Function at 0x1055ab1
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9bc
mov eax, dword [0x111121c]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, 0x464
cmp ecx, eax
mov dword [ebp - 0x774], edi
mov dword [ebp - 0x778], esi
mov dword [ebp - 0x764], edx
ja 0x105638a
je 0x1056365
add eax, 0xffffffca
cmp ecx, eax
ja 0x105622c
je 0x105609d
sub ecx, 0x15
je 0x1056093
dec ecx
je 0x1056089
sub ecx, 4
je 0x1056078
sub ecx, 0xf9
je 0x1055f98
sub ecx, 0x319
je 0x1055f1c
dec ecx
jne case.0x10563ac.1131
xor eax, eax
push eax
lea edi, [ebx + 0x40]
mov esi, 0x10075f8
push esi
mov ecx, edi
mov dword [ebp - 0x768], eax
mov dword [ebp - 0x76c], eax
call fcn.01063f5e
test eax, eax
jle 0x1055b77
push esi
mov ecx, edi
mov dword [ebp - 0x76c], 1
call fcn.01063efe
mov ecx, dword [0x1113528]
xor eax, eax
xor esi, esi
cmp dword [ebp - 0x774], esi
setne al
add eax, 4
push eax
call fcn.01054948
cmp eax, 0x81000315
je 0x1055bb9
cmp dword [ebp - 0x774], esi
je 0x1055baa
cmp dword [ebp - 0x76c], esi
je 0x1055bb9
push 1
mov ecx, ebx
call fcn.0104ca19
mov dword [ebp - 0x768], eax
call fcn.010611eb
cmp dword [ebp - 0x768], esi
jl case.0x10563ac.1131
push 0x1048
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x768], edi
je case.0x10563ac.1131
mov ecx, dword [0x1112f40]
mov esi, 0x824
push esi
push edi
call fcn.0103f482
test eax, eax
jl 0x1055eee
cmp word [edi], 0
je 0x1055eee
push 0x1007b44
call fcn.01060d46
test eax, eax
jne 0x1055c27
push eax
push eax
push eax
mov ecx, ebx
call fcn.0104b05e
push eax
call fcn.010551b2
push edi
call fcn.01061569
test eax, eax
je 0x1055d06
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
je 0x1055c85
push esi
push edi
push dword [ebp - 0x768]
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x764], 1
call fcn.010644d9
mov ecx, eax
call fcn.010645a9
push eax
call fcn.01065fef
test eax, eax
jle 0x1055c85
push 0x1007b44
call fcn.01060d46
test eax, eax
mov byte [ebp - 0x75d], 1
jne 0x1055c8c
mov byte [ebp - 0x75d], 0
test byte [ebp - 0x764], 1
je 0x1055ca0
lea ecx, [ebp - 0x794]
call fcn.01064519
cmp byte [ebp - 0x75d], 0
je 0x1055cf4
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f54e
push 0
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x770]
call fcn.01064ae7
push 1
push dword [eax]
call fcn.010cf353
cmp dword [ebp - 0x770], 0
je 0x1055cf4
cmp dword [ebp - 0x770], 0x1111298
je 0x1055cf4
push dword [ebp - 0x770]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edi, dword [ebp - 0x768]
pop ecx
jmp 0x1055eee
push edi
call fcn.010615ae
test eax, eax
je 0x1055e81
mov eax, dword [0x1113528]
push dword [eax + 0x10]
call fcn.0104239d
test eax, eax
je 0x1055e81
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1055d64
push esi
push eax
push edi
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 0x764], 2
call fcn.010644d9
mov ecx, eax
call fcn.010645a9
push eax
call fcn.01065fef
test eax, eax
mov byte [ebp - 0x75d], 1
jg 0x1055d6b
mov byte [ebp - 0x75d], 0
test byte [ebp - 0x764], 2
je 0x1055d7f
lea ecx, [ebp - 0x7a0]
call fcn.01064519
cmp byte [ebp - 0x75d], 0
je 0x1055eee
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f54e
xor esi, esi
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x764], esi
call fcn.010d7131
push 0xa1eb
lea ecx, [ebp - 0x75c]
call fcn.010d5ef6
push 0xa1f4
lea ecx, [ebp - 0x75c]
call fcn.010d5f3c
push 0xa1fd
lea ecx, [ebp - 0x75c]
call fcn.010d5fea
push esi
lea eax, [ebp - 0x764]
push eax
push dword [ebx + 0x5c]
lea ecx, [ebp - 0x75c]
call fcn.010d815c
test eax, eax
je 0x1055e74
mov eax, dword [ebp - 0x764]
mov ecx, dword [eax]
lea edx, [ebp - 0x768]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x768]
mov ecx, dword [eax]
lea edx, [ebp - 0x76c]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jl 0x1055e68
cmp dword [ebp - 0x76c], esi
jne 0x1055e68
mov esi, dword [0x1113528]
push 0
push edi
call fcn.010615f3
push eax
lea ecx, [ebp - 0x7b8]
call fcn.010644d9
mov ecx, eax
call fcn.01064572
push eax
push dword [ebx + 0x5c]
mov ecx, esi
push dword [ebp - 0x764]
call fcn.0105237b
lea ecx, [ebp - 0x7b8]
call fcn.01064519
mov eax, dword [ebp - 0x764]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x75c]
call fcn.010d7262
jmp 0x1055eee
push edi
call fcn.01061619
test eax, eax
je 0x1055eee
mov eax, dword [0x1113528]
push dword [eax + 0x10]
call fcn.0104239d
test eax, eax
je 0x1055eee
mov eax, dword [0x1113528]
push edi
mov esi, eax
mov dword [ebp - 0x768], eax
call fcn.0106165e
push eax
lea ecx, [ebp - 0x7ac]
call fcn.010644d9
mov ecx, eax
call fcn.01064572
push eax
push dword [esi + 0x10]
mov ecx, esi
call fcn.0104b05e
push eax
call fcn.0103db46
lea ecx, [ebp - 0x7ac]
call fcn.01064519
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f54e
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x778]
push dword [ebp - 0x774]
push dword [ebp + 8]
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 4]
call fcn.0105eca9
pop edi
pop esi
pop ebx
leave
ret 0xc
xor esi, esi
push esi
push 0x4e20
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0103f307
mov eax, dword [ebx + 0xac]
cmp dword [eax + 0x1c], esi
jle 0x1055f71
push 0xa22f
lea ecx, [ebp - 0x9bc]
call fcn.0103d18c
lea eax, [ebp - 0x9bc]
push eax
push esi
push 0x10030
push 0x9f0a
mov ecx, ebx
call fcn.0104b05e
push eax
call fcn.01062c09
call fcn.01035cba
cmp eax, esi
je 0x1055f86
cmp dword [eax + 0x24], esi
je 0x1055f86
mov ecx, ebx
call fcn.01050799
mov ecx, ebx
call fcn.0104d4cd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1055f0d
mov esi, 0x1f4
sub edi, esi
je 0x105603e
dec edi
je 0x1056026
dec edi
dec edi
je 0x1055ffd
dec edi
je 0x1055fdc
dec edi
jne case.0x10563ac.1131
lea eax, [ebx + 0xa4]
mov esi, dword [eax]
and dword [eax], 0
push 0x1f9
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push esi
mov ecx, ebx
call fcn.0105260f
jmp case.0x10563ac.1131
push 0x1f8
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x104f9b2
push 1
push 0xd7
push 0xa1c5
jmp 0x105601c
push 0x1f7
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push fcn.01054526
push 1
push 0xd7
push 0xa1c6
call fcn.01055971
jmp case.0x10563ac.1131
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0103e8de
jmp case.0x10563ac.1131
lea eax, [ebx + 0x3b8]
cmp word [eax], dx
je 0x1056050
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebx + 0xe8]
mov eax, dword [esi]
test eax, eax
je case.0x10563ac.1131
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
jmp case.0x10563ac.1131
push 0x100886c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp case.0x10563ac.1131
call fcn.010b9c75
jmp case.0x10563ac.1131
call fcn.010768cf
jmp case.0x10563ac.1131
cmp dword [ebx + 0x5dc], edx
je case.0x10563ac.1131
call fcn.010663e2
test eax, eax
je 0x10560bf
test byte [ebx + 0x5dc], 2
je case.0x10563ac.1131
xor edi, edi
cmp dword [ebx + 0x60], edi
jne 0x105621d
call fcn.010d8663
test eax, eax
jne 0x105621d
mov eax, dword [ebx + 0x5dc]
test al, 2
je 0x105610a
push eax
lea esi, [ebx + 0x5d8]
push dword [esi]
mov ecx, ebx
mov dword [ebx + 0x60], 1
call fcn.01053258
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], edi
mov dword [ebx + 0x60], edi
jmp case.0x10563ac.1131
push dword [ebx + 0x5d8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0104bc80
cmp eax, edi
jl 0x10561c1
lea eax, [ebp - 0x20c]
push eax
call fcn.0106b8d1
cmp eax, edi
jl 0x10561c1
call fcn.0106b053
cmp eax, 0xf
ja 0x10561c1
call fcn.0106aed8
mov esi, eax
cmp esi, edi
jl 0x105615e
mov dword [ebp - 0x768], 1
jmp 0x10561bd
mov dword [ebp - 0x768], edi
call fcn.0106afc1
mov esi, eax
cmp esi, edi
jl 0x1056176
call fcn.0106b31c
jmp 0x10561bd
push edi
call fcn.0106ade0
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x764], edi
call fcn.0106b833
cmp eax, edi
jl 0x10561c1
mov ecx, dword [ebp - 0x764]
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x764]
cmp ecx, edi
mov esi, eax
je 0x10561bd
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, edi
jge 0x10561c9
push edi
call fcn.0106ade0
jmp 0x10561d5
cmp dword [ebp - 0x768], edi
je case.0x10563ac.1131
call fcn.010e37c0
test eax, eax
je case.0x10563ac.1131
mov eax, dword [0x1113528]
or dword [eax + 0x5dc], 8
push fcn.01054526
push edi
push 0xd7
push 0xa1c6
call fcn.01055971
mov eax, dword [ebx + 0x24]
cmp eax, edi
je case.0x10563ac.1131
push 1
lea ecx, [eax + 0x44]
call fcn.010417a5
jmp case.0x10563ac.1131
mov dword [ebx + 0x5d4], 1
jmp case.0x10563ac.1131
sub ecx, 0x42f
je 0x1056357
dec ecx
dec ecx
je 0x10562ea
dec ecx
dec ecx
je 0x10562b6
sub ecx, 9
je 0x1056266
sub ecx, 0xa
jne case.0x10563ac.1131
push esi
push edi
mov ecx, ebx
call fcn.010529d4
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp case.0x10563ac.1131
dec esi
je 0x10562a6
dec esi
je 0x1056295
dec esi
je 0x1056284
dec esi
dec esi
je 0x105627a
xor eax, eax
jmp 0x1055f0d
call fcn.010bf7c3
jmp 0x1055f0d
mov eax, dword [0x1114798]
cmp eax, edx
je 0x1056273
mov eax, dword [eax + 0x10]
jmp 0x1055f0d
mov eax, dword [0x11147d8]
cmp eax, edx
je 0x1056273
mov eax, dword [eax + 0x1c]
jmp 0x1055f0d
mov eax, dword [0x1114818]
cmp eax, edx
je 0x1056273
mov eax, dword [eax]
jmp 0x1055f0d
call fcn.010d8663
test eax, eax
jne case.0x10563ac.1131
lea eax, [ebx + 0x5d4]
xor ecx, ecx
cmp dword [eax], ecx
je case.0x10563ac.1131
push ecx
push ecx
push 0x42e
push dword [ebx + 0x5c]
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x10563ac.1131
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
push 0
push 0x24
push 0x9f5a
mov ecx, ebx
mov word [ebp - 0x788], 0xb
call fcn.0104b05e
push eax
call fcn.01062c09
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebx + 0x10]
setne cl
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x788]
push 3
push eax
dec ecx
mov word [ebp - 0x780], cx
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x98]
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp case.0x10563ac.1131
push 5
mov ecx, ebx
call fcn.01054948
jmp case.0x10563ac.1131
mov eax, dword [ebx + 0x24]
cmp eax, edx
je 0x10564e3
push 0
push 0xa00c
push 0x111
push dword [eax + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x10563ac.1131
mov eax, 0x472
cmp ecx, eax
ja 0x10564a3
je 0x105648b
lea eax, [ecx - 0x465]
cmp eax, 9
ja case.0x10563ac.1131
jmp dword [eax*4 + 0x1056500]
push edi
mov ecx, ebx
call fcn.01050bcb
jmp case.0x10563ac.1131
push esi
push edi
mov ecx, ebx
call fcn.0104cdad
jmp case.0x10563ac.1131
push 1
push dword [esi + 4]
mov ecx, ebx
push dword [esi]
push edi
call fcn.010551b2
push 1
mov ecx, esi
call fcn.01049d01
jmp case.0x10563ac.1131
push esi
push edi
mov ecx, ebx
call fcn.01050b50
jmp case.0x10563ac.1131
push dword [esi + 4]
mov ecx, ebx
push 0
push dword [esi]
push edi
call fcn.0105348b
push 1
mov ecx, esi
call fcn.0104bcb9
jmp case.0x10563ac.1131
push 1
push esi
push 0
push edi
mov ecx, ebx
call fcn.0105348b
test esi, esi
je case.0x10563ac.1131
push 1
mov ecx, esi
call fcn.0104bce2
jmp case.0x10563ac.1131
push dword [edi + 0xc]
mov ecx, ebx
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call fcn.0105237b
push 1
mov ecx, edi
call fcn.0104bd08
jmp case.0x10563ac.1131
cmp dword [edi + 0xa4], edx
jne case.0x10563ac.1131
lea ecx, [edi + 0x5c]
call fcn.010bddca
jmp case.0x10563ac.1131
cmp dword [edi + 0xa0], edx
jne case.0x10563ac.1131
lea ecx, [edi + 0x5c]
call fcn.010bdded
jmp case.0x10563ac.1131
push 0
push 0
push esi
push edi
mov ecx, ebx
call fcn.0104b05e
push eax
call fcn.01062c09
jmp case.0x10563ac.1131
cmp ecx, 0xd01
jne case.0x10563ac.1131
cmp edi, edx
jne 0x10564ef
push 0
push 0x4e20
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0103f307
call fcn.01035cba
test eax, eax
je 0x10564e3
cmp dword [eax + 0x24], 0
je 0x10564e3
mov ecx, ebx
call fcn.01050799
mov ecx, ebx
call fcn.0104d4cd
jmp case.0x10563ac.1131
cmp edi, 1
jne case.0x10563ac.1131
push 9
pop eax
jmp 0x1055f0d