Function at 0x2e04786f
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push 0x8b8
mov eax, 0x2e10238b
call fcn.2e01c44f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x878], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x860], ebx
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x870], ebx
push esi
mov byte [ebp - 4], 5
mov dword [ebp - 0x894], ebx
mov dword [ebp - 0x898], ebx
call fcn.2e0465fd
test eax, eax
jne 0x2e04792a
mov eax, dword [ebp - 0x870]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x2e0478d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x86c]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x2e0478ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x858]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x2e047900
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x860]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x2e047914
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x864]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x2e0480b5
jmp 0x2e0480af
push esi
call fcn.2e03f7c2
push eax
lea eax, [ebp - 0x878]
push eax
call fcn.2e02bc08
test eax, eax
jne 0x2e0479b3
mov eax, dword [ebp - 0x870]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x2e047955
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x86c]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x2e047969
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x858]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x2e04797d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x860]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x2e047991
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x864]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x2e0479a4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
jmp 0x2e04791d
push dword [ebp + 0xc]
lea eax, [ebp - 0x250]
push 0x20
push eax
call fcn.2e046469
mov esi, dword [ebp - 0x878]
lea eax, [ebp - 0x894]
push eax
push esi
call fcn.2e085aaf
mov eax, dword [esi]
lea ecx, [ebp - 0x864]
push ecx
push ebx
push ebx
push dword [ebp - 0x894]
lea ecx, [ebp - 0x250]
push ebx
push ecx
push esi
call dword [eax + 0x18]
lea eax, [ebp - 0x860]
push eax
push ebx
push 0x2e006304
push dword [ebp - 0x864]
call fcn.2e045ecd
test eax, eax
jl 0x2e048042
mov eax, dword [ebp - 0x860]
mov ecx, dword [eax]
lea edx, [ebp - 0x858]
push edx
push 0x2e006374
push eax
call dword [ecx]
test eax, eax
jl 0x2e048042
mov eax, dword [ebp - 0x860]
mov ecx, dword [eax]
lea edx, [ebp - 0x86c]
push edx
push 0x2e0063a4
push eax
call dword [ecx]
test eax, eax
jl 0x2e048042
mov eax, dword [ebp - 0x860]
mov ecx, dword [eax]
lea edx, [ebp - 0x870]
push edx
push 0x2e006344
push eax
call dword [ecx]
test eax, eax
jl 0x2e048042
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x86c]
mov edx, dword [ecx]
and eax, 0x7fff
lea esi, [ebp - 0x898]
push esi
push eax
push ecx
mov dword [ebp - 0x854], eax
call dword [edx + 0x58]
test eax, eax
jl 0x2e048042
test byte [ebp - 0x898], 8
je 0x2e048042
mov eax, dword [ebp - 0x854]
push 5
pop ecx
lea edx, [ebp - 0x884]
push edx
mov esi, 0x2e10a480
lea edi, [ebp - 0x8ac]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x2e10a4d0]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x858]
mov ecx, dword [eax]
lea edx, [ebp - 0x8ac]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x2e047bb4
mov eax, dword [ebp - 0x854]
push 5
pop ecx
lea edx, [ebp - 0x884]
push edx
mov esi, 0x2e10a494
lea edi, [ebp - 0x8ac]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x2e10a4d4]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x858]
mov ecx, dword [eax]
lea edx, [ebp - 0x8ac]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x2e047bb4
mov eax, dword [ebp - 0x854]
push 5
pop ecx
lea edx, [ebp - 0x884]
push edx
mov esi, 0x2e10a4a8
lea edi, [ebp - 0x8ac]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x2e10a4d8]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x858]
mov ecx, dword [eax]
lea edx, [ebp - 0x8ac]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x2e047bb4
mov eax, dword [ebp - 0x854]
push 5
pop ecx
lea edx, [ebp - 0x884]
push edx
mov esi, 0x2e10a4bc
lea edi, [ebp - 0x8ac]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x2e10a4dc]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x858]
mov ecx, dword [eax]
lea edx, [ebp - 0x8ac]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x2e048042
lea eax, [ebp - 0x850]
push eax
push 0x104
mov dword [ebp - 0x854], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x2e0017c8
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push ebx
mov eax, 0x100
push eax
lea ecx, [ebp - 0x650]
push ecx
push eax
lea eax, [ebp - 0x550]
push eax
push 3
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.2e01a7dc
mov esi, 0x200
cmp byte [ebp - 0x890], bl
je 0x2e047c53
push ebx
push ebx
push ebx
lea eax, [ebp - 0x890]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.2e016a1e
push esi
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.2e01654c
jmp 0x2e047c59
mov byte [ebp - 0x210], bl
push ebx
push ebx
push ebx
lea eax, [ebp - 0x550]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.2e01a61c
push ebx
push ebx
push ebx
lea eax, [ebp - 0x650]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.2e01a61c
push ebx
push ebx
push ebx
push 0x2e0027a0
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.2e01a61c
cmp edi, ebx
je 0x2e047cb1
push ebx
push ebx
push ebx
push edi
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.2e01a61c
mov eax, dword [ebp - 0x884]
dec eax
je 0x2e047d99
sub eax, 0xf
je 0x2e047d18
sub eax, 0x10
je 0x2e047cf0
sub eax, 0x20
jne 0x2e047e7f
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x880]
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x2e047e75
push dword [ebp - 0x880]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x210]
push ecx
push dword [eax + 0xc]
call dword [sym.imp.GDI32.dll_CopyMetaFileA]
push eax
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
jmp 0x2e047e69
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x2e047e7f
lea eax, [ebp - 0x8c4]
push eax
push 0x18
push dword [ebp - 0x880]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x868]
push eax
push 0x18
lea eax, [ebp - 0x8c4]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x868]
push eax
mov eax, dword [ebp - 0x8bc]
imul eax, dword [ebp - 0x8b8]
push eax
push dword [ebp - 0x8b0]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x2e047e75
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x85c], eax
cmp eax, 0xffffffff
je 0x2e047e7f
push dword [ebp - 0x880]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push dword [ebp - 0x880]
mov esi, eax
mov dword [ebp - 0x874], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov eax, 0x4d42
mov word [ebp - 0x8bc], ax
xor eax, eax
add esi, 0xe
mov word [ebp - 0x8b4], ax
mov word [ebp - 0x8b6], ax
mov dword [ebp - 0x8ba], esi
mov eax, dword [edi + 0x20]
mov ecx, dword [edi]
lea eax, [ecx + eax*4 + 0xe]
mov dword [ebp - 0x8b2], eax
cmp dword [edi + 0x10], 3
jne 0x2e047e27
add dword [ebp - 0x8b2], 0xc
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x868]
push eax
push 0xe
lea eax, [ebp - 0x8bc]
push eax
push dword [ebp - 0x85c]
call esi
push ebx
lea eax, [ebp - 0x868]
push eax
push dword [ebp - 0x874]
push edi
push dword [ebp - 0x85c]
call esi
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x880]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x854], 1
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
cmp dword [ebp - 0x854], ebx
je 0x2e048042
mov dword [ebp - 0x88c], ebx
mov dword [ebp - 0x888], ebx
mov dword [ebp - 0x85c], ebx
lea eax, [ebp - 0x888]
push eax
push ebx
push 0x4001012
push ebx
call dword [sym.imp.ole32.dll_StgCreateDocfile]
cmp eax, ebx
jl 0x2e047ff9
mov dword [ebp - 0x854], ebx
xor eax, eax
push 0x1fe
mov word [ebp - 0x450], ax
lea eax, [ebp - 0x44e]
push ebx
push eax
mov byte [ebp - 4], 9
call fcn.2e01b598
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x874], ebx
call fcn.2e07e06b
lea ecx, [eax + eax]
push ebx
push 0x100
mov dword [ebp - 0x868], ecx
lea ecx, [ebp - 0x450]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.2e07de85
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax]
lea edx, [ebp - 0x854]
push edx
push ebx
push ebx
push 0x1012
push 0x2e004310
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, ebx
jl 0x2e047fa3
mov eax, dword [ebp - 0x854]
mov ecx, dword [eax]
lea edx, [ebp - 0x874]
push edx
push 4
lea edx, [ebp - 0x868]
push edx
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x2e047fa3
mov eax, dword [ebp - 0x854]
mov ecx, dword [eax]
lea edx, [ebp - 0x874]
push edx
mov edx, dword [ebp - 0x868]
add edx, 2
push edx
lea edx, [ebp - 0x450]
push edx
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x2e047fa3
mov eax, dword [ebp - 0x854]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov esi, eax
mov eax, dword [ebp - 0x854]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x2e047fb7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x2e047ff9
lea eax, [ebp - 0x88c]
push eax
call fcn.2e07a5dd
cmp eax, ebx
jl 0x2e047ff9
mov eax, dword [ebp - 0x88c]
mov ecx, dword [eax]
lea edx, [ebp - 0x85c]
push edx
push 0x2e006344
push eax
call dword [ecx]
cmp eax, ebx
jl 0x2e047ff9
push ebx
push dword [ebp - 0x864]
push dword [ebp - 0x85c]
call dword [sym.imp.ole32.dll_OleSave]
mov eax, dword [ebp - 0x85c]
mov byte [ebp - 4], 7
cmp eax, ebx
je 0x2e04800d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x888]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x2e048021
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x88c]
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x2e048035
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x870]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x2e048056
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x86c]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x2e04806a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x858]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x2e04807e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x860]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x2e048092
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x864]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x2e0480a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.2e01c4d2
ret 0xc