Function at 0x100262b9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100262f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x7f50
push 0xc6c
push 0x6c15
push 0x6dab
push dword [ebp - 4]
push 0
push 0x4c1c
call fcn.10029275
add esp, 0x1c
jmp 0x1002635b
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10026331
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002632f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002635b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002635b
push 0
push 0x1dd8
push 0
push 0x2047
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov esp, ebp
pop ebp
ret

Function at 0x100266ad
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070f2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002670a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100266f3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10026705
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x10026805
mov dword [ebp - 0x20], 0x30ab
mov dword [ebp - 0x2c], 0x100081b0
cmp dword [ebp - 0x20], 0x3387
jle 0x100267bb
and dword [ebp - 0x14], 0
jmp 0x10026732
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b39
jge 0x100267aa
and dword [ebp - 0x18], 0
jmp 0x10026748
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x27d6
jge 0x100267a8
and dword [ebp - 0x1c], 0
jmp 0x1002675e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x37ec
jge 0x100267a6
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.1000a64e
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10017622
push eax
call fcn.10058109
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.10017618
jmp 0x10026757
jmp 0x10026741
jmp 0x1002672b
push 0
push 0
push 0xdb7
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0x785c
push 0
call fcn.1002bd50
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x300c
jge 0x100267df
push dword [ebp - 0x2c]
call fcn.10058109
pop ecx
jmp 0x100267fb
or dword [ebp - 4], 0xffffffff
jmp 0x10026805
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret