Function at 0x1003548e
Capabilities:
Delete file

Disassembly:
push 0x4c
mov eax, 0x1017d8ba
call fcn.10145d80
mov esi, ecx
mov dword [ebp - 0x2c], esi
lea eax, [esi + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [eax]
xor edi, edi
cmp dword [eax - 8], edi
je 0x10035a4b
push 0x101f7e50
push 0x101f7e4c
lea eax, [ebp - 0x1c]
push eax
call fcn.100100f8
mov eax, dword [0x101f3028]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10032013
add esp, 0xc
cmp eax, edi
je 0x10035a3b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.10005f82
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.10126a79
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x10035a24
cmp eax, edi
jl 0x10035a24
mov dword [ebp - 0x10], edi
push str.space
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10005f82
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.10126e0f
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 0xc
push dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 4
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x100359fe
cmp dword [ebp - 0x24], edi
jl 0x100359fe
mov edi, 0x101a3668
push edi
lea ecx, [ebp - 0x28]
call fcn.10005f82
mov eax, dword [eax]
add esi, 0x20
push esi
push eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10127155
add esp, 0xc
push dword [ebp - 0x28]
movzx eax, al
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 4
call ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x1003569a
mov dword [ebp - 0x24], eax
push str.activate
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.10005f82
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.10126e0f
add esp, 0xc
push dword [ebp - 0x38]
mov esi, eax
mov byte [ebp - 4], 7
call ebx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x1003564c
test esi, esi
jl 0x1003564c
push edi
lea ecx, [ebp - 0x38]
call fcn.10005f82
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax]
add ecx, 0x1c
push ecx
push eax
push dword [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.10127155
add esp, 0xc
push dword [ebp - 0x38]
movzx esi, al
call ebx
mov eax, dword [ebp - 0x24]
test eax, eax
mov byte [ebp - 4], 4
je 0x10035628
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 3
je 0x10035639
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
mov byte [ebp - 4], 2
je 0x1003567e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1003567e
test eax, eax
mov byte [ebp - 4], 4
je 0x1003565a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 3
je 0x1003566b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
mov byte [ebp - 4], 2
je 0x1003567c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
push dword [ebp - 0x20]
call ebx
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
mov eax, esi
jmp 0x10035a4d
mov ecx, dword [esi]
cmp dword [ecx - 8], eax
je 0x100356db
push 0x2f
mov ecx, esi
call fcn.1002a041
cmp eax, 0xffffffff
je 0x100356db
mov ecx, dword [esi]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.10011776
mov ecx, dword [ebp - 0x2c]
push eax
add ecx, 0x24
mov byte [ebp - 4], 0xa
call fcn.10007845
lea ecx, [ebp - 0x28]
call fcn.10003b75
push 0
call fcn.10146fd5
mov word [ebp - 0x48], 3
mov dword [ebp - 0x40], eax
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], esi
mov dword [esp], str.time
call fcn.10005f82
mov ecx, dword [esi]
mov eax, dword [eax]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x28]
mov byte [ebp - 4], 0xc
movsd dword es:[edi], dword [esi]
call dword [ecx + 0xb4]
push dword [ebp - 0x24]
mov esi, eax
call ebx
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jl 0x100357eb
mov eax, dword [0x101f3028]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push dword [ebp - 0x38]
mov byte [ebp - 4], 0xd
call fcn.10007ade
call fcn.100320e4
pop ecx
pop ecx
push 0x78
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10023bc2
push dword [ebp - 0x24]
and word [ebp - 0x48], 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xe
call fcn.10014b08
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 0xf
movsd dword es:[edi], dword [esi]
call dword [ecx + pe_nt_image_headers32]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0xe
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jl 0x100357d7
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.100739c5
pop ecx
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x24]
call fcn.10003b75
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10003b75
push 0x101a3668
lea ecx, [ebp - 0x28]
call fcn.10005f82
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax]
add ecx, 0x20
push ecx
push eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 0x10
call fcn.10127155
add esp, 0xc
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call ebx
push str.writeurl
lea ecx, [ebp - 0x28]
call fcn.10005f82
mov esi, dword [ebp - 0x2c]
mov eax, dword [eax]
lea ecx, [esi + 0x2c]
push ecx
push eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 0x11
call fcn.10127155
add esp, 0xc
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
call ebx
lea eax, [esi + 0x54]
push eax
lea eax, [esi + 0x44]
push eax
push dword [ebp - 0x14]
call fcn.10034eb3
add esp, 0xc
push 0x101f7e54
push 0x101f7e4c
lea eax, [ebp - 0x2c]
push eax
call fcn.100100f8
lea edi, [esi + 0x28]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x12
call fcn.10007845
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.10003b75
mov eax, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
xor edi, edi
push edi
push eax
call fcn.10032013
add esp, 0xc
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.10005f82
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x28]
mov byte [ebp - 4], 0x14
call fcn.10126a79
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
cmp ecx, edi
je 0x100359d0
cmp eax, 1
je 0x100359d0
lea eax, [esi + 0x30]
push eax
add esi, 0x64
push esi
push ecx
call fcn.10034c9f
mov eax, dword [0x101f3028]
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push dword [ebp - 0x38]
mov byte [ebp - 4], 0x15
call fcn.10007ade
call fcn.10032218
pop ecx
pop ecx
push 0x78
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10023bc2
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x16
mov word [ebp - 0x48], di
call fcn.10014b08
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 4], 0x17
movsd dword es:[edi], dword [esi]
call dword [ecx + pe_nt_image_headers32]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0x16
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
jl 0x1003596e
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.100739c5
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x30]
call fcn.10003b75
lea ecx, [ebp - 0x2c]
call fcn.10003b75
mov eax, dword [ebp - 0x34]
test eax, eax
mov byte [ebp - 4], 0x13
je 0x1003598f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x28]
call ebx
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 3
je 0x100359a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
mov byte [ebp - 4], 2
je 0x100359b6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x20]
call ebx
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
xor eax, eax
inc eax
jmp 0x10035a4d
cmp ecx, edi
mov byte [ebp - 4], 0x13
je 0x100359de
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [ebp - 0x28]
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, edi
mov byte [ebp - 4], 3
je 0x100359f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, edi
jmp 0x10035670
cmp eax, edi
mov byte [ebp - 4], 3
je 0x10035a0c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, edi
mov byte [ebp - 4], 2
je 0x10035a1d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x20]
call ebx
jmp 0x10035a3b
cmp ecx, edi
mov byte [ebp - 4], 2
je 0x10035a32
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret