Function at 0x104a257
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x18], ebx
call fcn.0104a760
test al, al
je 0x104a28a
lea eax, [ebp - 0x18]
push eax
call fcn.0104a7c9
test al, al
je 0x104a28a
push dword [ebp - 0x18]
call fcn.0104a73a
lea ecx, [ebp - 0x24]
mov byte [ebp - 1], bl
call fcn.010424ee
lea ecx, [ebp - 0x14]
call fcn.01043668
push 0x28
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a2b5
mov ecx, eax
call fcn.01043e2b
jmp 0x104a2b7
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x58], eax
je 0x104a385
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a2d7
mov ecx, eax
call fcn.01043e2b
jmp 0x104a2d9
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x104a385
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x104a301
cmp dword [0x10f05cc], ebx
jne 0x104a315
push eax
call fcn.0105edfc
test eax, eax
jne 0x104a30b
mov edi, 0x80004005
jmp 0x104a653
mov dword [0x10f05cc], 1
lea eax, [ebp - 0x10]
push eax
push 0x10091b4
push 0x10091a4
call fcn.0105f012
mov edi, eax
cmp edi, ebx
jl 0x104a653
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
lea eax, [esi + 0x28]
push eax
push 0x1009194
push ebx
push ecx
call dword [edx + 0xc]
mov edi, eax
cmp edi, ebx
jl 0x104a653
lea eax, [esi + 0x2c]
push eax
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov edi, eax
cmp edi, ebx
jl 0x104a653
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a37d
mov ecx, eax
call fcn.01054a06
mov dword [ebp - 0xc], eax
jmp 0x104a380
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x104a38f
mov edi, 0x8007000e
jmp 0x104a653
mov eax, dword [esi + 0x28]
mov ecx, dword [eax]
lea edx, [esi + 0x30]
push edx
push dword [ebp - 0xc]
push dword [esi + 0x2c]
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jl 0x104a64a
lea eax, [ebp - 0x24]
push eax
push 2
lea ecx, [ebp - 0x14]
call fcn.010438c7
mov edi, eax
cmp edi, ebx
jl 0x104a64a
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.0104369e
mov edi, eax
cmp edi, ebx
jl 0x104a64a
cmp dword [ebp - 8], ebx
jne 0x104a484
lea ecx, [ebp - 0x8c]
mov byte [ebp - 1], 1
call fcn.0107e139
lea ecx, [ebp - 0x30]
call fcn.010435bb
lea eax, [ebp - 0x8c]
push eax
push 1
push 0x11
call fcn.0107c911
test eax, eax
jl 0x104a444
push 0xffffffffffffffff
push 0x1008f98
lea ecx, [ebp - 0x8c]
call fcn.0107e578
test eax, eax
jl 0x104a444
lea eax, [ebp - 0x30]
push eax
push ebx
lea ecx, [ebp - 0x8c]
call fcn.0107f08b
test eax, eax
jl 0x104a444
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
mov edi, 0x10f2bd4
push 0x100903c
mov ecx, edi
call fcn.01079fed
test al, al
jne 0x104a46f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.01049fb4
lea ecx, [ebp - 0x30]
call fcn.01042e75
lea ecx, [ebp - 0x8c]
call fcn.0104163c
jmp 0x104a489
mov edi, 0x10f2bd4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1008fec
mov ecx, edi
call fcn.01079fed
test al, al
je 0x104a4bd
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push 0x1008fec
mov ecx, edi
call fcn.0107a099
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 8], ebx
mov ecx, esi
sete al
push eax
push dword [ebp - 0x24]
call fcn.01049512
mov edi, eax
cmp edi, ebx
jl 0x104a64a
push 0xf8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a4f5
mov ecx, eax
call fcn.0104e0b1
jmp 0x104a4f7
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x104a56f
push esi
mov ecx, eax
call fcn.0104e74d
mov edi, eax
cmp edi, ebx
jl 0x104a64a
push pe_nt_image_headers32
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a528
mov ecx, eax
call fcn.0104d3f3
jmp 0x104a52a
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x104a56f
xor ecx, ecx
cmp dword [ebp - 8], ebx
sete cl
push ecx
push dword [esi + 0x20]
mov ecx, eax
push dword [esi + 0x24]
call fcn.0104d4d2
mov edi, eax
cmp edi, ebx
jl 0x104a64a
push 0x50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x104a566
mov ecx, eax
call fcn.0104c58b
jmp 0x104a568
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x104a579
mov edi, 0x8007000e
jmp 0x104a64a
push dword [esi + 0x18]
mov ecx, eax
push dword [esi + 0x10]
push dword [esi + 0x20]
push dword [esi + 0x24]
call fcn.0104ad65
mov edi, eax
cmp edi, ebx
jl 0x104a64a
lea eax, [esi + 0x54]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
push eax
call dword [sym.imp.ole32.dll_CoCreateFreeThreadedMarshaler]
mov edi, eax
cmp edi, ebx
jl 0x104a64a
cmp byte [ebp - 1], bl
je 0x104a5d7
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1009028
mov ecx, 0x10f2bd4
call fcn.01079fed
test al, al
jne 0x104a5d7
push ebx
push esi
call fcn.010891eb
call fcn.0104a760
test al, al
je 0x104a64a
cmp byte [ebp - 1], bl
je 0x104a5f6
push ebx
push ebx
push 0x1009050
mov ecx, 0x10f2bd4
call fcn.0107a099
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1009050
mov ecx, 0x10f2bd4
call fcn.01079fed
test al, al
jne 0x104a64a
cmp dword [0x10d09d4], ebx
je 0x104a64a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1009028
mov ecx, 0x10f2bd4
call fcn.01079fed
test al, al
jne 0x104a64a
push 1
push esi
call fcn.010891eb
push ebx
push 1
push 0x1009050
mov ecx, 0x10f2bd4
call fcn.0107a099
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x104a663
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x14]
call fcn.01043670
lea ecx, [ebp - 0x24]
call fcn.01042e75
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret