Function at 0x12ea6f60
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x13063cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov eax, dword [0x13198f68]
push ebp
push esi
xor ebp, ebp
mov esi, ecx
cmp eax, ebp
mov dword [esp + 0x10], esi
je 0x12ea6f9f
push 0x13134210
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
xor eax, eax
push ebx
mov dword [esp + 0x60], eax
push edi
lea ecx, [esp + 0x60]
xor edi, edi
mov dword [esp + 0x68], eax
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x70], eax
call fcn.12e31de0
push 0x8000
mov dword [esp + 0x58], eax
call fcn.12e6efc0
mov ebx, dword [esp + 0x88]
add esp, 8
test eax, eax
je 0x12ea7009
lea edx, [esp + 0x60]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
push ebx
mov ecx, 0x131c3108
call fcn.12ee2dd0
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
cmp eax, ebp
mov eax, dword [esp + 0x38]
jne 0x12ea7027
cmp eax, ebp
je 0x12ea7027
mov edi, 1
mov dword [esp + 0x34], edi
cmp dword [0x13198f68], ebp
je 0x12ea7045
push edi
push eax
push 0x131341d0
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp dword [esi + 0xc], ebp
je 0x12ea74aa
push 1
call fcn.12e6efc0
add esp, 4
test eax, eax
je 0x12ea74aa
cmp dword [esp + 0x10], 2
je 0x12ea74aa
mov ecx, ebx
call fcn.12e02880
test eax, eax
je 0x12ea74aa
lea eax, [esi + 0x10]
push ebp
push eax
lea ecx, [esp + 0x5c]
call fcn.12f560a0
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push 1
mov ecx, ebx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x48], 1
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], ebp
call fcn.12e02d00
test eax, eax
je 0x12ea746c
push 0xffffffffffffffff
lea ecx, [esp + 0x58]
call fcn.12f56130
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
cmp edi, ebp
mov dword [esp + 0x44], ebx
je 0x12ea748a
cmp ebx, ebp
jbe 0x12ea748a
cmp dword [0x13198f68], ebp
je 0x12ea7116
push 0x131341a0
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x48], eax
cmp edi, ebp
je 0x12ea73ab
cmp ebx, 0x38
jb 0x12ea73ab
mov ecx, dword [edi]
cmp ebx, ecx
jb 0x12ea73ab
mov eax, dword [edi + 0x34]
lea edx, [eax + 0x38]
cmp ecx, edx
jne 0x12ea73ab
cmp eax, ebp
je 0x12ea7169
lea ecx, [edi + 0x38]
cmp ecx, ebp
je 0x12ea7169
test al, 1
jne 0x12ea73ab
shr eax, 1
cmp word [ecx + eax*2 - 2], bp
jne 0x12ea73ab
cmp dword [edi + 4], ebp
jne 0x12ea73c9
mov eax, dword [edi + 0xc]
mov dword [esp + 0x4c], 1
cmp eax, ebp
je 0x12ea718b
cmp eax, dword [esp + 0x48]
jb 0x12ea734a
call fcn.12e6ef90
cmp dword [edi + 0x10], ebp
je 0x12ea719d
cmp eax, ebp
je 0x12ea7368
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
push edi
mov ecx, esi
call fcn.12ea68a0
mov ebx, eax
cmp ebx, ebp
jne 0x12ea7227
mov edx, dword [esp + 0x80]
test byte [edx + 0xa00], 0x20
je 0x12ea7227
cmp dword [esp + 0x30], 2
jne 0x12ea7227
mov eax, dword [esp + 0x1c]
mov ecx, edx
push eax
call fcn.12e02870
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.12ea68a0
mov ebx, eax
mov eax, dword [0x13198f68]
cmp eax, ebp
je 0x12ea724c
mov ecx, dword [esp + 0x8c]
push ecx
push ebx
push 0x13134154
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp dword [0x13198f68], ebp
je 0x12ea724c
mov edx, dword [esp + 0x8c]
push edx
push ebx
push 0x13134110
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp ebx, ebp
je 0x12ea7390
mov eax, dword [esp + 0x8c]
cmp eax, ebp
je 0x12ea7265
mov dword [eax], 1
cmp dword [0x13198f68], ebp
je 0x12ea728b
mov eax, dword [esp + 0x84]
mov ecx, dword [eax]
push ecx
push 0x131340d8
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov esi, dword [edi + 0x14]
xor edx, edx
and esi, 3
lea eax, [esp + 0x40]
cmp esi, 2
lea ecx, [esp + 0x3c]
sete dl
push edx
push eax
push ecx
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
call fcn.12e03060
cmp dword [esp + 0x3c], ebp
je 0x12ea730a
mov edx, dword [esp + 0x84]
cmp dword [edx], ebp
jne 0x12ea730a
cmp dword [esp + 0x34], ebp
jne 0x12ea730a
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x18]
push eax
push edi
call fcn.12ea69f0
test eax, eax
je 0x12ea730a
mov eax, dword [0x13198f68]
mov dword [esp + 0x34], 1
cmp eax, ebp
je 0x12ea730a
push 0x131340a8
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
cmp dword [esp + 0x40], ebp
je 0x12ea7322
mov ecx, dword [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x1c]
push edi
call fcn.12ea8940
cmp dword [0x13198f68], ebp
je 0x12ea733f
push esi
push 0x13134070
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp esi, 3
jne 0x12ea7386
mov eax, dword [esp + 0x4c]
jmp 0x12ea738c
cmp dword [0x13198f68], ebp
je 0x12ea7390
push 0x13134040
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12ea7390
cmp dword [0x13198f68], ebp
je 0x12ea7390
push 0x13134010
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12ea7390
xor eax, eax
mov dword [esp + 0x10], esi
cmp eax, ebp
je 0x12ea73e7
mov eax, dword [edi]
mov ebx, dword [esp + 0x44]
sub ebx, eax
add edi, eax
cmp ebx, ebp
mov dword [esp + 0x44], ebx
jbe 0x12ea7404
mov esi, dword [esp + 0x18]
jmp 0x12ea7120
cmp dword [0x13198f68], ebp
je 0x12ea7408
push 0x13133fe0
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12ea7408
cmp dword [0x13198f68], ebp
je 0x12ea7408
push 0x13133fb0
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12ea7408
cmp dword [0x13198f68], ebp
je 0x12ea7404
push ebx
push 0x13133f78
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x54]
call fcn.12f56150
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 2
mov dword [esp + 0x30], eax
jg 0x12ea748e
cmp dword [esp + 0x10], 2
je 0x12ea748e
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], ebp
call fcn.12e02d00
test eax, eax
jne 0x12ea70d5
cmp dword [0x13198f68], ebp
je 0x12ea748e
push 0x13133f48
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12ea748e
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x54]
mov dword [esp + 0x78], 0xffffffff
call fcn.12f56100
mov ebx, dword [esp + 0x80]
mov edi, dword [esp + 0x34]
cmp edi, ebp
je 0x12ea755b
mov ecx, ebx
call fcn.12e030e0
test eax, eax
jne 0x12ea755b
cmp dword [0x13198f68], ebp
je 0x12ea74dd
push 0x13133f14
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
cmp dword [esp + 0x50], ebp
je 0x12ea755b
cmp dword [0x13198f68], ebp
je 0x12ea74ff
push 0x13133ee0
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
mov eax, dword [ebx + 0x9ec]
push ebp
cmp eax, ebp
je 0x12ea7517
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x64]
push edx
push ebx
push eax
jmp 0x12ea751e
push ebp
lea ecx, [esp + 0x68]
push ebp
push ecx
mov ecx, ebx
call fcn.12e02880
push eax
mov ecx, 0x131a90d0
call fcn.12e0c2d0
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x60]
mov dword [edx], eax
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x64]
mov dword [eax], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebp
pop ebx
je 0x12ea758e
push eax
call fcn.12f5c44d
add esp, 4
test eax, eax
jbe 0x12ea757d
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc]
push ecx
call fcn.12f5bf80
add esp, 4
mov dword [esp + 0xc], ebp
cmp dword [0x13198f68], ebp
je 0x12ea75c4
mov esi, dword [esp + 8]
push esi
push 0x13133ea8
push str.DocRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret 0x10
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 8]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x6c
ret 0x10