Function at 0x1002b627
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov ebx, edx
lea eax, [esp + 0xc]
xor edx, edx
xor esi, esi
and dword [esp + 0x18], edx
and dword [esp + 0xc], edx
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
push eax
lea edx, [esp + 0x20]
mov dword [esp + 0x10], edi
call fcn.10030a2b
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + 0x10]
mov ecx, eax
and ecx, 0x400
mov dword [esp + 0x14], ecx
je 0x1002b67d
test byte [esp + 0x10], 0x80
jne 0x1002b67d
xor eax, eax
jmp 0x1002bbf1
and eax, 0x4000
mov dword [esp + 0x20], eax
je 0x1002b692
test dword [esp + 0x10], 0x20000
je 0x1002b676
test byte [ebx + 0x30], 2
jne 0x1002bb4c
cmp dword [ebx + 0x10], 0xffffffff
je 0x1002b6d1
lea eax, [esp + 0x30]
mov ecx, edi
push eax
push 1
add edx, 0x14
call fcn.10030a0e
mov ecx, eax
call fcn.100336a9
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x1002b6c9
test byte [ecx + 0xf], 0x20
je 0x1002b6c9
inc eax
test eax, eax
jne 0x1002b734
mov ecx, dword [esp + 0x14]
test dword [esp + 0x1c], 0x1000000
je 0x1002b734
test ecx, ecx
jne 0x1002b734
xor eax, eax
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0xc]
mov edx, ebx
mov ecx, edi
call fcn.1004e71e
mov esi, eax
test esi, esi
jns 0x1002b70b
push esi
push 0xbc0
mov ecx, 0x10005f04
call fcn.1003a254
cmp esi, 0x80070020
je 0x1002b71f
cmp esi, 0x80070015
jne 0x1002bb3c
push 5
pop edx
lea ecx, [esp + 0x3c]
call fcn.100365e5
test eax, eax
jne 0x1002b6ec
jmp 0x1002bb3c
mov ecx, edi
call fcn.10030a0e
and dword [esp + 0x10], esi
cmp dword [ebx + 0x10], 0xffffffff
mov dword [esp + 0x28], eax
je 0x1002b963
mov edx, dword [ebx + 0xc]
lea edi, [esp + 0x3c]
and dword [esp + 0x24], esi
xor eax, eax
and dword [esp + 0x28], esi
add edx, 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 1
mov edi, ecx
call fcn.10030a0e
mov ecx, eax
call fcn.100336a9
mov dword [esp + 0x30], eax
test eax, eax
jne 0x1002b7bb
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x28]
push eax
mov ecx, edi
add edx, 0x14
call fcn.10030a0e
mov ecx, eax
call fcn.10043195
mov dword [esp + 0x24], eax
test eax, eax
jne 0x1002b7bb
push 0x80070714
push 0xacc
mov ecx, 0x10005f04
call fcn.1003a254
jmp 0x1002b90b
test dword [ebx + 0x30], 0x20000000
lea ecx, [ebx + 0x10]
je 0x1002b7d5
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0x1002b590
jmp 0x1002b7e3
mov eax, dword [ecx]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x10029250
mov eax, dword [ebx + 0xc]
push 2
pop edx
test dword [eax + 0x10], 0x800
je 0x1002b8aa
mov word [esp + 0xc], dx
lea eax, [esp + 0x2c]
xor edx, edx
push edx
push eax
push edx
push edx
push 2
lea eax, [esp + 0x20]
mov dword [esp + 0x40], edx
push eax
push 0x9c040
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1002b8aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x301
je 0x1002b8a4
cmp esi, 0x32
je 0x1002b8a4
cmp esi, 1
jne 0x1002b864
push 0xb02
push 0x10005f04
push 0x80070001
push 0x10005f28
push dword [ebx + 0x14]
mov edx, edi
push 2
pop ecx
call fcn.1002fae3
xor esi, esi
jmp 0x1002b8aa
test esi, esi
jle 0x1002b873
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1002b885
push esi
push 0xb0c
mov ecx, 0x10005f04
call fcn.1003a254
push 0xb0d
push 0x10005f04
push esi
push 0x10005f8c
push dword [ebx + 0x14]
xor ecx, ecx
mov edx, edi
inc ecx
call fcn.1002fae3
jmp 0x1002b8a6
xor esi, esi
test esi, esi
js 0x1002b90b
test dword [esp + 0x1c], 0x2000
je 0x1002b8c5
push dword [ebx + 0x14]
mov edx, dword [ebx + 0xc]
mov ecx, edi
call fcn.1004da41
test eax, eax
jne 0x1002b907
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1002b8d3
test byte [eax + 0xf], 0x20
jne 0x1002b907
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
push 1
push ecx
push dword [ebx + 0x14]
mov ecx, edi
push dword [esp + 0x30]
push dword [esp + 0x38]
push eax
call fcn.1004d271
mov esi, eax
test esi, esi
jns 0x1002b95a
push esi
push 0xb2a
mov ecx, 0x10005f04
call fcn.1003a254
test esi, esi
jns 0x1002b95a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002b91f
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002b938
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002b93f
movzx esi, si
or esi, 0x80070000
jmp 0x1002b93d
mov esi, 0x80004005
test esi, esi
jns 0x1002bb44
push esi
push 0xb3d
mov ecx, 0x10005f04
call fcn.1003a254
jmp 0x1002bb3c
or dword [ebx + 0x30], 2
jmp 0x1002bb3c
cmp dword [esp + 0x14], esi
jne 0x1002b96f
cmp dword [esp + 0x20], esi
je 0x1002b9c2
call fcn.100371cd
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1002b9cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002b990
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002b9a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002b9b0
movzx esi, si
or esi, 0x80070000
jmp 0x1002b9ae
mov esi, 0x80004005
test esi, esi
jns 0x1002b9c2
push esi
push 0xb53
mov ecx, 0x10005f04
call fcn.1003a254
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 8]
jmp 0x1002bab2
mov eax, dword [ebx + 0xc]
and dword [esp + 0x2c], esi
add eax, 0x14
mov ecx, eax
mov dword [esp + 0x30], eax
call fcn.1001a44c
test eax, eax
jne 0x1002ba12
lea eax, [esp + 0x10]
mov ecx, edi
push eax
push 1
call fcn.10030a0e
mov edx, dword [esp + 0x38]
mov ecx, eax
call fcn.100336a9
mov ecx, eax
test ecx, ecx
jne 0x1002ba16
mov esi, 0x80070714
push esi
push 0xb69
jmp 0x1002ba91
mov ecx, dword [esp + 0x2c]
and dword [esp + 0x30], esi
and dword [esp + 0x34], esi
test ecx, ecx
je 0x1002ba2f
call fcn.1001ff52
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x18]
lea eax, [ebx + 0x10]
push ecx
push eax
neg ecx
lea eax, [esp + 0x38]
sbb ecx, ecx
and ecx, eax
push ecx
push ecx
push 0x4a200100
push edx
mov ecx, edi
call fcn.10022bee
test eax, eax
jne 0x1002ba9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002ba69
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002ba82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002ba89
movzx esi, si
or esi, 0x80070000
jmp 0x1002ba87
mov esi, 0x80004005
test esi, esi
jns 0x1002ba9b
push esi
push 0xb86
mov ecx, 0x10005f04
call fcn.1003a254
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002bab0
cmp dword [esp + 0x28], eax
je 0x1002bab0
test edi, edi
je 0x1002bab0
mov dword [edi + 4], eax
xor ecx, ecx
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x1002babd
mov eax, dword [ebx + 0x14]
push 1
lea edx, [ebx + 0x10]
push edx
mov edx, dword [ebx + 0xc]
push ecx
push eax
add edx, 0x14
mov ecx, edi
call fcn.1004d0c3
test eax, eax
je 0x1002badc
or dword [ebx + 0x30], 3
jmp 0x1002bb22
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002baf0
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002bb09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002bb10
movzx esi, si
or esi, 0x80070000
jmp 0x1002bb0e
mov esi, 0x80004005
test esi, esi
jns 0x1002bb22
push esi
push 0xba9
mov ecx, 0x10005f04
call fcn.1003a254
mov ecx, edi
call fcn.10030a0e
mov ecx, dword [esp + 0x28]
cmp ecx, eax
je 0x1002bb3c
test edi, edi
je 0x1002bb3c
test ecx, ecx
je 0x1002bb3c
mov dword [edi + 4], ecx
test esi, esi
js 0x1002bbd0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp dword [ebp + 8], 0
je 0x1002bbd0
test eax, eax
je 0x1002bb74
push dword [ebx + 0xc]
lea edx, [ebx + 0x10]
mov ecx, edi
push dword [ebx + 0x14]
call fcn.1004f2f7
mov esi, eax
test esi, esi
jns 0x1002bba2
push esi
push 0xbd4
jmp 0x1002bb94
test ecx, ecx
je 0x1002bb9e
push dword [ebx + 0xc]
lea edx, [ebx + 0x10]
mov ecx, edi
push dword [ebx + 0x14]
call fcn.1004ee01
mov esi, eax
test esi, esi
jns 0x1002bba2
push esi
push 0xbe0
mov ecx, 0x10005f04
call fcn.1003a254
test esi, esi
js 0x1002bbd0
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + 0x4c], 0
je 0x1002bbd0
mov edx, dword [ebx + 0x14]
lea eax, [ebx + 0x10]
push eax
push ecx
mov ecx, edi
call fcn.1004ebf6
mov esi, eax
test esi, esi
jns 0x1002bbd0
push esi
push 0xbee
mov ecx, 0x10005f04
call fcn.1003a254
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1002bbef
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4