Function at 0x691f00
Capabilities:
Delete file
Get file size
Get thread local storage value
Move file
Set file attributes
Timestomp file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x887e67
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
push edi
mov dword [0x9ddbd8], ebp
call esi
mov dword [0x9ddbe0], eax
mov eax, dword [esp + 0x164]
cmp eax, ebp
je 0x692ae1
cmp word [eax], bp
je 0x692ae1
mov edi, dword [esp + 0x168]
cmp edi, ebp
je 0x692ae1
cmp word [edi], bp
je 0x692ae1
cmp dword [0x9ddbe4], ebp
jne 0x691f85
mov dword [0x9ddbd8], 2
mov dword [0x9ddbdc], 0x1b67
jmp 0x692af5
push eax
call fcn.006a31f0
add esp, 4
mov dword [esp + 0x64], eax
test al, 0x10
je 0x691faf
mov dword [0x9ddbd8], 0x1d
mov dword [0x9ddbdc], 0x1b6f
jmp 0x692af5
push edi
call fcn.006a31f0
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x691fdd
test bl, 0x10
je 0x691fdd
mov dword [0x9ddbd8], 0x1e
mov dword [0x9ddbdc], 0x1b79
jmp 0x692af5
mov eax, dword [0x8ab26c]
mov esi, 1
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x15c], ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], ebp
mov dword [esp + 0x48], ebp
je 0x692028
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x28], esi
cmp eax, ebp
jne 0x69202c
mov dword [esp + 0x28], ebp
cmp ebx, 0xffffffff
jne 0x692035
mov dword [esp + 0x28], ebp
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x68]
test ecx, ecx
stosb byte es:[edi], al
jne 0x6920a5
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbd8], esi
mov dword [0x9ddbdc], 0x1a36
call edi
mov dword [0x9ddbe0], eax
mov dword [0x9ddbd8], 7
mov dword [0x9ddbdc], 0x1b97
call edi
lea ecx, [esp + 0x10]
mov dword [0x9ddbe0], eax
mov dword [esp + 0x15c], 0xffffffff
call fcn.00617ec0
mov eax, esi
jmp 0x692b01
mov eax, dword [0x992ee8]
mov edx, dword [0x992ee4]
mov ecx, dword [0x992eec]
mov esi, dword [0x9ddc10]
mov dword [esp + 0x6c], eax
mov eax, dword [0x9ddbf0]
mov dword [esp + 0xa0], eax
mov eax, dword [0x992870]
mov dword [esp + 0x68], edx
mov edx, dword [0x992ef0]
cmp eax, 0xffffffff
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edx
mov word [esp + 0x98], 0x40
mov dword [esp + 0x88], 0x40001
mov word [esp + 0x9a], 1
je 0x692114
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebp
je 0x692114
mov esi, eax
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0xd0]
mov dword [esp + 0xcc], ebp
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0x120]
mov dword [esp + 0x11c], ebp
mov dword [esp + 0x94], esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
call fcn.00636b60
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 1
call fcn.00636b60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 2
call fcn.00636b60
mov eax, dword [esp + 0x170]
mov byte [esp + 0x15c], 3
cmp eax, ebp
mov dword [esp + 0x50], ebp
je 0x6921a8
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.00697d10
add esp, 8
cmp eax, ebp
je 0x6921a8
lea ecx, [esp + 0x2c]
call fcn.00637450
mov dword [esp + 0x50], eax
mov esi, dword [esp + 0x164]
push esi
call fcn.0067c540
add esp, 4
cmp eax, ebp
jne 0x6926e7
mov ecx, dword [esp + 0x184]
mov eax, 5
cmp ecx, ebp
je 0x6921d5
mov eax, 7
push ebp
push 0x80
push 3
push ebp
push eax
push SysReAllocString
push esi
call fcn.006a4030
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [esp + 0x40], eax
je 0x692943
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push eax
call fcn.0068eda0
add esp, 0x20
test eax, eax
jne 0x692967
xor edx, edx
cmp ebx, 0xffffffff
setne dl
mov esi, edx
cmp esi, ebp
je 0x69230c
mov ecx, 8
lea edi, [esp + 0xac]
mov dword [esp + 0xa8], ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x168]
lea eax, [esp + 0xa8]
push eax
push ebp
push ecx
call fcn.006a3220
add esp, 0xc
test eax, eax
je 0x6922f3
cmp dword [esp + 0xc8], ebp
jne 0x692270
cmp dword [esp + 0xc4], ebp
je 0x6922f3
mov edx, dword [0x9de114]
mov edi, dword [esp + 0x168]
lea eax, [esp + 0x10]
push edx
push eax
push 0x992874
push edi
call fcn.006a3d00
add esp, 0x10
test eax, eax
je 0x6922d2
mov ecx, dword [esp + 0x10]
push 2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x6922b1
mov dword [esp + 0x18], 1
jmp 0x6922fa
mov dword [0x9ddbd8], 0x28
mov dword [0x9ddbdc], 0x1c14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x6922fa
mov dword [0x9ddbd8], 0x24
mov dword [0x9ddbdc], 0x1c1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x6922fa
mov edi, dword [esp + 0x168]
test bl, 1
je 0x692313
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x692313
mov edi, dword [esp + 0x168]
push ebp
push 0x80
push 4
push ebp
push ebp
push 0xc0000000
push edi
call fcn.006a4030
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
je 0x69297d
cmp esi, ebp
je 0x692348
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
cmp ecx, ebp
je 0x692350
mov dword [esp + 0x14], 1
cmp esi, ebp
mov ebx, 1
je 0x6924e4
mov ecx, dword [esp + 0x18]
or esi, 0xffffffff
or edi, 0xffffffff
cmp ecx, ebp
je 0x6923ce
mov edx, dword [esp + 0x10]
push ebp
push 0x80
push 4
push ebp
push 7
push SysReAllocString
push edx
call fcn.006a4030
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x6923d0
cmp dword [esp + 0x28], ebp
je 0x6923ca
lea eax, [esp + 0x38]
mov dword [esp + 0x38], ebp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebp
jne 0x6923af
cmp dword [esp + 0x38], ebp
je 0x6923c6
cmp dword [esp + 0x178], 1
jne 0x6923ca
push edi
call fcn.0067bd20
add esp, 4
test eax, eax
je 0x6923ca
mov dword [esp + 0x28], ebp
mov esi, edi
jmp 0x6923d0
mov esi, eax
cmp dword [esp + 0x16c], ebp
jne 0x6924d8
cmp esi, 0xffffffff
je 0x6924d8
lea ecx, [esp + 0x58]
call fcn.00636b60
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x5c]
push edx
lea ecx, [esp + 0x124]
push eax
lea edx, [esp + 0xd8]
push ecx
lea eax, [esp + 0x78]
push edx
push eax
push esi
mov byte [esp + 0x178], 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x68], ebp
call fcn.006983f0
add esp, 0x1c
test eax, eax
je 0x6924c7
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push ebp
push 1
push eax
lea edx, [esp + 0x7c]
push ecx
push edx
push esi
mov dword [esp + 0x64], ebp
call fcn.00697ab0
add esp, 0x20
test eax, eax
je 0x692463
xor ebx, ebx
cmp dword [esp + 0x50], ebp
jne 0x6924aa
test byte [esp + 0x8c], 8
je 0x6924aa
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x44]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push 1
push 3
push edx
lea ecx, [esp + 0x7c]
push eax
push ecx
push esi
mov dword [esp + 0x64], ebp
call fcn.00697ab0
add esp, 0x20
test eax, eax
je 0x6924aa
lea ecx, [esp + 0x2c]
call fcn.00637450
mov eax, dword [esp + 0x8c]
mov edx, dword [0x9ddbf0]
and al, 0x7f
mov dword [esp + 0xa0], edx
mov dword [esp + 0x8c], eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x15c], 3
call fcn.00636c90
cmp edi, 0xffffffff
je 0x6924e4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esp + 0x126], bp
jne 0x692993
push 0xffffffffffffffff
push pe_nt_image_headers32
lea ecx, [esp + 0x24]
call fcn.00636d40
lea ecx, [esp + 0x1c]
call fcn.00637470
mov ebp, eax
mov ecx, 0x44
mov esi, 0x9ddbe8
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x992870]
cmp eax, 0xffffffff
je 0x692533
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x692533
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x48]
push eax
call fcn.006a31d0
mov eax, dword [0x9ddbec]
mov cl, byte [0x9ddbf4]
mov edx, dword [0x9ddbf0]
mov dword [esp + 0xe8], eax
mov al, byte [0x9ddbf8]
add esp, 4
mov byte [esp + 0xe2], cl
mov dword [esp + 0xe8], edx
mov byte [esp + 0xe3], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov cx, ax
mov dword [esp + 0xfc], eax
test ebx, ebx
mov word [esp + 0xa4], cx
je 0x6925e0
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00636d30
push eax
lea ecx, [esp + 0x2c]
call fcn.00636d40
lea ecx, [esp + 0x24]
call fcn.00636d30
lea ecx, [esp + 0x1c]
mov ebx, eax
call fcn.00637470
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00637470
mov ecx, ebx
mov edi, eax
mov edx, ecx
lea eax, [esp + 0x78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.006a3260
add esp, 4
lea ecx, [esp + 0x60]
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x128]
push ecx
lea eax, [esp + 0xdc]
push edx
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x7c]
push eax
mov eax, dword [esp + 0x58]
push ecx
push edx
push eax
mov dword [esp + 0x84], 0
call fcn.00692b20
mov ecx, dword [esp + 0x84]
add esp, 0x24
test ecx, ecx
je 0x692641
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x692641
mov dword [esp + 0x14], 1
test eax, eax
je 0x6929b2
mov bl, byte [esp + 0x180]
test bl, 1
je 0x6926a5
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x3c]
push edx
xor edi, edi
push eax
push esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [esp + 0x30]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x6926af
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x30]
xor edi, edi
test bl, 4
je 0x6926c7
lea ecx, [esp + 0x48]
lea edx, [esp + 0x34]
push ecx
push edx
push esi
call fcn.006a3820
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x188], edi
je 0x6926de
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esp + 0x20], edi
jmp 0x6929c3
xor eax, eax
cmp ebx, 0xffffffff
setne al
cmp eax, ebp
mov ebx, 0x24
je 0x6927b9
mov ecx, 8
xor eax, eax
lea edi, [esp + 0xac]
mov dword [esp + 0xa8], ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x168]
lea eax, [esp + 0xa8]
push eax
push ebp
push edi
call fcn.006a3220
add esp, 0xc
test eax, eax
je 0x6927ad
cmp dword [esp + 0xc8], ebp
jne 0x692742
cmp dword [esp + 0xc4], ebp
je 0x6927ad
mov ecx, dword [0x9de114]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x992874
push edi
call fcn.006a3d00
add esp, 0x10
test eax, eax
je 0x692792
mov eax, dword [esp + 0x10]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x69277c
mov dword [esp + 0x18], 1
jmp 0x6927ad
mov dword [0x9ddbd8], 0x28
mov dword [0x9ddbdc], 0x1bc3
jmp 0x6927a2
mov dword [0x9ddbd8], ebx
mov dword [0x9ddbdc], 0x1bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
cmp dword [esp + 0x18], ebp
jne 0x6927c0
mov dword [esp + 0x14], ebp
jmp 0x6927c8
mov edi, dword [esp + 0x168]
mov dword [esp + 0x14], 1
test byte [esp + 0x180], 4
je 0x6927e5
lea ecx, [esp + 0x48]
lea edx, [esp + 0x34]
push ecx
push edx
push esi
call fcn.006a39f0
add esp, 0xc
mov eax, dword [esp + 0x188]
push eax
push 0xffffffffffffffff
push ebp
push edi
push esi
call fcn.00679970
add esp, 0x14
test eax, eax
je 0x692862
mov dword [esp + 0x20], ebp
mov ebx, dword [esp + 0x168]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x692820
mov ecx, dword [esp + 0x48]
push ecx
push eax
push ebx
call fcn.006a3aa0
add esp, 0xc
test byte [esp + 0x180], 2
je 0x692836
mov edx, dword [esp + 0x64]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6928da
mov eax, dword [esp + 0x28]
test eax, eax
je 0x692abc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x17c]
push 0x103
push eax
push ecx
jmp 0x6928d2
mov dword [0x9ddbd8], ebx
mov dword [0x9ddbdc], 0x1bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x692893
mov ecx, dword [esp + 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6928da
mov edx, dword [esp + 0x168]
mov eax, dword [esp + 0x10]
push 3
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x6928da
mov eax, dword [esp + 0x174]
mov dword [esp + 0x20], 0xffffffff
test eax, eax
je 0x6928da
mov ecx, dword [esp + 0x10]
push 0x103
push ecx
push eax
call fcn.005fc3ce
add esp, 0xc
mov eax, dword [esp + 0x34]
test eax, eax
je 0x6928f3
push eax
call fcn.008325dd
add esp, 4
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 2
call fcn.00636c90
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 1
call fcn.00636c90
lea ecx, [esp + 0x24]
mov byte [esp + 0x15c], 0
call fcn.00636c90
lea ecx, [esp + 0x10]
mov dword [esp + 0x15c], 0xffffffff
call fcn.00617ec0
mov eax, dword [esp + 0x20]
jmp 0x692b01
mov dword [0x9ddbd8], 3
mov dword [0x9ddbdc], 0x1bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
jmp 0x6928da
mov dword [0x9ddbd8], 0x2a
mov dword [0x9ddbdc], 0x1bfd
jmp 0x6929a7
mov dword [0x9ddbd8], 4
mov dword [0x9ddbdc], 0x1c31
jmp 0x6929a7
mov dword [0x9ddbd8], 1
mov dword [0x9ddbdc], 0x1c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbe0], eax
mov ecx, dword [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x30]
xor edi, edi
cmp ebp, 0xffffffff
je 0x6929cf
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], edi
jne 0x69287d
mov eax, dword [0x9de110]
test eax, eax
je 0x692802
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ddbd8], 0
call ebp
mov ebx, dword [esp + 0x168]
mov dword [0x9ddbe0], eax
push ebx
call fcn.005fc40b
add esp, 4
test eax, eax
je 0x692a9c
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x692a52
mov dword [0x9ddbd8], 3
mov dword [0x9ddbdc], 0x22ff
call ebp
mov dword [0x9ddbe0], eax
jmp 0x692809
lea edx, [esp + 0xcc]
push edx
push esi
call fcn.006959a0
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x692809
mov dword [0x9ddbd8], 0x1c
mov dword [0x9ddbdc], 0x1cca
call ebp
mov dword [0x9ddbe0], eax
mov dword [esp + 0x20], 0xffffffff
jmp 0x69287d
mov dword [0x9ddbd8], 1
mov dword [0x9ddbdc], 0x22f0
call ebp
mov dword [0x9ddbe0], eax
jmp 0x692809
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x6928da
mov eax, dword [esp + 0x10]
push eax
call fcn.006a3b20
add esp, 4
jmp 0x6928da
mov dword [0x9ddbd8], 1
mov dword [0x9ddbdc], 0x1b61
call esi
mov dword [0x9ddbe0], eax
mov eax, 1
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret