Function at 0x11097650
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111dfc30
mov eax, dword fs:[0]
push eax
sub esp, 0xa44
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
mov esi, ecx
mov dword [ebp - 0x9d4], esi
mov ebx, edx
jne 0x110976bd
mov ecx, dword [0x1127aa68]
push 0
push 0
push 0x11212424
push str._debug
call fcn.110bbc00
test eax, eax
je 0x110976bd
mov eax, dword [ebp + 8]
push 0x1121241c
push eax
push ebx
call fcn.11090f60
add esp, 0xc
mov eax, dword [ebx + 0xa]
xor edi, edi
mov dword [ebp - 0x9d8], edi
cmp eax, 7
je 0x110976d6
cmp eax, 0xd
jne 0x11097b61
cmp dword [ebx + 2], 2
jne 0x11097b61
cmp dword [ebx + 0xe], 5
jne 0x11098624
mov esi, 0x11212418
lea eax, [ebx + 0x1c]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x11097712
test cl, cl
je 0x1109770e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x11097712
add eax, 2
add esi, 2
test cl, cl
jne 0x110976f2
xor eax, eax
jmp 0x11097717
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x11098624
cmp dword [ebx + 6], 3
jne 0x11098624
push 0x1f
lea ecx, [ebx + 0x27]
push str.F_r_nredirect:_r_nhttp:__localhost_
push ecx
call dword [sym.imp.MSVCR100.dll__strnicmp]
mov ecx, dword [0x1127ab0c]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
lea edx, [ebp - 0x9d0]
push edx
inc esi
push esi
call fcn.110d6450
test esi, esi
je 0x11097acf
cmp word [ebp - 0x9d0], di
je 0x11097acf
lea eax, [ebp - 0x9d0]
push 0x3a
push eax
mov esi, str.localhost
mov edi, 0x50
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 8
test eax, eax
je 0x110977d6
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
mov dword [ebp - 0x9dc], eax
call dword [sym.imp.MSVCR100.dll__wtoi]
mov edx, dword [ebp - 0x9dc]
push 0x3a
push edx
mov edi, eax
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 0xc
test eax, eax
je 0x110977d6
lea esi, [eax + 2]
xor ecx, ecx
push 0x3a
push esi
mov word [eax], cx
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 8
test eax, eax
je 0x110977d6
xor edx, edx
mov word [eax], dx
lea ecx, [ebp - 0xa10]
call fcn.1113dd30
lea eax, [ebp - 0x9d0]
push eax
lea ecx, [ebp - 0xa10]
push str.__s_
push ecx
mov dword [ebp - 4], 0
call fcn.1113d940
push str.127.0.0.1
lea edx, [ebp - 0xa10]
push str._r_n__s_
push edx
call fcn.1113d9c0
push str.localhost
lea eax, [ebp - 0xa10]
push str._r_n__s_
push eax
call fcn.1113d9c0
push esi
lea ecx, [ebp - 0xa10]
push str._r_n__s_
push ecx
call fcn.1113d9c0
add esp, 0x30
lea ecx, [ebp - 0xa30]
call fcn.1113dd30
lea edx, [ebp - 0x9d0]
push edx
lea eax, [ebp - 0xa30]
push str.__s_000_240
push eax
mov byte [ebp - 4], 1
call fcn.1113d940
push str.127.0.0.1
lea ecx, [ebp - 0xa30]
push str._r_n__s_000_240
push ecx
call fcn.1113d9c0
push str.localhost
lea edx, [ebp - 0xa30]
push str._r_n__s_000_240
push edx
call fcn.1113d9c0
push esi
lea eax, [ebp - 0xa30]
push str._r_n__s_000_240
push eax
call fcn.1113d9c0
add esp, 0x30
push str.127.0.0.1
lea ecx, [ebp - 0xa00]
call fcn.1113ccd0
mov byte [ebp - 4], 2
cmp edi, 0x50
je 0x110978d7
push edi
lea ecx, [ebp - 0xa00]
push 0x1120fcc4
push ecx
call fcn.1113d9c0
add esp, 0xc
lea ecx, [ebp - 0xa20]
call fcn.1113dd30
lea ecx, [ebp - 0xa00]
mov byte [ebp - 4], 3
call fcn.1104dac0
push eax
lea edx, [ebp - 0xa20]
push str.PF_r_nredirect:_r_nhttp:___s_
push edx
call fcn.1113d940
mov esi, dword [ebp - 0x9d4]
mov ecx, dword [esi + 4]
add esp, 0xc
call fcn.110c7040
push eax
lea eax, [ebx + 0x46]
push eax
lea ecx, [ebp - 0x9f0]
call fcn.1113cd50
push eax
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 4
call fcn.1113dc60
lea ecx, [ebp - 0x9f0]
mov byte [ebp - 4], 3
call fcn.1113cd80
lea ecx, [ebp - 0xa30]
call fcn.1104dac0
push eax
push str._localhost_000_240
lea ecx, [ebp - 0xa20]
call fcn.1113d1c0
test eax, eax
jne 0x1109797f
lea ecx, [ebp - 0xa10]
call fcn.1104dac0
push eax
push str._localhost_
lea ecx, [ebp - 0xa20]
call fcn.1113d1c0
mov ecx, dword [esi + 4]
call fcn.110c7040
push eax
lea ecx, [ebp - 0xa20]
call fcn.1102f630
push eax
lea ecx, [ebp - 0x9e0]
call fcn.111b81d0
mov edi, dword [ebp - 0x9e0]
mov byte [ebp - 4], 5
lea ecx, [edi + 1]
lea esp, [esp]
mov al, byte [edi]
inc edi
test al, al
jne 0x110979b0
lea eax, [ebx + 0x26]
sub edi, ecx
mov dword [ebp - 0x9dc], eax
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x110979c5
mov ecx, dword [ebp + 8]
sub eax, esi
sub edi, eax
lea eax, [edi + ecx + 0x20]
call fcn.111d9480
mov edx, dword [ebp + 8]
mov esi, esp
lea eax, [edi + edx + 0x20]
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 0x9e0]
add esp, 0x18
inc eax
lea ecx, [esi + 0x27]
mov dl, byte [eax]
mov byte [ecx], dl
inc eax
inc ecx
test dl, dl
jne 0x11097a06
add dword [esi + 0x12], edi
add word [esi + 0x1a], di
add dword [esi + 0x22], edi
mov edx, dword [ebp - 0x9dc]
add edi, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x9dc]
mov dword [ebp + 8], edi
mov ebx, esi
call fcn.11062fb0
mov eax, dword [eax]
push eax
push str.OldFilter_.900s_n
call fcn.111bd7b0
mov eax, dword [ebp - 0x9dc]
mov edi, dword [sym.imp.MSVCR100.dll_free]
push eax
call edi
add esp, 0xc
add esi, 0x26
push esi
lea ecx, [ebp - 0x9dc]
call fcn.11062fb0
mov eax, dword [eax]
push eax
push str.NewFilter_.900s_n
call fcn.111bd7b0
mov ecx, dword [ebp - 0x9dc]
push ecx
call edi
add esp, 0xc
lea ecx, [ebp - 0x9e0]
mov byte [ebp - 4], 3
call fcn.11063000
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 2
call fcn.1113cd80
lea ecx, [ebp - 0xa00]
mov byte [ebp - 4], 1
call fcn.1113cd80
lea ecx, [ebp - 0xa30]
mov byte [ebp - 4], 0
call fcn.1113cd80
lea ecx, [ebp - 0xa10]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov edi, dword [ebp - 0x9d8]
mov esi, dword [ebp - 0x9d4]
mov ecx, dword [esi + 4]
call fcn.110c7040
push eax
lea edx, [ebx + 0x26]
push edx
lea ecx, [ebp - 0x9f0]
call fcn.1113cd50
push eax
mov ecx, 0x1127b9bc
mov dword [ebp - 4], 6
call fcn.1113db60
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, 0x1127b9cc
call fcn.1103f220
test al, al
jne 0x11097b2b
mov eax, dword [esi + 4]
mov dword [eax + 0x60], 1
jmp 0x11097b35
mov ecx, dword [esi + 4]
mov dword [ecx + 0x60], 0
cmp dword [ebx + 0xa], 0xd
je 0x11098624
mov ecx, 0x1127b9cc
call fcn.1103f220
test al, al
jne 0x11098624
lea edx, [ebp + 8]
push edx
push ebx
push esi
call fcn.1108ad90
jmp 0x11098616
mov ecx, dword [ebx + 2]
cmp ecx, 2
jne 0x11097de2
cmp eax, 9
jne 0x11097cce
mov ecx, dword [esi + 4]
call fcn.110c7040
push eax
lea eax, [ebx + 0x26]
push eax
lea ecx, [ebp - 0x9f0]
call fcn.1113cd50
push eax
mov ecx, 0x1127b9cc
mov dword [ebp - 4], 7
call fcn.1113db60
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
push 0x20a
lea ecx, [ebp - 0x21c]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x105
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x11097c21
xor ecx, ecx
lea edi, [ebp - 0x21c]
mov word [eax + 2], cx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11097c01
mov ecx, 8
mov esi, str.TCFilterData.dat
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x9d4]
cmp dword [ebp + 0xc], 0
je 0x11097c3a
lea edx, [ebp - 0x21c]
push 0x1127b9cc
push edx
call fcn.110974d0
jmp 0x11097c68
mov ecx, 0x1127b9cc
call fcn.1103f220
test al, al
je 0x11097c57
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11097c6b
lea ecx, [ebp - 0x21c]
push 0x1127b9cc
push ecx
call fcn.110975b0
add esp, 8
mov edx, dword [0x1127b9cc]
mov eax, dword [edx]
mov ecx, 0x1127b9cc
call eax
test al, al
jne 0x11097c95
push 0x263
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
cmp dword [0x1127b9d4], 0
push 1
je 0x11097cac
mov ecx, dword [esi + 4]
mov dword [ecx + 0x60], 1
jmp 0x11097cb6
mov edx, dword [esi + 4]
mov dword [edx + 0x60], 0
call fcn.1106ad10
add esp, 4
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.1108ad90
jmp 0x11098616
cmp ecx, 2
jne 0x11097de2
cmp eax, 0xb
jne 0x11097de2
mov ecx, dword [esi + 4]
call fcn.110c7040
push eax
add ebx, 0x26
push ebx
lea ecx, [ebp - 0x9f0]
call fcn.1113cd50
push eax
mov ecx, 0x1127b9dc
mov dword [ebp - 4], 8
call fcn.1113db60
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
push 0x20a
lea ecx, [ebp - 0x21c]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x105
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x11097d8a
xor ecx, ecx
lea edi, [ebp - 0x21c]
mov word [eax + 2], cx
add edi, 0xfffffffe
jmp 0x11097d70
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11097d70
mov ecx, 7
mov esi, str.TCListData.dat
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [ebp + 0xc], 0
je 0x11097da9
lea edx, [ebp - 0x21c]
push 0x1127b9dc
push edx
call fcn.110974d0
add esp, 8
jmp 0x1109864a
mov ecx, 0x1127b9dc
call fcn.1103f220
test al, al
je 0x11097dc9
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1109864a
lea ecx, [ebp - 0x21c]
push 0x1127b9dc
push ecx
call fcn.110975b0
add esp, 8
jmp 0x1109864a
cmp ecx, 6
jne 0x110981f5
push 0x20a
lea edx, [ebp - 0x428]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x105
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x428]
push 0x5c
push ecx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x11097e31
xor edx, edx
mov word [eax + 2], dx
cmp dword [ebp + 0xc], edi
je 0x11097fb6
lea ecx, [ebp - 0xa40]
call fcn.1113dd30
lea esi, [ebx + 0x26]
push str.SETUSBMASSSTORAGEACCESS
push esi
mov dword [ebp - 4], 9
mov dword [ebp - 0x9dc], esi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x11097ef8
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11097e75
mov ecx, 7
mov esi, str.TCUSBData.dat
lea eax, [ebp - 0xa40]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov dword [0x112715e8], 0xe0000000
call fcn.110974d0
add esp, 8
test eax, eax
je 0x11097ecf
push 0xa
push 0
lea ecx, [ebp - 0xa40]
call fcn.1104dac0
push eax
call dword [sym.imp.MSVCR100.dll_wcstoul]
add esp, 0xc
mov dword [0x112715e8], eax
mov eax, dword [ebp - 0x9d4]
push str.SETUSBMASSSTORAGEACCESS
lea edx, [ebp + 8]
push edx
push ebx
push eax
call fcn.1108abe0
mov esi, dword [ebp - 0x9dc]
add esp, 0x10
mov dword [ebp - 0x9d8], eax
mov ebx, eax
mov edi, eax
push str.SETOPTICALDRIVEACCESS
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x11097f9f
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
jmp 0x11097f20
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11097f20
mov ecx, 6
mov esi, str.TCCDData.dat
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xa40]
push ecx
lea edx, [ebp - 0x428]
push edx
movsw word es:[edi], word [esi]
mov dword [0x112715ec], 0xe0000000
call fcn.110974d0
add esp, 8
test eax, eax
je 0x11097f7c
push 0xa
push 0
lea ecx, [ebp - 0xa40]
call fcn.1104dac0
push eax
call dword [sym.imp.MSVCR100.dll_wcstoul]
add esp, 0xc
mov dword [0x112715ec], eax
mov ecx, dword [ebp - 0x9d4]
push str.SETOPTICALDRIVEACCESS
lea eax, [ebp + 8]
push eax
push ebx
push ecx
call fcn.1108abe0
add esp, 0x10
mov dword [ebp - 0x9d8], eax
mov ebx, eax
mov edi, eax
lea ecx, [ebp - 0xa40]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
jmp 0x11098624
cmp byte [esi + 0x340], 0
je 0x110980a7
lea esi, [ebx + 0x26]
push str.SETUSBMASSSTORAGEACCESS
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x110980a7
push str.ACCESSMODES
mov edi, 0xe0000000
push esi
mov dword [ebp - 0x9e0], edi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x11098014
push 0xa
add eax, 0xc
push 0
push eax
call dword [sym.imp.MSVCR100.dll_strtoul]
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x9e0], eax
mov dword [0x112715e8], edi
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11098023
cmp dword [ebp - 0x9e0], 0xe0000000
mov ecx, 7
mov esi, str.TCUSBData.dat
rep movsd dword es:[edi], dword [esi]
jne 0x11098056
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x110980a7
lea ecx, [ebp - 0xa00]
call fcn.1113dd30
mov eax, dword [0x112715e8]
push eax
lea ecx, [ebp - 0xa00]
push 0x1124b6a8
push ecx
mov dword [ebp - 4], 0xa
call fcn.1113d940
lea edx, [ebp - 0xa00]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.110975b0
add esp, 0x14
lea ecx, [ebp - 0xa00]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, dword [ebp - 0x9d4]
cmp byte [ecx + 0x340], 0
je 0x110981a6
lea esi, [ebx + 0x26]
push str.SETOPTICALDRIVEACCESS
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x110981a6
push str.ACCESSMODES
mov edi, 0xe0000000
push esi
mov dword [ebp - 0x9e0], edi
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x1109810b
push 0xa
add eax, 0xc
push 0
push eax
call dword [sym.imp.MSVCR100.dll_strtoul]
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x9e0], eax
mov dword [0x112715ec], edi
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11098120
cmp dword [ebp - 0x9e0], 0xe0000000
mov ecx, 6
mov esi, str.TCCDData.dat
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x11098155
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x110981a6
lea ecx, [ebp - 0xa00]
call fcn.1113dd30
mov eax, dword [0x112715ec]
push eax
lea ecx, [ebp - 0xa00]
push 0x1124b6a8
push ecx
mov dword [ebp - 4], 0xb
call fcn.1113d940
lea edx, [ebp - 0xa00]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.110975b0
add esp, 0x14
lea ecx, [ebp - 0xa00]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov eax, dword [ebp - 0x9d4]
mov esi, dword [eax + 4]
mov edx, 0xe0000000
mov ecx, 1
cmp dword [0x112715e8], edx
jne 0x110981ca
mov dword [esi + 0x64], 0
jmp 0x110981cd
mov dword [esi + 0x64], ecx
mov edi, dword [ebp - 0x9d8]
cmp dword [0x112715ec], edx
jne 0x110981ea
mov ecx, dword [eax + 4]
mov dword [ecx + 0x68], 0
jmp 0x11098624
mov edx, dword [eax + 4]
mov dword [edx + 0x68], ecx
jmp 0x11098624
cmp ecx, 4
jne 0x1109841d
push 0x20a
lea eax, [ebp - 0x634]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x105
lea ecx, [ebp - 0x634]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x634]
push 0x5c
push edx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x11098244
xor ecx, ecx
mov word [eax + 2], cx
cmp dword [ebp + 0xc], edi
je 0x11098314
lea ecx, [ebp - 0x9f0]
call fcn.1113dd30
lea edx, [ebx + 0x26]
push str.BLOCKPRINTING
push edx
mov dword [ebp - 4], 0xc
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x110982fd
lea edi, [ebp - 0x634]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11098282
mov ecx, 7
mov esi, str.TCPRNData.dat
lea eax, [ebp - 0x9f0]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x634]
push ecx
mov dword [0x1127b97c], 0
call fcn.110974d0
add esp, 8
test eax, eax
je 0x110982dc
push 0xa
push 0
lea ecx, [ebp - 0x9f0]
call fcn.1104dac0
push eax
call dword [sym.imp.MSVCR100.dll_wcstoul]
add esp, 0xc
mov dword [0x1127b97c], eax
mov eax, dword [ebp - 0x9d4]
push str.BLOCKPRINTING
lea edx, [ebp + 8]
push edx
push ebx
push eax
call fcn.1108abe0
add esp, 0x10
mov dword [ebp - 0x9d8], eax
mov ebx, eax
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
jmp 0x110983e4
cmp byte [esi + 0x340], 0
je 0x110983e4
lea edi, [ebp - 0x634]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11098330
mov ecx, 7
mov esi, str.TCPRNData.dat
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.MSVCR100.dll_strstr]
lea esi, [ebx + 0x26]
push str.BLOCKPRINTING
push esi
call edi
add esp, 8
test eax, eax
je 0x110983be
lea ecx, [ebp - 0x9f0]
mov dword [0x1127b97c], 1
call fcn.1113dd30
mov ecx, dword [0x1127b97c]
push ecx
lea edx, [ebp - 0x9f0]
push 0x111f9500
push edx
mov dword [ebp - 4], 0xd
call fcn.1113d940
lea eax, [ebp - 0x9f0]
push eax
lea ecx, [ebp - 0x634]
push ecx
call fcn.110975b0
add esp, 0x14
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
jmp 0x110983e4
push str.RESUMEPRINTING
push esi
call edi
add esp, 8
test eax, eax
je 0x110983e4
lea edx, [ebp - 0x634]
push edx
mov dword [0x1127b97c], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x1127b97c], 0
mov edi, dword [ebp - 0x9d8]
je 0x11098408
mov eax, dword [ebp - 0x9d4]
mov ecx, dword [eax + 4]
mov dword [ecx + 0x6c], 1
jmp 0x11098624
mov edx, dword [ebp - 0x9d4]
mov eax, dword [edx + 4]
mov dword [eax + 0x6c], 0
jmp 0x11098624
mov edx, dword [ebx + 0xe]
cmp edx, 5
jne 0x11098624
cmp eax, 7
je 0x11098437
cmp eax, 0xd
jne 0x110984cd
cmp ecx, 1
jne 0x110984cd
mov ecx, dword [esi + 4]
call fcn.110c7040
push eax
lea ecx, [ebx + 0x2f]
push ecx
lea ecx, [ebp - 0x9f0]
call fcn.1113cd50
push eax
mov ecx, 0x1127b9ec
mov dword [ebp - 4], 0xe
call fcn.1113db60
lea ecx, [ebp - 0x9f0]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
mov ecx, 0x1127b9fc
call fcn.1103f220
test al, al
jne 0x11098496
mov edx, dword [esi + 4]
mov dword [edx + 0x70], 1
jmp 0x110984a0
mov eax, dword [esi + 4]
mov dword [eax + 0x70], 0
cmp dword [ebx + 0xa], 0xd
je 0x11098624
mov ecx, 0x1127b9fc
call fcn.1103f220
test al, al
jne 0x11098624
mov edx, dword [ebp - 0x9d4]
lea ecx, [ebp + 8]
push ecx
push ebx
push edx
jmp 0x11098611
cmp edx, 5
jne 0x11098624
cmp ecx, 1
jne 0x11098624
cmp eax, 9
jne 0x11098624
mov edi, esi
mov ecx, dword [edi + 4]
call fcn.110c7040
push eax
lea eax, [ebx + 0x2f]
push eax
lea ecx, [ebp - 0xa50]
call fcn.1113cd50
push eax
mov ecx, 0x1127b9fc
mov dword [ebp - 4], 0xf
call fcn.1113db60
lea ecx, [ebp - 0xa50]
mov dword [ebp - 4], 0xffffffff
call fcn.1113cd80
push 0x20a
lea ecx, [ebp - 0x840]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x105
lea edx, [ebp - 0x840]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x840]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x11098593
xor ecx, ecx
lea edi, [ebp - 0x840]
mov word [eax + 2], cx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11098575
mov ecx, 7
mov esi, str.TCAppData.dat
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x9d4]
cmp dword [ebp + 0xc], 0
je 0x110985b6
mov ecx, 0x1127b9ec
call fcn.1113c610
lea edx, [ebp - 0x840]
push 0x1127b9fc
push edx
call fcn.110974d0
jmp 0x110985e4
mov ecx, 0x1127b9fc
call fcn.1103f220
test al, al
je 0x110985d3
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x110985e7
lea ecx, [ebp - 0x840]
push 0x1127b9fc
push ecx
call fcn.110975b0
add esp, 8
mov ecx, 0x1127b9fc
call fcn.1103f220
test al, al
jne 0x11098601
mov edx, dword [edi + 4]
mov dword [edx + 0x70], 1
jmp 0x1109860b
mov eax, dword [edi + 4]
mov dword [eax + 0x70], 0
lea ecx, [ebp + 8]
push ecx
push ebx
push edi
call fcn.1108b1b0
mov edi, eax
mov dword [edi + 0xa], 7
mov ebx, edi
add esp, 0xc
mov edx, dword [ebp - 0x9d4]
mov eax, dword [edx + 4]
mov ecx, dword [ebp + 8]
push 0
push eax
push ecx
mov ecx, dword [0x1127ad34]
push ebx
call fcn.111418d0
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea esp, [ebp - 0xa60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret