Function at 0x101bd65
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10ac
call fcn.0101ca90
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
mov esi, 0x7fe
push esi
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push ebx
push eax
mov dword [ebp - 0x1014], ebx
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x1024], ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x88
lea eax, [ebp - 0x10ac]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x10550c8
push 0x1055068
push edi
push dword [ebp + 8]
call fcn.0104ced1
mov esi, eax
cmp esi, ebx
jl 0x101c708
cmp esi, 1
je 0x101c708
cmp dword [0x1055050], ebx
je 0x101be32
mov dword [section..data], 0xa
lea eax, [ebp - 0x1008]
push eax
call fcn.0101f185
push 4
pop ecx
mul ecx
push edx
push eax
call fcn.0101b8f5
mov esi, eax
cmp esi, ebx
jl 0x101c708
push dword [ebp - 0x1008]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov dword [ebp - 0x1020], eax
cmp eax, ebx
jne 0x101be80
mov esi, 0x8007000e
jmp 0x101c6d0
push dword [ebp - 0x1008]
push ebx
call edi
push eax
call esi
mov dword [ebp - 0x101c], eax
cmp eax, ebx
je 0x101beac
push dword [ebp - 0x1008]
push ebx
call edi
push eax
call esi
mov dword [ebp - 0x1014], eax
cmp eax, ebx
jne 0x101beb6
mov esi, 0x8007000e
jmp 0x101c6b4
push 0x12c
push ebx
call fcn.0104d909
mov eax, dword [0x1055170]
neg eax
sbb eax, eax
and eax, 0xffffefff
add eax, 0x1001
pop ecx
pop ecx
mov dword [ebp - 0x1008], eax
cmp dword [0x1055770], ebx
je 0x101c069
cmp dword [0x10551d0], ebx
je 0x101bf11
push 0x10016d8
push dword [0x10551e4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101bf11
mov dword [ebp - 0x1024], 1
mov edi, dword [0x1055784]
cmp edi, ebx
jne 0x101bf2d
mov edi, 0x10014f4
cmp dword [ebp - 0x1024], ebx
jne 0x101bf2d
mov edi, 0x1001510
push dword [ebp - 0x1008]
or dword [ebp - 0x1034], 8
push edi
mov dword [ebp - 0x1088], edi
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x804]
cmp dword [ebp - 0x1024], ebx
jne 0x101c01b
push edi
push 0x400
push eax
call fcn.0101bc13
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x101bf88
sub eax, edx
sar eax, 1
lea edi, [ebp + eax*2 - 0x806]
jmp 0x101bfa7
cmp word [edi], 0x5c
je 0x101bfb3
dec edi
dec edi
lea eax, [ebp - 0x804]
cmp edi, eax
ja 0x101bf9f
jmp 0x101bfda
inc edi
xor eax, eax
push 0x10016c0
inc edi
mov word [edi], ax
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.0101bc4d
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
lea eax, [ebp - 0x804]
cmp edi, eax
jne 0x101bffe
push 0x10016c0
push 0x400
push eax
call fcn.0101bc13
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
lea eax, [ebp - 0x804]
push eax
push 0x10016a8
call fcn.0101bb72
mov dword [ebp - 0x1070], 0x10016c0
jmp 0x101c069
push 0x400
push eax
call fcn.01022d0c
xor esi, esi
cmp eax, ebx
je 0x101c03a
jle 0x101c038
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
lea eax, [ebp - 0x804]
push eax
push 0x10016a8
call fcn.0101bb72
or dword [ebp - 0x1034], 0x40000
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1070], eax
cmp dword [0x1055650], ebx
je 0x101c090
mov eax, dword [0x1055664]
mov dword [ebp - 0x1028], eax
cmp eax, 1
jb 0x101c086
cmp eax, 5
jbe 0x101c09a
mov esi, 0x80070057
jmp 0x101c6b4
mov dword [ebp - 0x1028], 1
cmp dword [0x10558f0], ebx
je 0x101c10c
mov esi, dword [0x1055904]
push 0x12f
push ebx
call fcn.0104d909
pop ecx
pop ecx
jmp 0x101c0fd
call fcn.0101f185
cmp dword [ebp - 0x1010], eax
jae 0x101c102
mov ecx, dword [ebp - 0x1010]
mov eax, dword [ebp - 0x101c]
inc dword [ebp - 0x1010]
push esi
push 0x1001690
mov dword [eax + ecx*4], esi
call fcn.0104d8ef
pop ecx
mov eax, esi
pop ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x101c0eb
sub eax, ecx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x101c0b7
push 0x100168c
call fcn.0104d95d
cmp dword [0x1055890], ebx
je 0x101c1aa
push 1
push 0x10558a4
call fcn.0104ddc8
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
mov edi, dword [0x10558a4]
push 0x130
push ebx
call fcn.0104d909
pop ecx
pop ecx
jmp 0x101c19b
call fcn.0101f185
cmp dword [ebp - 0x1018], eax
jae 0x101c1a0
mov ecx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1020]
inc dword [ebp - 0x1018]
push 2
push edi
mov dword [eax + ecx*4], edi
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
push edi
push 0x1001690
call fcn.0104d8ef
pop ecx
mov eax, edi
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x101c189
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x101c143
push 0x100168c
call fcn.0104d95d
cmp dword [0x10552f0], ebx
je 0x101c1d9
mov eax, dword [0x1055304]
or dword [ebp - 0x1034], 0x4000000
push 2
push eax
mov dword [ebp - 0x107c], eax
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
cmp dword [0x1055350], ebx
je 0x101c281
or dword [ebp - 0x1034], 0x40000000
push 1
push 0x1055364
call fcn.0104ddc8
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
mov edi, dword [0x1055364]
push 0x130
push ebx
call fcn.0104d909
pop ecx
pop ecx
jmp 0x101c272
call fcn.0101f185
cmp dword [ebp - 0x100c], eax
jae 0x101c277
mov ecx, dword [ebp - 0x100c]
mov eax, dword [ebp - 0x1014]
inc dword [ebp - 0x100c]
push 2
push edi
mov dword [eax + ecx*4], edi
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
push edi
push 0x1001690
call fcn.0104d8ef
pop ecx
mov eax, edi
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x101c260
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x101c21a
push 0x100168c
call fcn.0104d95d
cmp dword [0x1055410], ebx
je 0x101c293
or dword [ebp - 0x1034], 0x1000
cmp dword [0x1055470], ebx
je 0x101c2b0
mov eax, dword [0x1055484]
or dword [ebp - 0x1034], 0x80000
mov dword [ebp - 0x1068], eax
cmp dword [0x10554d0], ebx
je 0x101c2cd
mov eax, dword [0x10554e4]
or dword [ebp - 0x1034], 0x100000
mov dword [ebp - 0x1064], eax
cmp dword [0x1055530], ebx
je 0x101c2ea
mov eax, dword [0x1055544]
or dword [ebp - 0x1034], 0x200000
mov dword [ebp - 0x1060], eax
cmp dword [0x1055590], ebx
je 0x101c307
mov eax, dword [0x10555a4]
or dword [ebp - 0x1034], 0x400000
mov dword [ebp - 0x105c], eax
cmp dword [0x10555f0], ebx
je 0x101c319
or dword [ebp - 0x1034], 0x800000
cmp dword [0x10553b0], ebx
je 0x101c34c
mov eax, dword [0x10553c4]
push dword [ebp - 0x1008]
or dword [ebp - 0x1034], 0x800
push eax
mov dword [ebp - 0x1074], eax
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
cmp dword [0x1055230], ebx
je 0x101c3b3
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x100161c
push dword [0x1055244]
call esi
pop ecx
pop ecx
test eax, eax
je 0x101c3d1
push 0x1001684
push dword [0x1055244]
call esi
pop ecx
pop ecx
test eax, eax
je 0x101c3b3
push 0x1001678
push dword [0x1055244]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x101c3d1
cmp dword [0x10557d0], ebx
je 0x101c3a7
or dword [ebp - 0x1034], 0x10000000
jmp 0x101c3d1
or dword [ebp - 0x1034], 0x2000000
jmp 0x101c3d1
cmp dword [0x10557d0], ebx
je 0x101c3c7
or dword [ebp - 0x1034], 0x8000000
jmp 0x101c3d1
or dword [ebp - 0x1034], 0x1000000
cmp dword [0x1055290], ebx
je 0x101c3fb
mov eax, dword [0x10552a4]
cmp eax, ebx
je 0x101c3fb
push 0x1001668
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101c3fb
or dword [ebp - 0x1034], 0x20
cmp dword [0x1055710], ebx
je 0x101c45b
mov eax, dword [0x1055724]
cmp eax, ebx
jne 0x101c435
test dword [ebp - 0x1034], 0x9000000
je 0x101c41f
mov eax, 0x100157c
jmp 0x101c435
test dword [ebp - 0x1034], 0x12000000
mov eax, 0x1001560
jne 0x101c435
mov eax, 0x1001544
push dword [ebp - 0x1008]
or dword [ebp - 0x1034], 0x80
push eax
mov dword [ebp - 0x1080], eax
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
mov edi, 0x100152c
cmp dword [0x10556b0], ebx
je 0x101c499
mov eax, dword [0x10556c4]
cmp eax, ebx
jne 0x101c473
mov eax, edi
push dword [ebp - 0x1008]
or dword [ebp - 0x1034], 0x400
push eax
mov dword [ebp - 0x1084], eax
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
cmp dword [0x1055830], ebx
je 0x101c4d5
mov eax, dword [0x1055844]
cmp eax, ebx
jne 0x101c4af
mov eax, 0x10014dc
push dword [ebp - 0x1008]
or dword [ebp - 0x1034], 0x20000000
push eax
mov dword [ebp - 0x1058], eax
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
test dword [ebp - 0x1034], 0x20000488
jne 0x101c551
or dword [ebp - 0x1034], 0x480
test dword [ebp - 0x1034], 0x9000000
je 0x101c4fe
mov eax, 0x100157c
jmp 0x101c514
test dword [ebp - 0x1034], 0x12000000
mov eax, 0x1001560
jne 0x101c514
mov eax, 0x1001544
push dword [ebp - 0x1008]
mov dword [ebp - 0x1080], eax
push eax
mov dword [ebp - 0x1084], edi
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
push dword [ebp - 0x1008]
push dword [ebp - 0x1084]
call fcn.0104e4d2
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
mov eax, dword [ebp - 0x1020]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x100c]
mov dword [ebp - 0x109c], eax
cmp dword [0x1055890], ebx
je 0x101c5b8
fldz
push ecx
push ecx
fstp qword [esp]
push ebx
mov dword [ebp - 0x1030], fcn.0101bd06
call fcn.0101bd06
lea eax, [ebp - 0x10ac]
push eax
call fcn.0101fdd5
xor esi, esi
cmp eax, ebx
je 0x101c5d8
jle 0x101c5d6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x101c6b4
cmp dword [0x10558f0], ebx
jne 0x101c5ff
fld1
push ecx
push ecx
fstp qword [esp]
push ebx
call fcn.0101bd06
push 0x100168c
call fcn.0104d95d
push 0x12d
push ebx
call fcn.0104d909
test byte [ebp - 0x1034], 0x80
pop ecx
pop ecx
je 0x101c629
push dword [ebp - 0x1080]
push 0x132
push ebx
call fcn.0104d909
add esp, 0xc
test dword [ebp - 0x1034], 0x400
je 0x101c649
push dword [ebp - 0x1084]
push 0x134
push ebx
call fcn.0104d909
add esp, 0xc
test dword [ebp - 0x1034], 0x20000000
je 0x101c669
push dword [ebp - 0x1058]
push 0x139
push ebx
call fcn.0104d909
add esp, 0xc
test byte [ebp - 0x1034], 8
je 0x101c686
push dword [ebp - 0x1088]
push 0x133
push ebx
call fcn.0104d909
add esp, 0xc
test dword [ebp - 0x1034], 0x800
je 0x101c6a6
push dword [ebp - 0x1074]
push 0x137
push ebx
call fcn.0104d909
add esp, 0xc
lea eax, [ebp - 0x10ac]
push eax
call fcn.0101f69e
mov esi, eax
cmp dword [ebp - 0x101c], ebx
je 0x101c6d0
push dword [ebp - 0x101c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x1020], ebx
je 0x101c6ec
push dword [ebp - 0x1020]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x1014], ebx
je 0x101c708
push dword [ebp - 0x1014]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test byte [ebp - 0x1034], 8
je 0x101c727
cmp esi, ebx
jge 0x101c727
push 0x12e
push esi
lea eax, [ebp - 0x10ac]
push eax
call fcn.0101f969
lea eax, [ebp - 0x1004]
test eax, eax
je 0x101c749
xor eax, eax
cmp ax, word [ebp - 0x1004]
je 0x101c749
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test dword [ebp - 0x1034], 0x40000
je 0x101c762
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x100168c
call fcn.0104d95d
cmp byte [0x10566d0], bl
je 0x101c781
push 0x138
push ebx
call fcn.0104d909
pop ecx
pop ecx
cmp esi, ebx
jge 0x101c792
push 0x1001650
push esi
call fcn.0104d975
jmp 0x101c7a4
cmp esi, 1
je 0x101c7a4
push 0x3b60
push ebx
call fcn.0104d909
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101ca75
leave
ret