Function at 0x1002a800
Capabilities:
Delete file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10051421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
mov eax, dword [0x1006099c]
push ebx
push ebp
xor ebx, ebx
push esi
mov ebp, ecx
mov dword [esp + 0x94], eax
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov eax, dword [ebp + 0x150]
mov esi, dword [eax]
xor edi, edi
cmp esi, eax
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x10], esi
je 0x1002a96b
lea esp, [esp]
push 0xffffffffffffffff
lea eax, [esi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.10001e90
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
mov byte [esp + 0xa4], 1
jae 0x1002a897
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.10040e96
add esp, 8
cmp eax, 0xffffffff
jne 0x1002a8ab
mov dword [esi + 0x28], ebx
jmp 0x1002a922
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x68]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.10001e90
lea ecx, [esp + 0x7c]
push ecx
mov ecx, ebp
call fcn.100290b0
cmp dword [esp + 0x70], ebx
mov byte [esp + 0xa4], 2
je 0x1002a8fe
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x2c]
mov dword [esi + 0x28], 1
call fcn.10004480
cmp dword [esp + 0x74], 0x10
jb 0x1002a912
mov eax, dword [esp + 0x60]
push eax
call fcn.10036530
add esp, 4
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
mov eax, dword [esp + 0x58]
inc edi
cmp eax, 0x10
mov byte [esp + 0xa4], bl
jb 0x1002a940
mov ecx, dword [esp + 0x44]
push ecx
call fcn.10036530
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.100206a0
mov eax, dword [ebp + 0x150]
mov esi, dword [esp + 0x10]
cmp esi, eax
jne 0x1002a860
lea ecx, [esp + 0x18]
call fcn.10020880
mov dword [esp + 0x1c], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], eax
mov eax, dword [esp + 0x1c]
mov dword [eax + 8], eax
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x30]
mov byte [esp + 0xa4], 3
mov dword [esp + 0x10], eax
je 0x1002ab03
mov edi, edi
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push ebx
push edx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.10001e90
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 4
call fcn.100208c0
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
je 0x1002aa47
cmp dword [eax + 0x24], 0x10
mov ebp, dword [eax + 0x20]
jb 0x1002a9ff
mov eax, dword [eax + 0x10]
jmp 0x1002aa02
add eax, 0x10
mov edx, dword [esp + 0x54]
cmp edx, ebx
je 0x1002aa32
cmp edx, ebp
mov ecx, edx
jb 0x1002aa12
mov ecx, ebp
cmp dword [esp + 0x58], 0x10
mov esi, dword [esp + 0x44]
jae 0x1002aa21
lea esi, [esp + 0x44]
mov edi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1002aa2e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1002aa3f
cmp edx, ebp
jb 0x1002aa47
xor eax, eax
cmp edx, ebp
setne al
cmp eax, ebx
jl 0x1002aa47
lea eax, [esp + 0x38]
jmp 0x1002aa53
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x24]
mov eax, dword [eax]
cmp eax, dword [esp + 0x1c]
mov esi, 0xf
je 0x1002aa65
inc dword [eax + 0x28]
jmp 0x1002aac4
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x68]
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
call fcn.10001e90
mov dword [esp + 0x78], ebx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0xac], 5
call fcn.100212d0
cmp dword [esp + 0x74], 0x10
jb 0x1002aab8
mov edx, dword [esp + 0x60]
push edx
call fcn.10036530
add esp, 4
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
cmp dword [esp + 0x58], 0x10
mov byte [esp + 0xa4], 3
jb 0x1002aae0
mov eax, dword [esp + 0x44]
push eax
call fcn.10036530
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
add eax, 0x1c
cmp eax, ecx
mov dword [esp + 0x58], esi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x10], eax
jne 0x1002a9b0
push ebx
push 0x100534c7
lea ecx, [esp + 0x84]
xor edi, edi
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
call fcn.10001f80
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx]
cmp esi, ecx
mov byte [esp + 0xa4], 6
je 0x1002aba5
cmp dword [esi + 0x28], edi
jle 0x1002ab61
push 0xffffffffffffffff
lea eax, [esi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x88]
call fcn.10001e90
mov edi, dword [esi + 0x28]
mov ecx, dword [esp + 0x1c]
cmp byte [esi + 0x2d], bl
jne 0x1002aba1
mov eax, dword [esi + 8]
cmp byte [eax + 0x2d], bl
jne 0x1002ab82
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
jne 0x1002aba1
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
je 0x1002ab77
jmp 0x1002aba1
mov eax, dword [esi + 4]
cmp byte [eax + 0x2d], bl
jne 0x1002ab9f
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x1002ab9f
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], bl
je 0x1002ab90
mov esi, eax
cmp esi, ecx
jne 0x1002ab42
mov eax, dword [esp + 0x20]
cmp eax, 1
jne 0x1002abd5
mov edi, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x84]
lea esi, [edi + 0xec]
push ecx
mov ecx, esi
call fcn.10001e90
mov dword [edi + 0x148], ebx
jmp 0x1002ac6e
cmp eax, ebx
jne 0x1002ac48
lea ecx, [esp + 0x10]
call fcn.1002d9e9
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 7
call fcn.1002fc96
mov edi, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea esi, [edi + 0xec]
push eax
mov ecx, esi
mov byte [esp + 0xb0], 8
call fcn.10001e90
mov eax, dword [esp + 0x74]
mov ebp, 0x10
cmp eax, ebp
jb 0x1002ac2f
mov eax, dword [esp + 0x60]
push eax
call fcn.10036530
add esp, 4
lea ecx, [esp + 0x10]
mov dword [edi + 0x148], ebx
mov byte [esp + 0xa4], 6
call fcn.1002d9f2
jmp 0x1002ac73
mov edi, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x84]
lea esi, [edi + 0xec]
push ecx
mov ecx, esi
call fcn.10001e90
mov dword [edi + 0x148], 1
mov ebp, 0x10
cmp dword [edi + 0x100], ebx
jne 0x1002ad91
lea ecx, [esp + 0x14]
call fcn.1002d9e9
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0xa8], 9
call fcn.1002fc96
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0xb0], 0xa
call fcn.10001e90
cmp dword [esp + 0x74], ebp
mov byte [esp + 0xa4], 9
jb 0x1002accc
mov eax, dword [esp + 0x60]
push eax
call fcn.10036530
add esp, 4
mov eax, dword [edi + 0x150]
mov dword [edi + 0x148], ebx
mov esi, dword [eax]
cmp esi, eax
je 0x1002ad80
push 0xffffffffffffffff
lea eax, [esi + 0xc]
push ebx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
call fcn.10001e90
cmp dword [esp + 0x58], ebp
mov eax, dword [esp + 0x44]
jae 0x1002ad10
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x58], ebp
jb 0x1002ad2a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.10036530
add esp, 4
cmp byte [esi + 0x2d], bl
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jne 0x1002ad74
mov eax, dword [esi + 8]
cmp byte [eax + 0x2d], bl
jne 0x1002ad5b
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
jne 0x1002ad74
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
je 0x1002ad50
jmp 0x1002ad74
mov eax, dword [esi + 4]
cmp byte [eax + 0x2d], bl
jne 0x1002ad72
cmp esi, dword [eax + 8]
jne 0x1002ad72
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], bl
je 0x1002ad63
mov esi, eax
cmp esi, dword [edi + 0x150]
jne 0x1002ace2
lea ecx, [esp + 0x14]
mov byte [esp + 0xa4], 6
call fcn.1002d9f2
cmp dword [esp + 0x94], ebp
jb 0x1002adaa
mov edx, dword [esp + 0x80]
push edx
call fcn.10036530
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov ecx, dword [eax]
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xb0], bl
call fcn.10021210
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10036530
mov ebp, dword [esp + 0x30]
add esp, 4
cmp ebp, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
je 0x1002ae38
mov edi, dword [esp + 0x30]
cmp ebp, edi
je 0x1002ae2f
lea esi, [ebp + 0x18]
cmp dword [esi], 0x10
jb 0x1002ae19
mov edx, dword [esi - 0x14]
push edx
call fcn.10036530
add esp, 4
mov dword [esi], 0xf
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x1002ae08
push ebp
call fcn.10036530
add esp, 4
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x98]
call fcn.1003fd01
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret