Function at 0x1000f733
Capabilities:
Delete file

Disassembly:
mov eax, 0x10058248
call fcn.100579d8
sub esp, 0xbc
push ebx
push esi
mov dword [ebp - 0x34], 0x68bc
mov esi, edx
push edi
mov eax, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x34], 0x692a
mov dword [ebp - 0x40], eax
jle 0x1000f7ca
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x2c], 0x6214
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
or eax, edi
mov ecx, 0x1006f958
or eax, esi
cdq
push edx
push eax
call fcn.10009584
mov eax, dword [ebp - 0x28]
add eax, ebx
dec dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jne 0x1000f77b
inc ebx
push 0
mov dword [ebp - 0x18], ebx
cmp ebx, 0x13d3
pop ebx
jl 0x1000f76c
inc edi
cmp edi, 0x560e
jl 0x1000f769
inc esi
cmp esi, 0x59a
jl 0x1000f767
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x1c]
cmp byte [ebp + 0x10], 0
je 0x1000f85e
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x14]
call fcn.10009699
lea ecx, [ebp - 0x74]
call fcn.1000df63
add esp, 0x18
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x74], eax
je 0x1000f857
push dword [ebp - 0x44]
xor ecx, ecx
mov dword [ebp - 0x78], 7
push eax
push dword [ebp - 0x74]
mov word [ebp - 0x8c], cx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x7c], ebx
call fcn.100119e8
lea edx, [ebp - 0x8c]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.1000f190
lea ecx, [ebp - 0x8c]
push ebx
push 1
test eax, eax
jns 0x1000f852
mov eax, dword [ebp + 0x1c]
mov byte [eax], 1
call fcn.10009ca4
lea ecx, [ebp - 0x74]
call fcn.10011367
jmp 0x1000fbf4
call fcn.10009ca4
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
jmp 0x1000f845
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], 0x5d78
cmp dword [ebp - 0x34], 0x5e1f
mov dword [ebp - 0x58], str.sfs_wgjlpq_nbadea
jle 0x1000f8e0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x1c]
sar ebx, cl
mov eax, ebx
mov ecx, 0x1006f958
or eax, esi
cdq
push edx
push eax
call fcn.10009584
inc esi
cmp esi, 0xf21
jl 0x1000f8a8
mov esi, dword [ebp - 0x18]
inc edi
push 0
pop ebx
cmp edi, 0x63cb
jl 0x1000f89c
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1114
jl 0x1000f89a
mov edi, dword [ebp + 0x20]
cmp dword [edi + 0x10], ebx
je 0x1000fbbf
push 0x2e
pop eax
push 2
mov ecx, ebx
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], 0x5ba002f7
mov word [ebp - 0x30], ax
pop esi
mov dword [ebp - 0x3c], ecx
cmp esi, 2
jne 0x1000f911
push 3
pop ecx
push ecx
mov dword [ebp - 0x3c], ecx
pop esi
jmp 0x1000f951
movzx edx, byte [ebp + esi - 0x23]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x26]
movzx ecx, word [ebp + eax*2 - 0x30]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x24]
add ecx, edx
xor dl, dl
push ecx
push ecx
push 0x5e34
push ecx
mov word [ebp + eax*2 - 0x30], cx
push ecx
lea ecx, [ebp - 0x3c]
call fcn.1000e0e4
mov ecx, dword [ebp - 0x3c]
add esp, 0x14
add esi, 2
cmp esi, 5
jb 0x1000f902
xor eax, eax
mov dword [ebp - 0xa8], 7
mov word [ebp - 0x2e], ax
lea ecx, [ebp - 0xbc]
mov word [ebp - 0xbc], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0xac], ebx
call fcn.10009b82
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 3
push eax
mov edx, edi
lea ecx, [ebp - 0x54]
call fcn.1000cfc7
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.10009ca4
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x54]
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x30], ebx
test eax, eax
jne 0x1000fb9d
push 0x2d
pop eax
push 2
mov ecx, ebx
mov byte [ebp - 0x14], bl
mov word [ebp - 0x13], 0x19d
mov byte [ebp - 0x11], 0x90
mov word [ebp - 0x38], ax
pop esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], esi
cmp esi, 4
jae 0x1000fb12
movzx eax, byte [ebp - 0x14]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x1000fad0
movzx eax, byte [ebp + esi - 0x14]
mov dword [ebp - 0x40], eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], 0x5d76
cmp dword [ebp - 0x2c], 0x6060
jle 0x1000fa74
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x1c]
shl ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1006f958
cdq
push edx
push eax
call fcn.10009584
inc esi
cmp esi, 0x6560
jl 0x1000fa37
mov esi, dword [ebp - 0x18]
inc edi
push 0
pop ebx
cmp edi, 0x30f8
jl 0x1000fa2b
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2b71
jl 0x1000fa29
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp - 0x40]
dec eax
mov byte [ebp - 4], 6
add esi, eax
cmp dword [ebp - 0x2c], 0x5c51
mov dword [ebp - 0x1c], esi
jge 0x1000fa99
mov edx, str.nfqd_aeksv_prlhfq_olngkee_zprdo_lmbo_ihjirv_aoag_fsjplrx_cics_symcewet
mov ecx, 0x1006f958
call fcn.1000b719
mov dword [ebp - 4], 5
jmp 0x1000fb07
movzx edx, byte [ebp + esi - 0x13]
mov eax, esi
sub eax, ecx
push 1
movzx eax, byte [ebp + eax - 0x16]
movzx eax, word [ebp + eax*2 - 0x38]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x397a
sub ecx, eax
movzx eax, byte [ebp + esi - 0x14]
mov word [ebp + eax*2 - 0x38], cx
lea eax, [ebp - 0x48]
push eax
call fcn.1000dd4e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
add esi, 2
jmp 0x1000f9e0
xor eax, eax
mov dword [ebp - 0x90], 7
mov word [ebp - 0x36], ax
lea ecx, [ebp - 0xa4]
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x94], ebx
call fcn.10009b82
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 8
push eax
mov edx, edi
lea ecx, [ebp - 0xc8]
call fcn.1000cfc7
pop ecx
mov esi, eax
lea eax, [ebp - 0x54]
cmp eax, esi
je 0x1000fb80
mov ecx, eax
call fcn.100111ef
mov ecx, dword [esi]
mov dword [ebp - 0x54], ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x4c], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [ebp - 0xc8]
call fcn.100111ef
push ebx
push 1
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 5
call fcn.10009ca4
lea eax, [ebp - 0x54]
mov ecx, 0x4fe8
push eax
push 0x1e1c
push ebx
lea edx, [ebp - 0x64]
call fcn.1000f48a
add esp, 0xc
lea ecx, [ebp - 0x54]
call fcn.100111ef
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x34], 0x5bdd
jge 0x1000fbd9
mov edx, dword [ebp - 0x58]
mov ecx, 0x1006f958
call fcn.1000b719
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x44]
push eax
call fcn.10010e06
lea ecx, [ebp - 0x64]
call fcn.100112c7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret