Function at 0x110d83f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e2e54
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1a4], ebx
mov dword [ebx], vtable.NSMConnection.0
mov esi, dword [ebx + 0x28]
mov eax, dword [esi + 0x27c]
mov dword [ebp - 4], 1
test eax, eax
je 0x110d8465
cmp eax, 0xffffffff
je 0x110d8465
cmp dword [esi + 0x138], 0
jne 0x110d8465
push 0xf52
push str...ctl32Connect.cpp
push str.idata__tr__NULL__idata__tr___TRANSPORT____1__idata__dead
call fcn.11067750
add esp, 0xc
cmp dword [esi + 0x860], 0
je 0x110d8511
mov eax, dword [esi + 0x85c]
mov edi, dword [eax]
mov dword [ebp - 0x1b8], eax
cmp edi, eax
je 0x110d84f1
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov eax, edx
movzx edx, dx
push edx
mov edx, dword [ecx + 0x18]
shr eax, 0x10
push eax
mov eax, dword [ecx + 0x20]
push edx
push eax
push str.status_d__event_x__cmd_d__type_d_n
call fcn.111bd7b0
add esp, 0x14
cmp byte [edi + 0x15], 0
jne 0x110d84e9
mov eax, dword [edi + 8]
cmp byte [eax + 0x15], 0
jne 0x110d84ce
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x15], 0
jne 0x110d84e9
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x15], 0
je 0x110d84c2
jmp 0x110d84e9
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x110d84e7
cmp edi, dword [eax + 8]
jne 0x110d84e7
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x110d84d7
mov edi, eax
cmp edi, dword [ebp - 0x1b8]
jne 0x110d8484
cmp dword [esi + 0x860], 0
je 0x110d8511
push 0xf68
push str...ctl32Connect.cpp
push str.idata__RMap.empty___
call fcn.11067750
add esp, 0xc
mov edx, dword [esi + 0x778]
test edx, edx
je 0x110d8571
mov ecx, ebx
call fcn.110c2d40
push eax
push edx
lea ecx, [ebp - 0x1a0]
push str.idata__selcount_d___s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
push 0xf6e
lea edx, [ebp - 0x1a0]
push str...ctl32Connect.cpp
push edx
call fcn.11123e10
add esp, 0x20
cmp dword [esi + 0x778], 0
je 0x110d8571
push 0xf70
push str...ctl32Connect.cpp
push str.idata__selcount__0
call fcn.11067750
add esp, 0xc
push 0
push 0
mov ecx, ebx
call fcn.110d6b40
mov eax, dword [esi + 0x76c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x8f8]
push ecx
call edi
lea edx, [esi + 0x8d0]
push edx
call edi
lea eax, [esi + 0x154]
push eax
call edi
lea ecx, [esi + 0x13c]
push ecx
call edi
mov edx, dword [ebx + 0x30]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push esi
push 0
push 0x110d6e60
push 0x30000014
call edx
cmp dword [esi + 0x274], 0
je 0x110d85e5
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x110d85e5
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esi + 0x8b0]
test ecx, ecx
je 0x110d85f7
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esi + 0x934]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x938]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x9e8]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x9ec]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x9f0]
add esp, 0x10
test eax, eax
je 0x110d8715
mov edi, dword [eax]
cmp edi, dword [eax + 4]
je 0x110d86fb
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea esp, [esp]
push edi
lea ecx, [ebp - 0x1b4]
call fcn.1113cc10
mov eax, dword [ebp - 0x1b4]
mov edx, dword [eax]
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 2
call edx
test al, al
jne 0x110d868b
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov eax, dword [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x110d86d4
mov edx, dword [ebp - 0x1b4]
mov eax, dword [edx]
lea ecx, [ebp - 0x1b4]
call eax
test al, al
jne 0x110d86c7
push 0x266
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
mov ecx, dword [ebp - 0x1a8]
push 4
push 0
push ecx
call ebx
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 1
call fcn.1113cd80
mov eax, dword [esi + 0x9f0]
add edi, 0x10
cmp edi, dword [eax + 4]
jne 0x110d8650
mov ebx, dword [ebp - 0x1a4]
mov edi, dword [esi + 0x9f0]
test edi, edi
je 0x110d8715
mov ecx, edi
call fcn.1105d8f0
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esi + 0x688]
mov edi, dword [sym.imp.MSVCR100.dll_free]
push edx
call edi
mov eax, dword [esi + 0x690]
push eax
call edi
mov ecx, dword [esi + 0xa5c]
push ecx
call edi
mov edx, dword [esi + 0xa60]
push edx
call edi
mov ecx, dword [esi + 0xa00]
add esp, 0x10
test ecx, ecx
je 0x110d875e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0xa00], 0
lea eax, [esi + 0xa08]
push eax
call fcn.110cda40
mov ecx, dword [esi + 0xa38]
push ecx
call edi
mov edx, dword [esi]
push esi
call edx
add esp, 0xc
cmp dword [ebx + 0x20], 8
jb 0x110d878d
mov eax, dword [ebx + 0xc]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebx + 0x20], 7
mov dword [ebx + 0x1c], 0
mov ecx, ebx
mov word [ebx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
call fcn.111707d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret