Function at 0x1055a11
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9bc
mov eax, dword [0x111121c]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, 0x464
cmp ecx, eax
mov dword [ebp - 0x774], edi
mov dword [ebp - 0x778], esi
mov dword [ebp - 0x764], edx
ja 0x10562ea
je 0x10562c5
add eax, 0xffffffca
cmp ecx, eax
ja 0x105618c
je 0x1055ffd
sub ecx, 0x15
je 0x1055ff3
dec ecx
je 0x1055fe9
sub ecx, 4
je 0x1055fd8
sub ecx, 0xf9
je 0x1055ef8
sub ecx, 0x319
je 0x1055e7c
dec ecx
jne case.0x105630c.1131
xor eax, eax
push eax
lea edi, [ebx + 0x40]
mov esi, 0x1007600
push esi
mov ecx, edi
mov dword [ebp - 0x768], eax
mov dword [ebp - 0x76c], eax
call fcn.01063ebe
test eax, eax
jle 0x1055ad7
push esi
mov ecx, edi
mov dword [ebp - 0x76c], 1
call fcn.01063e5e
mov ecx, dword [0x1113528]
xor eax, eax
xor esi, esi
cmp dword [ebp - 0x774], esi
setne al
add eax, 4
push eax
call fcn.010548a8
cmp eax, 0x81000315
je 0x1055b19
cmp dword [ebp - 0x774], esi
je 0x1055b0a
cmp dword [ebp - 0x76c], esi
je 0x1055b19
push 1
mov ecx, ebx
call fcn.0104c979
mov dword [ebp - 0x768], eax
call fcn.0106114b
cmp dword [ebp - 0x768], esi
jl case.0x105630c.1131
push 0x1048
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x768], edi
je case.0x105630c.1131
mov ecx, dword [0x1112f40]
mov esi, 0x824
push esi
push edi
call fcn.0103f3e2
test eax, eax
jl 0x1055e4e
cmp word [edi], 0
je 0x1055e4e
push 0x1007b4c
call fcn.01060ca6
test eax, eax
jne 0x1055b87
push eax
push eax
push eax
mov ecx, ebx
call fcn.0104afbe
push eax
call fcn.01055112
push edi
call fcn.010614c9
test eax, eax
je 0x1055c66
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
je 0x1055be5
push esi
push edi
push dword [ebp - 0x768]
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x764], 1
call fcn.01064439
mov ecx, eax
call fcn.01064509
push eax
call fcn.01065f4f
test eax, eax
jle 0x1055be5
push 0x1007b4c
call fcn.01060ca6
test eax, eax
mov byte [ebp - 0x75d], 1
jne 0x1055bec
mov byte [ebp - 0x75d], 0
test byte [ebp - 0x764], 1
je 0x1055c00
lea ecx, [ebp - 0x794]
call fcn.01064479
cmp byte [ebp - 0x75d], 0
je 0x1055c54
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f4ae
push 0
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x770]
call fcn.01064a47
push 1
push dword [eax]
call fcn.010cf2aa
cmp dword [ebp - 0x770], 0
je 0x1055c54
cmp dword [ebp - 0x770], 0x1111298
je 0x1055c54
push dword [ebp - 0x770]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edi, dword [ebp - 0x768]
pop ecx
jmp 0x1055e4e
push edi
call fcn.0106150e
test eax, eax
je 0x1055de1
mov eax, dword [0x1113528]
push dword [eax + 0x10]
call fcn.010422fd
test eax, eax
je 0x1055de1
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1055cc4
push esi
push eax
push edi
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 0x764], 2
call fcn.01064439
mov ecx, eax
call fcn.01064509
push eax
call fcn.01065f4f
test eax, eax
mov byte [ebp - 0x75d], 1
jg 0x1055ccb
mov byte [ebp - 0x75d], 0
test byte [ebp - 0x764], 2
je 0x1055cdf
lea ecx, [ebp - 0x7a0]
call fcn.01064479
cmp byte [ebp - 0x75d], 0
je 0x1055e4e
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f4ae
xor esi, esi
lea ecx, [ebp - 0x75c]
mov dword [ebp - 0x764], esi
call fcn.010d7088
push 0xa1eb
lea ecx, [ebp - 0x75c]
call fcn.010d5e4d
push 0xa1f4
lea ecx, [ebp - 0x75c]
call fcn.010d5e93
push 0xa1fd
lea ecx, [ebp - 0x75c]
call fcn.010d5f41
push esi
lea eax, [ebp - 0x764]
push eax
push dword [ebx + 0x5c]
lea ecx, [ebp - 0x75c]
call fcn.010d80b3
test eax, eax
je 0x1055dd4
mov eax, dword [ebp - 0x764]
mov ecx, dword [eax]
lea edx, [ebp - 0x768]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x768]
mov ecx, dword [eax]
lea edx, [ebp - 0x76c]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jl 0x1055dc8
cmp dword [ebp - 0x76c], esi
jne 0x1055dc8
mov esi, dword [0x1113528]
push 0
push edi
call fcn.01061553
push eax
lea ecx, [ebp - 0x7b8]
call fcn.01064439
mov ecx, eax
call fcn.010644d2
push eax
push dword [ebx + 0x5c]
mov ecx, esi
push dword [ebp - 0x764]
call fcn.010522db
lea ecx, [ebp - 0x7b8]
call fcn.01064479
mov eax, dword [ebp - 0x764]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x75c]
call fcn.010d71b9
jmp 0x1055e4e
push edi
call fcn.01061579
test eax, eax
je 0x1055e4e
mov eax, dword [0x1113528]
push dword [eax + 0x10]
call fcn.010422fd
test eax, eax
je 0x1055e4e
mov eax, dword [0x1113528]
push edi
mov esi, eax
mov dword [ebp - 0x768], eax
call fcn.010615be
push eax
lea ecx, [ebp - 0x7ac]
call fcn.01064439
mov ecx, eax
call fcn.010644d2
push eax
push dword [esi + 0x10]
mov ecx, esi
call fcn.0104afbe
push eax
call fcn.0103daa6
lea ecx, [ebp - 0x7ac]
call fcn.01064479
mov ecx, dword [0x1112f40]
push 0x1001bc8
call fcn.0103f4ae
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x778]
push dword [ebp - 0x774]
push dword [ebp + 8]
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 4]
call fcn.0105ec09
pop edi
pop esi
pop ebx
leave
ret 0xc
xor esi, esi
push esi
push 0x4e20
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0103f267
mov eax, dword [ebx + 0xac]
cmp dword [eax + 0x1c], esi
jle 0x1055ed1
push 0xa22f
lea ecx, [ebp - 0x9bc]
call fcn.0103d0ec
lea eax, [ebp - 0x9bc]
push eax
push esi
push 0x10030
push 0x9f0a
mov ecx, ebx
call fcn.0104afbe
push eax
call fcn.01062b69
call fcn.01035c1a
cmp eax, esi
je 0x1055ee6
cmp dword [eax + 0x24], esi
je 0x1055ee6
mov ecx, ebx
call fcn.010506f9
mov ecx, ebx
call fcn.0104d42d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1055e6d
mov esi, 0x1f4
sub edi, esi
je 0x1055f9e
dec edi
je 0x1055f86
dec edi
dec edi
je 0x1055f5d
dec edi
je 0x1055f3c
dec edi
jne case.0x105630c.1131
lea eax, [ebx + 0xa4]
mov esi, dword [eax]
and dword [eax], 0
push 0x1f9
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push esi
mov ecx, ebx
call fcn.0105256f
jmp case.0x105630c.1131
push 0x1f8
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x104f912
push 1
push 0xd7
push 0xa1c5
jmp 0x1055f7c
push 0x1f7
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
push fcn.01054486
push 1
push 0xd7
push 0xa1c6
call fcn.010558d1
jmp case.0x105630c.1131
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0103e83e
jmp case.0x105630c.1131
lea eax, [ebx + 0x3b8]
cmp word [eax], dx
je 0x1055fb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_KillTimer]
lea esi, [ebx + 0xe8]
mov eax, dword [esi]
test eax, eax
je case.0x105630c.1131
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
jmp case.0x105630c.1131
push 0x100885c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp case.0x105630c.1131
call fcn.010b9bcc
jmp case.0x105630c.1131
call fcn.0107682f
jmp case.0x105630c.1131
cmp dword [ebx + 0x5dc], edx
je case.0x105630c.1131
call fcn.01066342
test eax, eax
je 0x105601f
test byte [ebx + 0x5dc], 2
je case.0x105630c.1131
xor edi, edi
cmp dword [ebx + 0x60], edi
jne 0x105617d
call fcn.010d85ba
test eax, eax
jne 0x105617d
mov eax, dword [ebx + 0x5dc]
test al, 2
je 0x105606a
push eax
lea esi, [ebx + 0x5d8]
push dword [esi]
mov ecx, ebx
mov dword [ebx + 0x60], 1
call fcn.010531b8
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], edi
mov dword [ebx + 0x60], edi
jmp case.0x105630c.1131
push dword [ebx + 0x5d8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0104bbe0
cmp eax, edi
jl 0x1056121
lea eax, [ebp - 0x20c]
push eax
call fcn.0106b831
cmp eax, edi
jl 0x1056121
call fcn.0106afb3
cmp eax, 0xf
ja 0x1056121
call fcn.0106ae38
mov esi, eax
cmp esi, edi
jl 0x10560be
mov dword [ebp - 0x768], 1
jmp 0x105611d
mov dword [ebp - 0x768], edi
call fcn.0106af21
mov esi, eax
cmp esi, edi
jl 0x10560d6
call fcn.0106b27c
jmp 0x105611d
push edi
call fcn.0106ad40
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x764], edi
call fcn.0106b793
cmp eax, edi
jl 0x1056121
mov ecx, dword [ebp - 0x764]
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x764]
cmp ecx, edi
mov esi, eax
je 0x105611d
mov eax, dword [ecx]
push 1
call dword [eax]
cmp esi, edi
jge 0x1056129
push edi
call fcn.0106ad40
jmp 0x1056135
cmp dword [ebp - 0x768], edi
je case.0x105630c.1131
call fcn.010e3717
test eax, eax
je case.0x105630c.1131
mov eax, dword [0x1113528]
or dword [eax + 0x5dc], 8
push fcn.01054486
push edi
push 0xd7
push 0xa1c6
call fcn.010558d1
mov eax, dword [ebx + 0x24]
cmp eax, edi
je case.0x105630c.1131
push 1
lea ecx, [eax + 0x44]
call fcn.01041705
jmp case.0x105630c.1131
mov dword [ebx + 0x5d4], 1
jmp case.0x105630c.1131
sub ecx, 0x42f
je 0x10562b7
dec ecx
dec ecx
je 0x105624a
dec ecx
dec ecx
je 0x1056216
sub ecx, 9
je 0x10561c6
sub ecx, 0xa
jne case.0x105630c.1131
push esi
push edi
mov ecx, ebx
call fcn.01052934
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp case.0x105630c.1131
dec esi
je 0x1056206
dec esi
je 0x10561f5
dec esi
je 0x10561e4
dec esi
dec esi
je 0x10561da
xor eax, eax
jmp 0x1055e6d
call fcn.010bf71a
jmp 0x1055e6d
mov eax, dword [0x1114798]
cmp eax, edx
je 0x10561d3
mov eax, dword [eax + 0x10]
jmp 0x1055e6d
mov eax, dword [0x11147d8]
cmp eax, edx
je 0x10561d3
mov eax, dword [eax + 0x1c]
jmp 0x1055e6d
mov eax, dword [0x1114818]
cmp eax, edx
je 0x10561d3
mov eax, dword [eax]
jmp 0x1055e6d
call fcn.010d85ba
test eax, eax
jne case.0x105630c.1131
lea eax, [ebx + 0x5d4]
xor ecx, ecx
cmp dword [eax], ecx
je case.0x105630c.1131
push ecx
push ecx
push 0x42e
push dword [ebx + 0x5c]
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x105630c.1131
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
push 0
push 0x24
push 0x9f5a
mov ecx, ebx
mov word [ebp - 0x788], 0xb
call fcn.0104afbe
push eax
call fcn.01062b69
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebx + 0x10]
setne cl
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x788]
push 3
push eax
dec ecx
mov word [ebp - 0x780], cx
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x98]
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp case.0x105630c.1131
push 5
mov ecx, ebx
call fcn.010548a8
jmp case.0x105630c.1131
mov eax, dword [ebx + 0x24]
cmp eax, edx
je 0x1056443
push 0
push 0xa00c
push 0x111
push dword [eax + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x105630c.1131
mov eax, 0x472
cmp ecx, eax
ja 0x1056403
je 0x10563eb
lea eax, [ecx - 0x465]
cmp eax, 9
ja case.0x105630c.1131
jmp dword [eax*4 + 0x1056460]
push edi
mov ecx, ebx
call fcn.01050b2b
jmp case.0x105630c.1131
push esi
push edi
mov ecx, ebx
call fcn.0104cd0d
jmp case.0x105630c.1131
push 1
push dword [esi + 4]
mov ecx, ebx
push dword [esi]
push edi
call fcn.01055112
push 1
mov ecx, esi
call fcn.01049c61
jmp case.0x105630c.1131
push esi
push edi
mov ecx, ebx
call fcn.01050ab0
jmp case.0x105630c.1131
push dword [esi + 4]
mov ecx, ebx
push 0
push dword [esi]
push edi
call fcn.010533eb
push 1
mov ecx, esi
call fcn.0104bc19
jmp case.0x105630c.1131
push 1
push esi
push 0
push edi
mov ecx, ebx
call fcn.010533eb
test esi, esi
je case.0x105630c.1131
push 1
mov ecx, esi
call fcn.0104bc42
jmp case.0x105630c.1131
push dword [edi + 0xc]
mov ecx, ebx
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call fcn.010522db
push 1
mov ecx, edi
call fcn.0104bc68
jmp case.0x105630c.1131
cmp dword [edi + 0xa4], edx
jne case.0x105630c.1131
lea ecx, [edi + 0x5c]
call fcn.010bdd21
jmp case.0x105630c.1131
cmp dword [edi + 0xa0], edx
jne case.0x105630c.1131
lea ecx, [edi + 0x5c]
call fcn.010bdd44
jmp case.0x105630c.1131
push 0
push 0
push esi
push edi
mov ecx, ebx
call fcn.0104afbe
push eax
call fcn.01062b69
jmp case.0x105630c.1131
cmp ecx, 0xd01
jne case.0x105630c.1131
cmp edi, edx
jne 0x105644f
push 0
push 0x4e20
push 0x1f5
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0103f267
call fcn.01035c1a
test eax, eax
je 0x1056443
cmp dword [eax + 0x24], 0
je 0x1056443
mov ecx, ebx
call fcn.010506f9
mov ecx, ebx
call fcn.0104d42d
jmp case.0x105630c.1131
cmp edi, 1
jne case.0x105630c.1131
push 9
pop eax
jmp 0x1055e6d