Function at 0x701a1b6d
Capabilities:
Accept command line arguments
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x701a1bb9
cmp dword [ebp + 8], 0x90
je 0x701a1bb9
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push edi
push edi
lea eax, [ebp - 0x34]
push edi
push eax
call esi
test eax, eax
je 0x701a1bb9
push 1
push edi
push edi
lea eax, [ebp - 0x34]
push edi
push eax
jmp 0x701a1ba8
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
xor eax, eax
cmp dword [ebp - 8], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
jle 0x701a1c8b
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea ebx, [eax + 1]
cmp ebx, dword [ebp - 8]
jge 0x701a1c7b
push 0x701a42f8
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x701a1c0c
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
push 0x701a42f0
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x701a1c21
mov eax, dword [esi + 4]
mov dword [ebp + 0xc], eax
push 0x701a42e8
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x701a1c36
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
push 0x701a42e0
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x701a1c52
push dword [esi + 4]
call dword [sym.imp.MSVCRT.dll__wtoi]
pop ecx
mov dword [ebp - 0xc], eax
push 0x701a42d8
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x701a1c7b
cmp dword [ebp - 0x14], eax
jne 0x701a1c72
mov dword [ebp - 0x14], 1
call fcn.701a1487
push dword [esi + 4]
call fcn.701a148f
pop ecx
mov eax, ebx
add esi, 4
cmp eax, dword [ebp - 8]
jl 0x701a1beb
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x701a1c9a
call fcn.701a14f9
jmp 0x701a1d76
lea eax, [ebp - 0x444]
push eax
call fcn.701a111e
mov esi, 0x90
pop ecx
cmp dword [ebp + 8], esi
je 0x701a1cc8
lea eax, [ebp - 0x444]
push 1
push eax
call fcn.701a1118
push eax
call fcn.701a2262
add esp, 0xc
cmp dword [ebp + 0xc], edi
je 0x701a1cdc
push 0x701a43c0
push dword [ebp + 0xc]
call fcn.701a1b05
pop ecx
pop ecx
cmp dword [ebp - 4], edi
je 0x701a1cf0
push 0x701a42b8
push dword [ebp - 4]
call fcn.701a1b05
pop ecx
pop ecx
cmp dword [ebp - 0xc], edi
je 0x701a1cfe
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.701a14bb
cmp dword [ebp + 8], esi
je 0x701a1d40
lea eax, [ebp - 0x23c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x23c]
push 0x701a42bc
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 0x23c]
push 0x701a43c8
push eax
call fcn.701a1d7f
add esp, 0x10
mov ebx, dword [ebp - 0x10]
cmp ebx, edi
je 0x701a1d6d
cmp word [ebx], di
je 0x701a1d6d
push 1
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x701a1d6d
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
inc esi
cmp eax, 7
jl 0x701a1d4f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8