Function at 0x10023127
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
jmp 0x10023144
mov eax, dword [ebp - 0x30]
add eax, 0x5e
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
add eax, 0x29dc
cmp dword [ebp - 0x30], eax
ja 0x100237ed
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x65ff
ja 0x10023218
cmp dword [ebp - 0x64], 0x65ff
je 0x10023420
cmp dword [ebp - 0x64], 0x63cb
ja 0x100231d8
cmp dword [ebp - 0x64], 0x63cb
je 0x100233b3
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
sub dword [ebp - 0x68], 0x578f
je 0x10023384
sub dword [ebp - 0x68], 0x5e
je 0x100233c9
sub dword [ebp - 0x68], 0x5e
je 0x10023340
sub dword [ebp - 0x68], 0x5e
je 0x10023430
sub dword [ebp - 0x68], 0x5e
je 0x100232ef
sub dword [ebp - 0x68], 0xa66
je 0x100232b0
jmp 0x100237e8
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
sub dword [ebp - 0x6c], 0x6429
je 0x100237c0
sub dword [ebp - 0x6c], 0x5e
je 0x100232c6
sub dword [ebp - 0x6c], 0x5e
je 0x1002336e
sub dword [ebp - 0x6c], 0x5e
je 0x10023401
sub dword [ebp - 0x6c], 0x5e
je 0x10023426
jmp 0x100237e8
cmp dword [ebp - 0x64], 0x6891
ja 0x10023278
cmp dword [ebp - 0x64], 0x6891
je 0x10023419
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x70], eax
sub dword [ebp - 0x70], 0x665d
je 0x100237e3
sub dword [ebp - 0x70], 0x5e
je 0x100232d2
sub dword [ebp - 0x70], 0x5e
je 0x10023314
sub dword [ebp - 0x70], 0x5e
je 0x100232e6
sub dword [ebp - 0x70], 0x5e
je 0x1002379b
sub dword [ebp - 0x70], 0x5e
je 0x100237b0
jmp 0x100237e8
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x74], eax
sub dword [ebp - 0x74], 0x68ef
je 0x100237d2
sub dword [ebp - 0x74], 0x5e
je 0x100237da
sub dword [ebp - 0x74], 0x5e
je 0x10023334
sub dword [ebp - 0x74], 0x5e
je 0x100232fb
sub dword [ebp - 0x74], 0x5e
je 0x1002330b
jmp 0x100237e8
push ecx
cmp dword [ecx + 4], 0
mov dword [esp], ecx
je 0x100232d2
cmp dword [ecx + 8], 2
je 0x10023334
push esi
jmp 0x100237e8
mov dword [ebp], 0
jmp 0x100237e8
push eax
push ecx
call fcn.10024ecf
test eax, eax
je 0x10023373
jmp 0x100237e8
sub esi, eax
add edi, eax
jmp 0x100237e8
mov dword [ebp - 0x30], 0x5907
jmp 0x100237e8
mov ebx, ds
rcr dword gs:[ebp + 0x59], 0xc2
adc al, 0
xor al, al
jmp 0x100237e8
pop ecx
ret 0x14
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
cmp dword [eax + 4], 0x1400002e
jne 0x10023430
movzx eax, word [esp + 0x18]
add dword [ebp], eax
jmp 0x100237e8
ret 0x14
push 0x65
pop eax
mov word [ebp - 0x18], ax
mov dword [ebp - 0x16], 0x33006c
mov dword [ebp - 0x12], 0x2e0032
mov dword [ebp - 0xe], 0x6c0064
push 0x6c
pop eax
mov word [ebp - 0xa], ax
inc ebp
div byte [ebx]
shl byte [esi - 0x77], 0x45
clc
jmp 0x100237e8
outsb dx, byte [esi]
wait
or eax, 0x96eb2449
mov ecx, dword [esp + 0x10]
cmp esi, 0xffff
jmp 0x100237e8
jmp 0x1002330b
push 0x4d
pop eax
mov word [ebp - 0x2c], ax
push 0x6f
pop eax
mov word [ebp - 0x2b], ax
push 0x76
pop eax
mov word [ebp - 0x2a], ax
push 0x65
pop eax
mov word [ebp - 0x29], ax
push 0x46
pop eax
mov word [ebp - 0x28], ax
push 0x69
pop eax
mov word [ebp - 0x27], ax
jmp 0x100237e8
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x100232e6
mov edi, dword [esp + 0x14]
jmp 0x100237e8
push 0x6c
pop eax
mov word [ebp - 0x26], ax
push 0x65
pop eax
mov word [ebp - 0x25], ax
mov eax, 0x7845
mov word [ebp - 0x24], ax
push 0x41
pop eax
mov word [ebp - 0x22], ax
push 0x6b
pop eax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], 0x720065
push 0x6e
pop eax
mov word [ebp - 0x1a], ax
jmp 0x100237e8
mov dword [esp + 0x18], 0
mov eax, 0xffff
ja 0x10023420
movzx eax, si
push edi
jmp 0x100237e8
mov bl, 1
jmp 0x100237e8
push eax
jmp 0x100237e8
push eax
lea eax, [esp + 0x20]
jmp 0x100237e8
lea eax, [ebp - 0x20]
push eax
push 0x505d
lea eax, [ebp - 0x2c]
push eax
call fcn.10036ab6
add esp, 0xc
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.1003770f
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10037700
push eax
lea ecx, [ebp - 0x34]
call fcn.1003771d
movzx eax, al
test eax, eax
je 0x10023799
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x34]
call fcn.1003762a
mov eax, dword [eax + 4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov al, byte [eax]
mov byte [ebp - 0x7d], al
mov ecx, dword [ebp - 0x78]
cmp al, byte [ecx]
jne 0x100234cb
cmp byte [ebp - 0x7d], 0
je 0x100234c2
mov eax, dword [ebp - 0x7c]
mov al, byte [eax + 1]
mov byte [ebp - 0x7e], al
mov ecx, dword [ebp - 0x78]
cmp al, byte [ecx + 1]
jne 0x100234cb
add dword [ebp - 0x7c], 2
add dword [ebp - 0x78], 2
cmp byte [ebp - 0x7e], 0
jne 0x1002348e
and dword [ebp - 0x84], 0
jmp 0x100234d6
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x1002378c
mov dword [ebp - 0x3c], 0x5ee8
jmp 0x10023501
mov eax, dword [ebp - 0x3c]
add eax, 0x21
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x5f6c
ja 0x1002378c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
sub dword [ebp - 0x90], 0x5ee8
je 0x1002357e
sub dword [ebp - 0x90], 0x21
je 0x1002372b
sub dword [ebp - 0x90], 0x21
je 0x1002376a
sub dword [ebp - 0x90], 0x21
je 0x10023564
sub dword [ebp - 0x90], 0x21
je 0x10023782
jmp 0x10023787
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10037865
jmp 0x10023787
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x94]
mov al, byte [eax]
mov byte [ebp - 0x99], al
inc dword [ebp - 0x94]
cmp byte [ebp - 0x99], 0
jne 0x10023597
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa4]
mov al, byte [eax]
mov byte [ebp - 0xa9], al
inc dword [ebp - 0xa4]
cmp byte [ebp - 0xa9], 0
jne 0x100235dc
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa0]
lea eax, [ecx + eax + 1]
push eax
call fcn.1000361d
pop ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xb4]
mov al, byte [eax]
mov byte [ebp - 0xbd], al
mov eax, dword [ebp - 0xb8]
mov cl, byte [ebp - 0xbd]
mov byte [eax], cl
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp byte [ebp - 0xbd], 0
jne 0x10023652
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc4]
mov al, byte [eax]
mov byte [ebp - 0xc9], al
inc dword [ebp - 0xc4]
cmp byte [ebp - 0xc9], 0
jne 0x100236a6
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov al, byte [eax + 1]
mov byte [ebp - 0xd9], al
inc dword [ebp - 0xd8]
cmp byte [ebp - 0xd9], 0
jne 0x100236eb
mov edi, dword [ebp - 0xd8]
mov esi, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd4]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10023787
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10023742
push 4
push 0
push dword [ebp - 0x38]
call dword [ebp - 4]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
call fcn.100351b3
pop ecx
and dword [ebp - 0x38], 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x5589
call fcn.100349db
add esp, 0xc
jmp 0x10023787
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0x5484
call fcn.10022882
add esp, 0xc
mov dword [ebp - 0x60], eax
jmp 0x10023787
jmp 0x100232ef
jmp 0x100234f8
lea ecx, [ebp - 0x34]
call fcn.10037582
jmp 0x1002345a
jmp 0x100237e8
test esi, esi
je 0x100232e6
cmp byte [esp + 0x24], 0
je 0x1002379b
mov cl, byte [esp + 0x28]
jmp 0x100237e8
mov byte [edi], cl
sub esi, 1
add edi, 1
add dword [ebp], 1
test esi, esi
jmp 0x100237e8
test edi, edi
je 0x10023401
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor bl, bl
jmp 0x100237e8
jne 0x100232d2
jmp 0x100237e8
pop ebp
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
jmp 0x100237e8
lea eax, [ecx + 4]
mov ecx, dword [ecx]
jmp 0x1002313b
pop edi
pop esi
pop ebx
leave
ret