Function at 0x1023bea
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
mov eax, dword [0x102cd74]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x87c], 0xffffffff
or dword [ebp - 0x8a4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x8ac], esi
mov dword [ebp - 0x89c], edi
mov word [ebp - 0x20c], ax
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
mov dword [ebp - 0x898], eax
xor eax, eax
mov dword [0x102f76c], eax
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x890], eax
cmp esi, eax
je 0x102400f
cmp edi, eax
je 0x102400f
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ebx, 0x80
push ebx
push 3
push eax
push 3
push 0x80000000
push esi
call edi
mov dword [ebp - 0x884], eax
cmp eax, 0xffffffff
je 0x102400f
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01023b3b
xor eax, eax
cmp word [ebp - 0x20c], ax
je 0x1023faf
push eax
push ebx
push 2
push eax
push 7
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call edi
mov dword [ebp - 0x87c], eax
cmp eax, 0xffffffff
je 0x1023faf
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x884]
call fcn.01020eac
test eax, eax
jne 0x1023faf
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x87c]
call fcn.01020f1f
test eax, eax
jne 0x1023faf
movzx ebx, word [ebp + 0xc]
movsx esi, word [ebp - 0x81c]
mov edi, dword [sym.imp.msvcrt.dll_malloc]
sub ebx, 0xdffe
push 0xf0
mov dword [ebp - 0x88c], esi
mov dword [ebp - 0x8a0], ebx
call edi
pop ecx
mov dword [ebp - 0x880], eax
test eax, eax
je 0x1023faf
push esi
push eax
push dword [ebp - 0x884]
call fcn.01020fb8
test eax, eax
jne 0x1023faf
push esi
push dword [ebp - 0x880]
push dword [ebp - 0x87c]
call fcn.01021040
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a3c
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a34
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a2c
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1001a50
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a24
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a1c
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a14
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a0c
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
push dword [ebp - 0x87c]
mov ecx, 0x1004a04
push dword [ebp - 0x884]
call fcn.01021d56
test eax, eax
jne 0x1023faf
mov eax, dword [ebp - 0x880]
push esi
mov ecx, 0x10049f4
call fcn.010210ea
mov dword [ebp - 0x8b0], eax
test eax, eax
je 0x1023faf
push 0x20
lea ecx, [ebp - 0x840]
push ecx
push eax
push dword [ebp - 0x884]
call fcn.010211b9
cmp eax, 0x20
jne 0x1023faf
movzx eax, word [ebp - 0x83c]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x894]
push eax
call fcn.01020b18
movsx eax, word [ebp - 0x894]
cmp ebx, eax
mov dword [0x102f768], eax
jge 0x1023faf
lea eax, [eax*4 + 3]
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
shl ebx, 2
push ebx
call edi
pop ecx
mov dword [ebp - 0x888], eax
test eax, eax
je 0x1023faf
mov esi, dword [ebp - 0x89c]
lea edi, [ebp - 0x8c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x894]
push eax
push dword [ebp + 0x14]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x8c0]
lea edi, [ebp - 0x89c]
call fcn.0102264c
mov edi, dword [sym.imp.msvcrt.dll_malloc]
mov esi, 0xffff
push esi
call edi
pop ecx
mov dword [ebp - 0x890], eax
test eax, eax
je 0x1023faf
lea eax, [ebp - 0x8a8]
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x890]
mov ecx, esi
lea edx, [ebp - 0x8c0]
call fcn.01022b97
test eax, eax
je 0x102403d
mov dword [0x102f76c], eax
push dword [ebp - 0x884]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x87c], 0xffffffff
je 0x1023fce
push dword [ebp - 0x87c]
call esi
xor esi, esi
cmp dword [ebp - 0x880], esi
je 0x1023fe5
push dword [ebp - 0x880]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x888], esi
je 0x1023ffa
push dword [ebp - 0x888]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x890], esi
je 0x102400f
push dword [ebp - 0x890]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp word [ebp - 0x20c], 0
je 0x1024026
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x8a4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01026cc5
leave
ret 0x10
lea eax, [ebp - 0x89c]
push eax
call fcn.01020b75
lea eax, [ebp - 0x89a]
push eax
call fcn.01020b75
push dword [ebp - 0x88c]
mov eax, dword [ebp - 0x880]
mov ecx, 0x10049e4
call fcn.010210ea
mov esi, eax
test esi, esi
je 0x1023faf
push ebx
push dword [ebp - 0x888]
push esi
push dword [ebp - 0x884]
call fcn.010211b9
test eax, eax
jle 0x1023faf
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ebp - 0x8a0]
push ebx
push eax
push esi
push dword [ebp - 0x87c]
mov dword [eax + edx*4], ecx
call fcn.01021338
test eax, eax
jle 0x1023faf
push dword [ebp - 0x888]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [0x102f768]
lea eax, [eax*4 + 3]
cdq
and edx, 3
add eax, edx
mov esi, eax
sar esi, 2
shl esi, 2
push esi
call edi
pop ecx
pop ecx
mov dword [ebp - 0x888], eax
test eax, eax
je 0x1023faf
lea eax, [ebp - 0x894]
push eax
call fcn.01020b75
lea eax, [ebp - 0x892]
push eax
call fcn.01020b75
push dword [ebp - 0x88c]
mov eax, dword [ebp - 0x880]
mov ecx, 0x10049dc
call fcn.010210ea
mov ebx, eax
test ebx, ebx
je 0x1023faf
push esi
push dword [ebp - 0x888]
push ebx
push dword [ebp - 0x884]
call fcn.010211b9
test eax, eax
jle 0x1023faf
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0x894]
mov edx, dword [ebp - 0x8a0]
push esi
push eax
push ebx
push dword [ebp - 0x87c]
mov dword [eax + edx*4], ecx
call fcn.01021338
test eax, eax
jle 0x1023faf
push dword [ebp - 0x888]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [0x102f768]
lea eax, [eax*4 + 7]
cdq
and edx, 3
add eax, edx
mov esi, eax
sar esi, 2
shl esi, 2
push esi
call edi
pop ecx
pop ecx
mov dword [ebp - 0x888], eax
test eax, eax
je 0x1023faf
push dword [ebp - 0x88c]
mov eax, dword [ebp - 0x880]
mov ecx, 0x10049ec
call fcn.010210ea
mov ebx, eax
test ebx, ebx
je 0x1023faf
push esi
push dword [ebp - 0x888]
push ebx
push dword [ebp - 0x884]
call fcn.010211b9
test eax, eax
jle 0x1023faf
push dword [ebp - 0x88c]
mov eax, dword [ebp - 0x880]
mov ecx, 0x10049fc
call fcn.010210ea
mov edi, eax
test edi, edi
je 0x1023faf
push dword [ebp - 0x8a8]
push dword [ebp - 0x890]
push dword [ebp - 0x8a0]
push esi
push dword [ebp - 0x888]
push edi
push dword [ebp - 0x87c]
push dword [ebp - 0x884]
call fcn.01021f1a
test eax, eax
jne 0x1023faf
push dword [ebp - 0x87c]
call fcn.01020dec
test eax, eax
jne 0x1023faf
push dword [ebp - 0x890]
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - 0x890], 0
pop ecx
push esi
push dword [ebp - 0x888]
push ebx
push dword [ebp - 0x87c]
call fcn.01021338
test eax, eax
jle 0x1023faf
push dword [ebp + 0x14]
lea edi, [ebp - 0x840]
call fcn.01021683
test eax, eax
jl 0x1023faf
push 0x20
mov eax, edi
push eax
push dword [ebp - 0x8b0]
push dword [ebp - 0x87c]
call fcn.01021338
cmp eax, 0x20
jne 0x1023faf
push dword [ebp - 0x88c]
push dword [ebp - 0x880]
push dword [ebp - 0x87c]
call fcn.01021040
test eax, eax
jne 0x1023faf
push dword [ebp - 0x88c]
mov eax, dword [ebp - 0x880]
mov ecx, 0x10049d4
call fcn.010210ea
mov esi, eax
test esi, esi
je 0x1023faf
push 0x36
lea eax, [ebp - 0x878]
push eax
push esi
push dword [ebp - 0x884]
call fcn.010211b9
test eax, eax
jle 0x1023faf
and dword [esi + 4], 0
push 0x36
lea eax, [ebp - 0x878]
push eax
push esi
push dword [ebp - 0x87c]
call fcn.01021338
test eax, eax
jle 0x1023faf
mov ecx, dword [ebp - 0x880]
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x87c]
mov eax, dword [ebp - 0x88c]
call fcn.0102149f
test eax, eax
jne 0x1023faf
push 0x36
lea eax, [ebp - 0x878]
push eax
push esi
push dword [ebp - 0x87c]
call fcn.01021338
test eax, eax
jle 0x1023faf
push dword [ebp - 0x884]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x87c]
call esi
mov edi, dword [ebp - 0x8ac]
lea eax, [ebp - 0x814]
push eax
push edi
call fcn.01023b3b
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x814]
push eax
call ebx
test eax, eax
je 0x10243d5
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x814]
push eax
push edi
call esi
test eax, eax
je 0x10243d5
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x1024432
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov esi, 0x100
push esi
lea eax, [ebp - 0x40c]
push eax
push 0xef3b
push dword [ebp - 0x898]
call edi
push esi
lea eax, [ebp - 0x60c]
push eax
push 0xef6c
push dword [ebp - 0x898]
call edi
call fcn.0101c4d7
test eax, eax
je 0x1024416
mov eax, dword [eax + 0x20]
push 0
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x60c]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1023faf
lea eax, [ebp - 0x814]
push eax
call ebx
test eax, eax
jne 0x102445b
push edi
call ebx
push edi
lea eax, [ebp - 0x814]
push eax
call esi
mov dword [ebp - 0x8a4], 0xfffffffd
jmp 0x1023faf
push dword [ebp - 0x880]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push dword [ebp - 0x888]
call esi
pop ecx
pop ecx
xor eax, eax
jmp 0x102402c