Function at 0x10131b19
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1026f32d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10a4
call fcn.1026ac00
mov eax, dword [0x10285008]
xor eax, esp
mov dword [esp + 0x10a0], eax
push ebx
push esi
push edi
mov eax, dword [0x10285008]
xor eax, esp
push eax
lea eax, [esp + 0x10b8]
mov dword fs:[0], eax
mov ebx, edx
mov dword [esp + 0x10], ebx
mov esi, ecx
lea ecx, [esp + 0x24]
call fcn.100d4b2d
xor eax, eax
mov dword [esp + 0x10c0], eax
lea ecx, [esp + 0x13c]
call fcn.100d4dd0
mov byte [esp + 0x10c0], 1
mov ecx, ebx
call fcn.10214aa4
mov edi, eax
test edi, edi
je 0x10131bb2
mov ecx, edi
call fcn.10210755
push eax
push 0x1007c584
call fcn.100d3aab
jmp 0x10131e66
push 0x1007c5b8
call fcn.100d3aca
pop ecx
test esi, esi
jne 0x10131c26
mov esi, dword [0x102c7ff4]
xor ecx, ecx
mov ebx, ecx
add esi, 0xc40
cmp dword [esi], ecx
je 0x10131c11
cmp dword [esi - 0xc], 2
jb 0x10131be0
mov eax, dword [esi - 0x14]
jmp 0x10131be2
mov eax, ecx
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x30]
call fcn.100d4bf2
mov edi, eax
test edi, edi
jne 0x10131e4e
cmp dword [esp + 0x2c], 1
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x24]
call fcn.10131ab5
test eax, eax
je 0x10131c1c
xor ecx, ecx
inc ebx
add esi, 0x58
cmp ebx, 2
jb 0x10131bd1
jmp 0x10131c31
mov edi, 0x8000ffff
jmp 0x10131e4e
mov ecx, esi
call fcn.10131ab5
test eax, eax
je 0x10131c1c
test dword [ebp + 8], 0x40000000
je 0x10131e4e
mov eax, dword [0x102c7ff8]
mov eax, dword [eax + 0xa8]
test eax, eax
je 0x10131c71
push 0x104
lea ecx, [esp + 0xfa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10131c71
lea ecx, [esp + 0xfa4]
call fcn.10131ab5
mov eax, dword [0x102c7ff8]
mov esi, dword [eax + 0xc]
jmp 0x10131e46
cmp dword [esi + 0x2c8], 4
jb 0x10131cca
xor ebx, ebx
cmp dword [esi + 0x2c8], 2
jb 0x10131c9a
mov eax, dword [esi + 0x2c0]
jmp 0x10131c9c
mov eax, ebx
push ebx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x30]
call fcn.100d4bf2
mov edi, eax
test edi, edi
jne 0x10131d6c
cmp dword [esp + 0x2c], 1
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x24]
call fcn.10131ab5
jmp 0x10131d6c
test dword [ebp + 8], 0x10000000
je 0x10131d6a
push 0x1ff
push dword [esi + 0xc]
lea ecx, [esi + 0x1c]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi]
call fcn.101780fc
test eax, eax
je 0x10131d6a
xor ebx, ebx
cmp dword [esi + 0x120], 2
jb 0x10131d06
mov edx, dword [esi + 0x118]
jmp 0x10131d08
mov edx, ebx
mov ecx, dword [0x102c7ff8]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push 1
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x18]
call fcn.10167300
test eax, eax
jne 0x10131d6c
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x144], 2
sbb eax, eax
not eax
and eax, dword [esp + 0x13c]
jmp 0x10131c9c
xor ebx, ebx
lea eax, [esp + 0x2e4]
mov dword [esp + 0x2e4], 0xcc0
push eax
push dword [esi + 0x14]
mov eax, dword [0x102c7ff8]
push dword [esi + 0x10]
push dword [eax + 0x50]
call dword [sym.imp.dbghelp.dll_SymGetModuleInfoW64]
test eax, eax
je 0x10131e43
cmp word [esp + 0x548], 0
je 0x10131e0c
lea ecx, [esp + 0x548]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10131db0
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x10131e0c
lea eax, [esp + 0x540]
lea eax, [eax + ecx*2]
push 0x10066c14
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10131e0c
push ebx
push 0xffffffffffffffff
lea eax, [esp + 0x550]
push eax
lea ecx, [esp + 0x30]
call fcn.100d4bf2
mov edi, eax
test edi, edi
jne 0x10131e0c
cmp dword [esp + 0x2c], 1
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x24]
call fcn.10131ab5
cmp word [esp + 0x748], 0
je 0x10131e43
push ebx
push 0xffffffffffffffff
lea eax, [esp + 0x750]
push eax
lea ecx, [esp + 0x30]
call fcn.100d4bf2
mov edi, eax
test edi, edi
jne 0x10131e43
cmp dword [esp + 0x2c], 1
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x24]
call fcn.10131ab5
mov esi, dword [esi + 4]
test esi, esi
jne 0x10131c7e
call fcn.10214c97
mov esi, dword [esp + 0x10]
push esi
test edi, edi
jne 0x10131e6a
push 0x1007c6c0
call fcn.100d3a67
pop ecx
pop ecx
jmp 0x10131e7d
push 0x1007c6d8
call fcn.100d3aab
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [esp + 0x10c0], 0
lea ecx, [esp + 0x13c]
call fcn.100b5ef7
or dword [esp + 0x10c0], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.100b5ef7
mov eax, edi
mov ecx, dword [esp + 0x10b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, esp
call fcn.10236010
mov esp, ebp
pop ebp
ret 4