Function at 0x646086e1
Capabilities:
Delete file
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x646180b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x3d4], eax
lea edi, [ebp - 0x3f4]
xor eax, eax
mov dword [ebp - 0x3b8], esi
mov dword [ebp - 0x3c8], eax
mov ebx, eax
mov dword [ebp - 0x3cc], eax
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3e8], 0x14
mov dword [ebp - 0x3e4], edi
mov dword [ebp - 0x3e0], edi
mov dword [ebp - 0x3dc], edi
mov dword [ebp - 0x3d8], edi
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646087a3
test dword [eax + 0x1c], 0x200
je 0x646087a3
cmp byte [eax + 0x19], 4
jb 0x646087a3
push dword [eax + 0x14]
mov edx, 0x64602d30
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.6460534c
mov ecx, dword [ebp - 0x3bc]
push edi
push edi
push dword [ecx]
push edi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
mov dword [ebp - 0x3d0], edi
test edi, edi
jne 0x64608809
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646087ff
test dword [eax + 0x1c], 0x200
je 0x646087ff
cmp byte [eax + 0x19], 2
jb 0x646087ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6461800c]
push 0x64602478
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
mov edx, 0x64602d30
pop ecx
call fcn.6460539a
mov ebx, 0x2cfb
jmp 0x64608deb
push 0x40
lea eax, [ebp - 0x14c]
push eax
push 0x2d17
push dword [0x64618430]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x3e4], eax
call fcn.64606cf5
test eax, eax
je 0x646087ff
lea eax, [ebp - 0x354]
mov dword [ebp - 0x3dc], 0x6460248c
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x3e8]
push eax
push edi
call dword [sym.imp.GDI32.dll_StartDocW]
test eax, eax
jg 0x646088a3
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646087ff
test dword [eax + 0x1c], 0x200
je 0x646087ff
cmp byte [eax + 0x19], 2
jb 0x646087ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6461800c]
push 0x64602494
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
jmp 0x646087f4
test esi, esi
je 0x646088d6
mov eax, dword [esi]
mov esi, dword [eax + 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x3b8]
mov ecx, esi
call dword [0x6461939c]
call esi
test eax, eax
jns 0x646088d0
mov ebx, 0x2cf2
jmp 0x64608deb
mov esi, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [eax + 8], ecx
jne 0x64608a3f
mov edx, dword [ebp - 0x3c4]
test edx, edx
je 0x64608a3f
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3b8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64608900
sub ecx, dword [ebp - 0x3b8]
sar ecx, 1
je 0x64608a37
mov ecx, edx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64608922
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x80]
mov ecx, eax
mov dword [ebp - 0x3b8], eax
call fcn.6460d35d
mov dword [ebp - 0x3c0], eax
test eax, eax
jne 0x6460895d
mov ebx, 0x2cfd
jmp 0x64608deb
push 0x40
lea eax, [ebp - 0xcc]
push eax
push 0x2cff
push dword [0x64618430]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x646089d1
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646089ba
test dword [eax + 0x1c], 0x200
je 0x646089ba
cmp byte [eax + 0x19], 2
jb 0x646089ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6461800c]
mov edx, 0x64602d30
push 0x646024a8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.6460539a
push 0x646024c0
lea eax, [ebp - 0xcc]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x3c4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x3b8]
push dword [ebp - 0x3c0]
call fcn.64606a66
mov ecx, eax
add esp, 0x10
test ecx, ecx
jns 0x64608a37
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64608a2d
test dword [eax + 0x1c], 0x200
je 0x64608a2d
cmp byte [eax + 0x19], 2
jb 0x64608a2d
push ecx
push 0x646024c8
push dword [eax + 0x14]
mov edx, 0x64602d30
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.6460539a
mov ebx, 0x2cfe
jmp 0x64608deb
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
je 0x64608d60
test esi, esi
je 0x64608a63
lea eax, [ebp - 0x3cc]
push eax
push ecx
push esi
call dword [sym.imp.MAPI32.dll_Ordinal_185]
test eax, eax
js 0x646088c6
xor eax, eax
push eax
push dword [0x64618434]
push eax
push eax
push eax
push eax
push eax
push eax
push 4
push 0x646020d4
push 0x646024e8
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp - 0x3b8], esi
test esi, esi
jne 0x64608ad6
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x646087ff
test dword [eax + 0x1c], 0x200
je 0x646087ff
cmp byte [eax + 0x19], 2
jb 0x646087ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6461800c]
push 0x64602500
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
jmp 0x646087f4
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x64608be1
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64608ae9
sub ecx, edx
sar ecx, 1
je 0x64608be1
push dword [ebp - 0x3c0]
xor eax, eax
push eax
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x3b4]
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0x3bc]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3b4], 0x5c
mov dword [ebp - 0x3b0], 0xa800000f
cmp dword [edx + 0x28], 0x2bc
movzx eax, byte [edx + 0x2e]
setge cl
neg eax
push 0x1f
sbb eax, eax
and eax, 8
or ecx, eax
movzx eax, byte [edx + 0x2d]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
movzx eax, byte [edx + 0x2c]
neg eax
sbb eax, eax
and eax, 2
or ecx, eax
mov eax, dword [edx + 0x18]
cdq
xor eax, edx
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp - 0x3bc]
sub eax, edx
imul eax, eax, 0x14
mov dword [ebp - 0x3a8], eax
mov al, byte [ecx + 0x2f]
mov byte [ebp - 0x39c], al
mov al, byte [ecx + 0x33]
mov byte [ebp - 0x39b], al
lea eax, [ecx + 0x34]
push eax
lea eax, [ebp - 0x39a]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
lea eax, [ebp - 0x3b4]
push eax
push 4
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3cc]
test eax, eax
je 0x64608c13
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x3f4]
push eax
push 0xc002
push 0x449
push esi
mov dword [ebp - 0x3ec], 0x64607720
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x40
push eax
lea eax, [ebp - 0x4c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x1f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x64608cd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x64608c7b
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64608c71
test dword [eax + 0x1c], 0x200
je 0x64608c71
cmp byte [eax + 0x19], 5
jb 0x64608c71
push dword [eax + 0x14]
mov edx, 0x64602d30
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.6460534c
mov ebx, 0x2d03
jmp 0x64608deb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x64608d50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x6461800c]
cmp ecx, 0x6461800c
je 0x64608deb
test dword [ecx + 0x1c], 0x200
je 0x64608deb
cmp byte [ecx + 0x19], 2
jb 0x64608deb
push ebx
push 0x64602520
push dword [ecx + 0x14]
mov edx, 0x64602d30
push dword [ecx + 0x10]
push 0x30
pop ecx
call fcn.6460539a
jmp 0x64608deb
lea esi, [ebp - 0x4c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x64608ce1
sub esi, ecx
sar esi, 1
cmp esi, 0x1e
jae 0x64608d4a
mov dword [ebp - 0x3c4], edx
lea edi, [ebp - 0x4c]
test esi, esi
je 0x64608d34
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x64608d20
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswcntrl]
pop ecx
test eax, eax
je 0x64608d44
mov eax, dword [ebp - 0x3c4]
add edi, 2
inc eax
mov dword [ebp - 0x3c4], eax
cmp eax, esi
jb 0x64608d02
mov edi, dword [ebp - 0x3d0]
mov ebx, 0x2d03
jmp 0x64608deb
mov edi, dword [ebp - 0x3d0]
mov esi, dword [ebp - 0x3b8]
push edi
push esi
call fcn.64606e28
test eax, eax
jne 0x64608d74
jmp 0x646087ff
push eax
push dword [ebp - 0x3c0]
push esi
push edi
call fcn.6460707b
mov ebx, eax
test ebx, ebx
jne 0x64608deb
push edi
push ecx
mov ecx, dword [ebp - 0x3bc]
mov ecx, dword [ecx]
call fcn.6460db4a
test eax, eax
jle 0x64608deb
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x64608deb
xor ebx, ebx
mov edi, ebx
cmp word [ebp - 0x354], bx
je 0x64608deb
lea ecx, [ebp - 0x354]
call fcn.6460ec38
mov ecx, eax
mov eax, dword [ebp - 0x3d4]
mov dword [eax], ecx
test ecx, ecx
je 0x64608953
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64608deb
test dword [eax + 0x1c], 0x200
je 0x64608deb
cmp byte [eax + 0x19], 5
jb 0x64608deb
push ecx
push dword [eax + 0x14]
mov edx, 0x64602d30
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.64606ab8
mov ecx, dword [ebp - 0x3cc]
test ecx, ecx
je 0x64608e05
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x6461939c]
call esi
test edi, edi
je 0x64608e10
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x3c0]
call fcn.6460d3c9
test ebx, ebx
je 0x64608e8b
lea ecx, [ebp - 0x354]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x64608e2a
sub ecx, edx
sar ecx, 1
je 0x64608e8b
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x64608e8b
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64608e8b
test dword [eax + 0x1c], 0x200
je 0x64608e8b
cmp byte [eax + 0x19], 2
jb 0x64608e8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6461800c]
mov edx, 0x64602d30
push 0x64602440
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.6460539a
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64616f60
leave
ret 0x14