Function at 0x1000f4b0
Capabilities:
Clear file content
Delete file
Get file size
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017b9f6
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x19a0
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x192c], edi
push 0x60
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x1958], 0xffffffff
push 0
push eax
call fcn.10154a20
add esp, 0xc
mov dword [ebp - 0x1960], 0
push 0
call fcn.1015ba74
add esp, 4
mov dword [ebp - 0x190c], edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, esi
push eax
call fcn.101573d8
mov eax, dword [edi]
lea ecx, [ebp - 0x1990]
add esp, 4
mov dword [ebp - 0x1944], eax
push ecx
mov ecx, dword [eax + 0x434]
call fcn.1000ee20
mov esi, dword [ebp - 0x192c]
mov edi, eax
add esi, 0x14
cmp esi, edi
je 0x1000f5a9
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x1000f584
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10005c20
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1000f59c
mov eax, dword [esi]
jmp 0x1000f59e
mov eax, esi
push edi
mov ecx, esi
mov byte [eax], 0
call fcn.10005900
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x197c]
cmp eax, 0x10
jb 0x1000f5ce
inc eax
lea ecx, [ebp - 0x1990]
push eax
push dword [ebp - 0x1990]
call fcn.10005c20
push 0
lea eax, [ebp - 0x1920]
mov dword [ebp - 0x1920], 1
push eax
lea eax, [ebp - 0x1924]
mov dword [ebp - 0x191c], 0
push eax
mov dword [ebp - 0x1918], 0
mov dword [ebp - 0x1914], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
nop dword [eax]
mov eax, dword [ebp - 0x1944]
mov esi, dword [eax + 0x434]
mov eax, dword [esi + 0x184]
test eax, eax
je 0x1000f62f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x188]
call fcn.100085d0
mov ecx, dword [esi + 0x184]
mov edi, eax
mov dword [ebp - 0x1948], edi
test ecx, ecx
je 0x1000f653
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x1000f6b1
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f677
nop
mov edx, dword [esi + 0x20]
mov ecx, 0x101cf4ac
call fcn.10006a20
test eax, eax
je 0x1000f677
mov esi, dword [esi]
test esi, esi
jne 0x1000f660
mov edi, dword [edi + 8]
mov dword [ebp - 0x1934], edi
test edi, edi
je 0x1000f6b1
nop dword [eax]
nop dword [eax + eax]
mov edx, dword [edi + 0x20]
mov ecx, 0x101cf4d0
call fcn.10006a20
test eax, eax
je 0x1000f7c6
mov edi, dword [edi]
mov dword [ebp - 0x1934], edi
test edi, edi
jne 0x1000f690
xor edi, edi
mov dword [ebp - 0x1934], edi
mov byte [ebp - 0x1925], 0
test edi, edi
je 0x1000f6eb
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f6eb
nop dword [eax + eax]
mov edx, dword [esi + 0x20]
mov ecx, str.COUNT
call fcn.10006a20
test eax, eax
je 0x1000f816
mov esi, dword [esi]
test esi, esi
jne 0x1000f6d0
mov dword [ebp - 0x1938], 0xa
test edi, edi
je 0x1000f71b
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f71b
mov edx, dword [esi + 0x20]
mov ecx, 0x101cf4b0
call fcn.10006a20
test eax, eax
je 0x1000f82e
mov esi, dword [esi]
test esi, esi
jne 0x1000f700
mov dword [ebp - 0x194c], 5
test edi, edi
je 0x1000f74b
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f74b
mov edx, dword [esi + 0x20]
mov ecx, 0x101d33dc
call fcn.10006a20
test eax, eax
je 0x1000f846
mov esi, dword [esi]
test esi, esi
jne 0x1000f730
mov dword [ebp - 0x1954], 0x14
test edi, edi
je 0x1000f77b
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f77b
mov edx, dword [esi + 0x20]
mov ecx, str.DIFF
call fcn.10006a20
test eax, eax
je 0x1000f85e
mov esi, dword [esi]
test esi, esi
jne 0x1000f760
mov dword [ebp - 0x1950], 0x400
test edi, edi
je 0x1000f882
mov esi, dword [edi + 8]
mov dword [ebp - 0x193c], esi
test esi, esi
je 0x1000f932
nop
mov edx, dword [esi + 0x20]
mov ecx, str.EXCLUDE
call fcn.10006a20
test eax, eax
je 0x1000f876
mov esi, dword [esi]
mov dword [ebp - 0x193c], esi
test esi, esi
jne 0x1000f7a0
jmp 0x1000f932
cmp dword [edi + 0x20], 0
je 0x1000f6b1
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f6b9
nop dword [eax + eax]
mov edx, dword [esi + 0x20]
mov ecx, str.MODE
call fcn.10006a20
test eax, eax
je 0x1000f7fc
mov esi, dword [esi]
test esi, esi
jne 0x1000f7e0
jmp 0x1000f6b9
cmp dword [esi + 0x20], 0
je 0x1000f6b9
cmp byte [esi + 0xc], 2
sete byte [ebp - 0x1925]
jmp 0x1000f6c0
cmp dword [esi + 0x20], 0
je 0x1000f6eb
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1938], eax
jmp 0x1000f6f5
cmp dword [esi + 0x20], 0
je 0x1000f71b
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x194c], eax
jmp 0x1000f725
cmp dword [esi + 0x20], 0
je 0x1000f74b
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1954], eax
jmp 0x1000f755
cmp dword [esi + 0x20], 0
je 0x1000f77b
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1950], eax
jmp 0x1000f785
cmp dword [esi + 0x20], 0
je 0x1000f932
jmp 0x1000f88a
xor esi, esi
mov dword [ebp - 0x193c], esi
xor ecx, ecx
mov dword [ebp - 0x1930], ecx
test esi, esi
je 0x1000f932
mov eax, dword [esi + 8]
test eax, eax
je 0x1000f8ae
mov eax, dword [eax]
inc ecx
test eax, eax
jne 0x1000f8a1
mov dword [ebp - 0x1930], ecx
mov dword [ebp - 0x195c], 0
test ecx, ecx
jle 0x1000f932
mov eax, dword [ebp - 0x192c]
mov edi, dword [ebp - 0x195c]
add eax, 0x2c
mov dword [ebp - 0x1940], eax
test edi, edi
jns 0x1000f8d9
xor eax, eax
jmp 0x1000f8ed
mov eax, dword [esi + 8]
mov ecx, edi
test eax, eax
je 0x1000f8ed
test ecx, ecx
je 0x1000f8ed
mov eax, dword [eax]
dec ecx
test eax, eax
jne 0x1000f8e2
mov edx, dword [eax + 0x10]
cmp byte [edx], 0
jne 0x1000f8f9
xor ecx, ecx
jmp 0x1000f90f
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f900
sub ecx, esi
mov esi, dword [ebp - 0x193c]
push ecx
mov ecx, dword [ebp - 0x1940]
push edx
call fcn.100056d0
add dword [ebp - 0x1940], 0x18
inc edi
cmp edi, dword [ebp - 0x1930]
jl 0x1000f8d1
mov edi, dword [ebp - 0x1934]
test edi, edi
je 0x1000f957
mov esi, dword [edi + 8]
test esi, esi
je 0x1000f957
nop dword [eax]
mov edx, dword [esi + 0x20]
mov ecx, str.IDLE
call fcn.10006a20
test eax, eax
je 0x1000f985
mov esi, dword [esi]
test esi, esi
jne 0x1000f940
mov dword [ebp - 0x1930], 0xb7
mov ecx, dword [ebp - 0x1948]
call fcn.10006b30
cmp byte [ebp - 0x1925], 0
jne 0x1000f996
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000f610
cmp dword [esi + 0x20], 0
je 0x1000f957
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1930], eax
jmp 0x1000f961
push 0
push 0
push ecx
mov ecx, dword [ebp - 0x192c]
call fcn.1000f180
cmp eax, dword [ebp - 0x194c]
jle 0x1000f9be
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000f610
xor ecx, ecx
mov eax, 0x20
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.101609af
mov edi, eax
add esp, 4
test edi, edi
je 0x1000fa00
mov byte [edi + 0x20], 0
xor esi, esi
call fcn.101573b7
and eax, 0x800000ff
jns 0x1000f9f7
dec eax
or eax, 0xffffff00
inc eax
mov byte [edi + esi], al
inc esi
cmp esi, 0x20
jl 0x1000f9e4
movups xmm0, xmmword [edi]
push edi
movups xmmword [ebp - 0x19b0], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [ebp - 0x19a0], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1988], xmm0
call fcn.1015bd72
add esp, 4
mov dword [ebp - 0xa8], 0
push 0
call fcn.1015ba74
add esp, 4
mov dword [ebp - 0x1910], eax
lea eax, [ebp - 0x1910]
mov dword [ebp - 0x190c], edx
push eax
call fcn.1015bd40
add esp, 4
push eax
push str._Y_m_d_H_M_S
lea eax, [ebp - 0xa8]
push 0x10
push eax
call fcn.101666f1
push 0x800
lea eax, [ebp - 0x1108]
push 0
push eax
call fcn.10154a20
add esp, 0x1c
lea eax, [ebp - 0x908]
push 0x800
push 0
push eax
call fcn.10154a20
mov esi, dword [ebp - 0x1944]
lea eax, [ebp - 0x1978]
add esp, 0xc
mov ecx, dword [esi + 0x434]
push eax
call fcn.100013a0
cmp dword [eax + 0x14], 8
jb 0x1000fab7
mov eax, dword [eax]
mov edi, dword [ebp - 0x192c]
lea ecx, [ebp - 0xa8]
push 0x101cf484
push dword [edi + 0xc4c]
push ecx
push eax
lea eax, [ebp - 0x1108]
push str._s_s_d_s
push eax
call fcn.1000ee00
mov eax, dword [ebp - 0x1964]
add esp, 0x18
cmp eax, 8
jb 0x1000fb02
inc eax
lea ecx, [ebp - 0x1978]
push eax
push dword [ebp - 0x1978]
call fcn.10005bc0
mov ecx, dword [esi + 0x434]
lea eax, [ebp - 0x1978]
push eax
call fcn.100013a0
cmp dword [eax + 0x14], 8
jb 0x1000fb1c
mov eax, dword [eax]
push 0x101d3d88
push 0x101cf484
push dword [edi + 0xc4c]
lea ecx, [ebp - 0xa8]
push ecx
push eax
lea eax, [ebp - 0x908]
push str._s_s_d_s_s
push eax
call fcn.1000ee00
mov eax, dword [ebp - 0x1964]
add esp, 0x1c
cmp eax, 8
jb 0x1000fb66
inc eax
lea ecx, [ebp - 0x1978]
push eax
push dword [ebp - 0x1978]
call fcn.10005bc0
push 0
push 6
push 4
push 0
push 0
push 4
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1948], edi
cmp edi, 0xffffffff
je 0x1000fb93
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x1938], 0
jle 0x1000fd3f
mov edi, dword [ebp - 0x1944]
mov esi, dword [edi + 0x43c]
mov eax, dword [esi]
test eax, eax
je 0x1000fbbb
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x44]
mov eax, esi
mov edx, ecx
sub eax, edx
lea edx, [eax + 0x24]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
test al, al
jne 0x1000fbc7
mov eax, dword [esi]
test eax, eax
je 0x1000fbe1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [edi + 0x43c]
mov eax, dword [esi]
test eax, eax
je 0x1000fbf6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esi + 0x54]
lea edx, [ebp - 0x108]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1000fc01
mov eax, dword [esi]
test eax, eax
je 0x1000fc1b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [edi + 0x43c]
mov eax, dword [esi]
test eax, eax
je 0x1000fc30
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esi + 0x84]
lea edx, [ebp - 0xd8]
sub edx, ecx
nop
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1000fc40
mov eax, dword [esi]
test eax, eax
je 0x1000fc57
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [edi + 0x43c]
mov eax, dword [esi]
test eax, eax
je 0x1000fc6c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esi + 0xb4]
mov cl, byte [eax]
lea eax, [eax + 1]
test cl, cl
jne 0x1000fc72
mov eax, dword [esi]
test eax, eax
je 0x1000fc88
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [edi + 0x43c]
mov eax, dword [esi]
test eax, eax
je 0x1000fc9d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi]
mov edi, dword [esi + 0x8b4]
test eax, eax
je 0x1000fcb0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x1988]
push eax
lea eax, [ebp - 0x19b0]
push eax
push edi
mov edi, dword [ebp - 0x1948]
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1960]
push eax
push edi
push dword [ebp - 0x1950]
push dword [ebp - 0x1954]
push ecx
mov ecx, dword [ebp - 0x192c]
call fcn.100105d0
mov esi, dword [ebp - 0x1958]
cmp esi, 1
jle 0x1000fd16
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
mov dword [ebp - 0x1958], esi
jmp 0x1000fd32
mov eax, dword [ebp - 0x1930]
test eax, eax
jle 0x1000fd32
mov esi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x1000fd22
sub dword [ebp - 0x1938], 1
jne 0x1000fba0
cmp edi, 0xffffffff
je 0x1000fd75
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1000fd75
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebp - 0x908]
push eax
call fcn.10163c4c
add esp, 8
jmp 0x1000f610
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000f610