Function at 0x64607b06
Capabilities:
Delete file
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x3d4], eax
lea edi, [ebp - 0x3f4]
xor eax, eax
mov dword [ebp - 0x3b8], esi
mov dword [ebp - 0x3c8], eax
mov ebx, eax
mov dword [ebp - 0x3cc], eax
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c0], edi
mov dword [ebp - 0x3e8], 0x14
mov dword [ebp - 0x3e4], edi
mov dword [ebp - 0x3e0], edi
mov dword [ebp - 0x3dc], edi
mov dword [ebp - 0x3d8], edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607bc8
test dword [eax + 0x1c], 0x200
je 0x64607bc8
cmp byte [eax + 0x19], 4
jb 0x64607bc8
push dword [eax + 0x14]
mov edx, 0x64601f74
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.64604453
mov ecx, dword [ebp - 0x3bc]
push edi
push edi
push dword [ecx]
push edi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
mov dword [ebp - 0x3d0], edi
test edi, edi
jne 0x64607c2e
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607c24
test dword [eax + 0x1c], 0x200
je 0x64607c24
cmp byte [eax + 0x19], 2
jb 0x64607c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x646016a0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
mov edx, 0x64601f74
pop ecx
call fcn.64604495
mov ebx, 0x2cfb
jmp 0x6460820f
push 0x40
lea eax, [ebp - 0x14c]
push eax
push 0x2d17
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x354]
mov dword [ebp - 0x3e4], eax
call fcn.6460615d
test eax, eax
je 0x64607c24
lea eax, [ebp - 0x354]
mov dword [ebp - 0x3dc], 0x646016b4
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x3e8]
push eax
push edi
call dword [sym.imp.GDI32.dll_StartDocW]
test eax, eax
jg 0x64607cc8
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607c24
test dword [eax + 0x1c], 0x200
je 0x64607c24
cmp byte [eax + 0x19], 2
jb 0x64607c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x646016bc
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
jmp 0x64607c19
test esi, esi
je 0x64607cfa
mov esi, dword [esi]
xor eax, eax
push eax
push eax
push eax
mov ecx, dword [esi + 0x14]
push eax
push dword [ebp - 0x3b8]
call dword [0x64618384]
call dword [esi + 0x14]
test eax, eax
jns 0x64607cf4
mov ebx, 0x2cf2
jmp 0x6460820f
mov esi, dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [eax + 8], ecx
jne 0x64607e63
mov edx, dword [ebp - 0x3c4]
test edx, edx
je 0x64607e63
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x3b8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607d24
sub ecx, dword [ebp - 0x3b8]
sar ecx, 1
je 0x64607e5b
mov ecx, edx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607d46
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x80]
mov ecx, eax
mov dword [ebp - 0x3b8], eax
call fcn.6460cdc3
mov dword [ebp - 0x3c0], eax
test eax, eax
jne 0x64607d81
mov ebx, 0x2cfd
jmp 0x6460820f
push 0x40
lea eax, [ebp - 0xcc]
push eax
push 0x2cff
push dword [0x64617400]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x64607df5
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607dde
test dword [eax + 0x1c], 0x200
je 0x64607dde
cmp byte [eax + 0x19], 2
jb 0x64607dde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f74
push 0x646016d0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
pop ecx
call fcn.64604495
push 0x646016e8
lea eax, [ebp - 0xcc]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x3c4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x3b8]
push dword [ebp - 0x3c0]
call fcn.64605bb2
mov ecx, eax
add esp, 0x10
test ecx, ecx
jns 0x64607e5b
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607e51
test dword [eax + 0x1c], 0x200
je 0x64607e51
cmp byte [eax + 0x19], 2
jb 0x64607e51
push ecx
push 0x646016f0
push dword [eax + 0x14]
mov edx, 0x64601f74
push dword [eax + 0x10]
push 0x2d
pop ecx
call fcn.64604495
mov ebx, 0x2cfe
jmp 0x6460820f
mov eax, dword [ebp - 0x3bc]
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
je 0x64608184
test esi, esi
je 0x64607e87
lea eax, [ebp - 0x3cc]
push eax
push ecx
push esi
call dword [sym.imp.MAPI32.dll_Ordinal_185]
test eax, eax
js 0x64607cea
xor eax, eax
push eax
push dword [0x64617404]
push eax
push eax
push eax
push eax
push eax
push eax
push 4
push 0x646012ec
push 0x64601710
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp - 0x3b8], esi
test esi, esi
jne 0x64607efa
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64607c24
test dword [eax + 0x1c], 0x200
je 0x64607c24
cmp byte [eax + 0x19], 2
jb 0x64607c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
push 0x64601728
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
jmp 0x64607c19
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x64608005
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c8]
jne 0x64607f0d
sub ecx, edx
sar ecx, 1
je 0x64608005
push dword [ebp - 0x3c0]
xor eax, eax
push eax
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x3b4]
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0x3bc]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3b4], 0x5c
mov dword [ebp - 0x3b0], 0xa800000f
cmp dword [edx + 0x28], 0x2bc
movzx eax, byte [edx + 0x2e]
setge cl
neg eax
push 0x1f
sbb eax, eax
and eax, 8
or ecx, eax
movzx eax, byte [edx + 0x2d]
neg eax
sbb eax, eax
and eax, 4
or ecx, eax
movzx eax, byte [edx + 0x2c]
neg eax
sbb eax, eax
and eax, 2
or ecx, eax
mov eax, dword [edx + 0x18]
cdq
xor eax, edx
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp - 0x3bc]
sub eax, edx
imul eax, eax, 0x14
mov dword [ebp - 0x3a8], eax
mov al, byte [ecx + 0x2f]
mov byte [ebp - 0x39c], al
mov al, byte [ecx + 0x33]
mov byte [ebp - 0x39b], al
lea eax, [ecx + 0x34]
push eax
lea eax, [ebp - 0x39a]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
lea eax, [ebp - 0x3b4]
push eax
push 4
push 0x444
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3cc]
test eax, eax
je 0x64608037
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x3f4]
push eax
push 0xc002
push 0x449
push esi
mov dword [ebp - 0x3ec], 0x64606b60
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x40
push eax
lea eax, [ebp - 0x4c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x1f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x646080fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6460809f
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64608095
test dword [eax + 0x1c], 0x200
je 0x64608095
cmp byte [eax + 0x19], 5
jb 0x64608095
push dword [eax + 0x14]
mov edx, 0x64601f74
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.64604453
mov ebx, 0x2d03
jmp 0x6460820f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x64608174
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6460820f
test dword [ecx + 0x1c], 0x200
je 0x6460820f
cmp byte [ecx + 0x19], 2
jb 0x6460820f
push ebx
push 0x64601748
push dword [ecx + 0x14]
mov edx, 0x64601f74
push dword [ecx + 0x10]
push 0x30
pop ecx
call fcn.64604495
jmp 0x6460820f
lea esi, [ebp - 0x4c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x64608105
sub esi, ecx
sar esi, 1
cmp esi, 0x1e
jae 0x6460816e
mov dword [ebp - 0x3c4], edx
lea edi, [ebp - 0x4c]
test esi, esi
je 0x64608158
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x64608144
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswcntrl]
pop ecx
test eax, eax
je 0x64608168
mov eax, dword [ebp - 0x3c4]
add edi, 2
inc eax
mov dword [ebp - 0x3c4], eax
cmp eax, esi
jb 0x64608126
mov edi, dword [ebp - 0x3d0]
mov ebx, 0x2d03
jmp 0x6460820f
mov edi, dword [ebp - 0x3d0]
mov esi, dword [ebp - 0x3b8]
push edi
push esi
call fcn.6460628d
test eax, eax
jne 0x64608198
jmp 0x64607c24
push eax
push dword [ebp - 0x3c0]
push esi
push edi
call fcn.646064d6
mov ebx, eax
test ebx, ebx
jne 0x6460820f
push edi
push ecx
mov ecx, dword [ebp - 0x3bc]
mov ecx, dword [ecx]
call fcn.6460d56c
test eax, eax
jle 0x6460820f
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x6460820f
xor ebx, ebx
mov edi, ebx
cmp word [ebp - 0x354], bx
je 0x6460820f
lea ecx, [ebp - 0x354]
call fcn.6460e639
mov ecx, eax
mov eax, dword [ebp - 0x3d4]
mov dword [eax], ecx
test ecx, ecx
je 0x64607d77
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6460820f
test dword [eax + 0x1c], 0x200
je 0x6460820f
cmp byte [eax + 0x19], 5
jb 0x6460820f
push ecx
push dword [eax + 0x14]
mov edx, 0x64601f74
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.64605f31
mov ecx, dword [ebp - 0x3cc]
test ecx, ecx
je 0x64608229
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x64618384]
call esi
test edi, edi
je 0x64608234
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x3c0]
call fcn.6460ce29
test ebx, ebx
je 0x646082af
lea ecx, [ebp - 0x354]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x6460824e
sub ecx, edx
sar ecx, 1
je 0x646082af
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x646082af
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646082af
test dword [eax + 0x1c], 0x200
je 0x646082af
cmp byte [eax + 0x19], 2
jb 0x646082af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64601f74
push 0x64601668
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.64604495
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615e30
leave
ret 0x14