13a5c7f4
cmp edi, ebx
je 0x13a5c4e1
lea eax, [ebp - 0x3c8]
push eax
push ebx
push edi
call sub.MAPI32.dll_Ordinal_185
test eax, eax
jge 0x13a5c4e1
mov dword [ebp - 0x3ac], 0x2cf2
jmp 0x13a5c8a8
push ebx
push dword [0x13a6e174]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push 0x13a01848
push 0x13a01830
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x3b0], eax
cmp eax, ebx
jne 0x13a5c55a
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c7e5
test dword [eax + 0x1c], 0x200
je 0x13a5c7e5
cmp byte [eax + 0x19], 2
jb 0x13a5c7e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13a01810
push 0x13a01620
push 0x2e
mov eax, dword [0x13a6e004]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58ce7
jmp 0x13a5c7e5
mov eax, dword [ebp - 0x3b8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x13a5c653
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x13a5c571
sub eax, edx
sar eax, 1
je 0x13a5c653
push dword [ebp - 0x3b8]
push ebx
push 0xc
push dword [ebp - 0x3b0]
call edi
push 0x58
lea eax, [ebp - 0x3a4]
push ebx
push eax
call sub.msvcrt.dll_memset
movzx ecx, byte [esi + 0x2e]
xor eax, eax
cmp dword [esi + 0x28], 0x2bc
push 0x1f
setge al
neg ecx
sbb ecx, ecx
and ecx, 8
mov dword [ebp - 0x3a8], 0x5c
mov dword [ebp - 0x3a4], 0xa800000f
or eax, ecx
movzx ecx, byte [esi + 0x2d]
neg ecx
sbb ecx, ecx
and ecx, 4
or eax, ecx
movzx ecx, byte [esi + 0x2c]
neg ecx
sbb ecx, ecx
and ecx, 2
or eax, ecx
mov dword [ebp - 0x3a0], eax
mov eax, dword [esi + 0x18]
cdq
xor eax, edx
sub eax, edx
imul eax, eax, 0x14
mov dword [ebp - 0x39c], eax
mov al, byte [esi + 0x2f]
mov byte [ebp - 0x390], al
mov al, byte [esi + 0x33]
mov byte [ebp - 0x38f], al
lea eax, [esi + 0x34]
push eax
lea eax, [ebp - 0x38e]
push 0x20
push eax
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x1c
lea eax, [ebp - 0x3a8]
push eax
push 4
push 0x444
push dword [ebp - 0x3b0]
call edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
push dword [ebp - 0x3b0]
call edi
mov eax, dword [ebp - 0x3c8]
cmp eax, ebx
je 0x13a5c686
mov dword [ebp - 0x3f0], eax
lea eax, [ebp - 0x3f0]
push eax
push 0xc002
push 0x449
push dword [ebp - 0x3b0]
mov dword [ebp - 0x3e8], 0x13a5a9a5
call edi
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1f
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x13a5c75b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x13a5c6ff
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c7bb
test dword [eax + 0x1c], 0x200
je 0x13a5c7bb
cmp byte [eax + 0x19], 5
jb 0x13a5c7bb
push 0x13a01620
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
jmp 0x13a5c7bb
call edi
cmp eax, 0x7a
je 0x13a5c7ca
call edi
mov dword [ebp - 0x3ac], eax
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c8a8
test dword [eax + 0x1c], 0x200
je 0x13a5c8a8
cmp byte [eax + 0x19], 2
jb 0x13a5c8a8
push dword [ebp - 0x3ac]
push 0x13a017f4
push 0x13a01620
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58ce7
jmp 0x13a5c8a8
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x13a5c761
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3c0], eax
cmp eax, 0x1e
jae 0x13a5c7ca
lea edi, [ebp - 0x44]
mov dword [ebp - 0x3bc], ebx
cmp eax, ebx
jbe 0x13a5c7bb
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x13a5c7a5
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswcntrl]
pop ecx
test eax, eax
je 0x13a5c7ca
inc edi
inc edi
inc dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x3c0]
jb 0x13a5c787
mov dword [ebp - 0x3ac], 0x2d03
jmp 0x13a5c8a8
push dword [ebp - 0x3b4]
mov ecx, dword [ebp - 0x3cc]
push dword [ebp - 0x3b0]
call fcn.13a5a793
test eax, eax
jne 0x13a5c81b
mov dword [ebp - 0x3ac], 0x2cfb
jmp 0x13a5c8a8
mov ecx, dword [ebp - 0x3cc]
push esi
push dword [ebp - 0x3b8]
push edi
push dword [ebp - 0x3b4]
call fcn.13a5af8c
mov dword [ebp - 0x3ac], eax
cmp eax, ebx
jne 0x13a5c8a8
push dword [ebp - 0x3b4]
push 0xffffffffffffffff
push ebx
push dword [esi]
call fcn.13a641a1
test eax, eax
jle 0x13a5c8a8
push dword [ebp - 0x3b4]
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x13a5c8a8
mov dword [ebp - 0x3b4], ebx
cmp word [ebp - 0x2cc], bx
je 0x13a5c8a2
lea eax, [ebp - 0x2cc]
push eax
call fcn.13a6240e
mov ecx, dword [ebp - 0x3d0]
mov dword [ecx], eax
cmp eax, ebx
jne 0x13a5c872
mov dword [ebp - 0x3ac], 0x2cfd
jmp 0x13a5c8a8
mov ecx, dword [0x13a6e004]
cmp ecx, 0x13a6e004
je 0x13a5c8a2
test dword [ecx + 0x1c], 0x200
je 0x13a5c8a2
cmp byte [ecx + 0x19], 5
jb 0x13a5c8a2
push eax
push 0x13a01620
push 0x31
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.13a5a555
mov dword [ebp - 0x3ac], ebx
mov eax, dword [ebp - 0x3c8]
cmp eax, ebx
je 0x13a5c8b8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x3b4], ebx
je 0x13a5c8cc
push dword [ebp - 0x3b4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x3b8]
call fcn.13a639b4
cmp dword [ebp - 0x3ac], ebx
je 0x13a5c947
lea eax, [ebp - 0x2cc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x13a5c8e8
sub eax, edx
sar eax, 1
je 0x13a5c947
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x13a5c947
mov eax, dword [0x13a6e004]
cmp eax, 0x13a6e004
je 0x13a5c947
test dword [eax + 0x1c], 0x200
je 0x13a5c947
cmp byte [eax + 0x19], 2
jb 0x13a5c947
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x13a6e004]
push 0x13a0178c
push 0x13a01620
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58ce7
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 0x14