Function at 0x759d1078
Capabilities:
Delete file
Terminate thread

Disassembly:
cmp byte [ebp + 0x10], 0
je 0x759d10fd
jmp 0x759d10f6
cmp eax, edi
je 0x759d11bc
jmp 0x759d11cc
cmp dword [0x75bcca30], edi
jne 0x759d1285
cmp byte [ebp + 0x10], 0
jne 0x759d1285
mov eax, dword [ebp - 0xd8]
cmp eax, edi
je 0x759d104a
mov eax, dword [eax + 8]
shr eax, 0x1f
test al, 1
jne 0x759d1285
call fcn.759ceaa4
test al, al
je 0x759e85cf
mov ecx, dword [0x75bcca68]
cmp ecx, edi
je 0x759d1068
push 1
call fcn.759cf17a
mov dword [0x75bcca68], edi
jmp 0x759d1285
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebx + 0x94]
push edi
xor edi, edi
cmp ecx, edi
jne 0x759e8406
mov eax, dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
jne 0x759e8425
lea esi, [ebx + 0xac]
mov eax, dword [esi]
mov byte [ebx + 0x55], 0
mov byte [ebx + 0x8b], 0
cmp eax, 0xffffffff
je 0x759d10d6
cmp eax, edi
jne 0x759e844e
or dword [esi], 0xffffffff
call fcn.759cf3fa
mov eax, dword [0x75bcc938]
mov dword [ebp - 0xd8], eax
cmp dword [ebx + 0x90], edi
jne 0x759d10fd
cmp eax, edi
jne 0x759cf1fa
mov ecx, ebx
call fcn.759cf0d8
mov ecx, 0x75bc8b00
mov dword [ebx + 0xc4], edi
call fcn.759b1681
mov ecx, 0x75bc8adc
call fcn.759b1681
mov ecx, 0x75bc8400
call fcn.759b1681
mov ecx, 0x75bc8c80
call fcn.759b1681
mov ecx, 0x75bc81f8
call fcn.759b1681
mov ecx, 0x75bc82e8
call fcn.759b1681
mov ecx, ebx
call fcn.759cf126
cmp dword [0x75bcc8ec], 2
jne 0x759d1154
call fcn.759cf1cd
cmp byte [ebp + 8], 0
jne 0x759e8476
mov eax, dword [ebx + 0x20]
cmp eax, edi
jne 0x759e845a
mov eax, dword [ebx + 0x4c]
cmp eax, edi
jne 0x759e8468
mov eax, dword [ebx + 0xa8]
cmp eax, edi
jne 0x759e848d
mov eax, dword [ebx + 0x60]
cmp eax, edi
jne 0x759d132b
mov eax, dword [ebx + 0x2c]
cmp eax, edi
je 0x759d119e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x2c], edi
cmp byte [ebp + 0x10], 0
mov dword [ebx + 0x70], edi
jne 0x759d11da
test dword [0x75bc8da4], 0x2000
mov esi, 0xd000000
jne 0x759e84ad
test dword [0x75bc93d4], 0x2000
jne 0x759e84c3
mov ecx, dword [0x75bcde24]
cmp ecx, edi
jne 0x759e84d4
cmp byte [0x75bccaf0], 0
je 0x759d11ed
mov ecx, 0x75bccad8
call fcn.759d5def
mov eax, dword [ebx + 0x44]
cmp eax, edi
jne 0x759e84f5
push dword [ebx + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6c], 0x2000
call esi
push dword [ebx + 0x30]
mov dword [ebx + 0x28], edi
call esi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x40], edi
mov byte [ebx + 0x7c], 0
mov byte [ebx + 0xc1], 0
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x8a], 0
mov byte [ebx + 0x89], 0
mov dword [ebp - 0xd0], edi
mov esi, 0x759b7ff8
push dword [ebp - 0xd0]
call fcn.759cfc61
pop ecx
mov dword [ebp - 0xd4], eax
cmp eax, edi
jne 0x759e8504
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], 1
jle 0x759d1249
call fcn.759b68cf
mov ecx, dword [0x75bcca68]
cmp ecx, edi
jne 0x759d101c
mov ecx, dword [ebx + 0x94]
cmp ecx, edi
jne 0x759e85e6
cmp byte [ebp + 8], 0
jne 0x759e85f8
lea esi, [ebx + 0x84]
cmp dword [esi], edi
je 0x759d12ae
call fcn.759c6f05
mov dword [esi], edi
cmp dword [ebx + 0x14], 0xffffffff
je 0x759d12c2
lea eax, [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebx + 0x14], 0xffffffff
cmp dword [ebx + 0x64], edi
jne 0x759e867e
push edi
lea ecx, [ebx + 0x5c]
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x54], 0
call fcn.759c83d5
mov byte [ebx + 0xba], 0
cmp dword [ebx + 0x90], edi
jne 0x759d12fc
mov eax, dword [ebx + 0x58]
cmp eax, edi
je 0x759d12fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x58], edi
cmp byte [ebx + 0xc0], 0
jne 0x759e8838
lea esi, [ebx + 0x8c]
cmp byte [esi], 1
je 0x759e8860
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.759b1748
leave
ret 0xc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x60], edi
jmp 0x759d118d
cmp dword [0x75bcc8ec], 2
jne 0x759d10a2
push 1
call fcn.75acb303
mov dword [ebx + 0x94], edi
jmp 0x759d10a2
cmp byte [ebx + 0x55], 0
push edi
je 0x759e843a
push 0xf000135
mov ecx, ebx
call fcn.759d14b0
jmp 0x759e8441
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebx + 0x34]
call esi
mov dword [ebx + 0x34], edi
jmp 0x759d10b3
push eax
call dword [0x75bc846c]
jmp 0x759d10d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x20], edi
jmp 0x759d1169
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x4c], edi
jmp 0x759d1174
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x4c], edi
mov dword [0x75bcde58], edi
mov dword [0x75bcde5c], edi
jmp 0x759d1174
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebx + 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0xa8], edi
jmp 0x759d1182
push dword [0x75bc82c8]
mov ecx, 0x75bc8d98
push esi
call fcn.75af59cd
jmp 0x759cf209
push edi
push esi
mov ecx, 0x75bc93c8
call fcn.75afa502
jmp 0x759d11cc
test dword [ecx + 0x42c], 0x2000
je 0x759d11da
push dword [0x75bc82c8]
push esi
call fcn.75b1491d
jmp 0x759d11da
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x44], edi
jmp 0x759d11f8
mov ecx, eax
call fcn.75ba3cac
test al, al
je 0x759e8570
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
je 0x759e8570
mov eax, dword [ebp - 0xd4]
cmp byte [eax + 0x304], 0
jne 0x759e8570
mov ecx, eax
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, edi
je 0x759e854f
cmp dword [0x75bc8ca8], edi
je 0x759e8570
push edi
push edi
push esi
push esi
push esi
push esi
push esi
push eax
push 0x759e8a20
jmp 0x759e8564
cmp dword [0x75bc8ca8], edi
je 0x759e8570
push edi
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x759e8990
push edi
push edi
push 0xa
call fcn.759c26bf
add esp, 0x30
mov ecx, dword [ebp - 0xd4]
call fcn.75ba3cc9
cmp eax, 0x65a
je 0x759e85be
cmp eax, edi
je 0x759e859d
cmp dword [0x75bc8ca8], edi
je 0x759e85be
push edi
push edi
push esi
push esi
push esi
push esi
push esi
push eax
push 0x759fa700
jmp 0x759e85b2
cmp dword [0x75bc8ca8], edi
je 0x759e85be
push edi
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x759fa6b8
push edi
push edi
push 0xa
call fcn.759c26bf
add esp, 0x30
push dword [ebp - 0xd0]
call fcn.75ba4c28
pop ecx
jmp 0x759d1263
mov ecx, dword [0x75bcca68]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push edi
call fcn.75a1df9e
jmp 0x759d1057
push 1
call fcn.75acb303
mov dword [ebx + 0x94], edi
jmp 0x759d1293
cmp dword [0x75bc8ca8], edi
je 0x759e8619
push edi
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x759e896c
push edi
push edi
push 0xa
call fcn.759c26bf
add esp, 0x30
mov byte [ebx + 0x98], 1
call fcn.75af1391
push 1
call fcn.759c8f87
pop ecx
push edi
call dword [0x75bc8258]
push 1
call fcn.759c9048
pop ecx
cmp dword [0x75bcc8f0], edi
je 0x759d12ae
mov dword [0x75bcc8f0], edi
call fcn.759c8759
cmp eax, edi
je 0x759d12ae
mov ecx, dword [0x75bcc914]
cmp ecx, edi
je 0x759e8674
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0xa8]
jmp 0x759d12ae
call fcn.759c6f05
jmp 0x759d12ae
push 0x75bc8ec0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0xa4], edi
je 0x759e8710
cmp dword [0x75bcc8ec], 3
je 0x759e8710
mov esi, 0x759e8958
lea edi, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x8e
lea eax, [ebp - 0x92]
push 0
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x75bcc8ec], 0
lea eax, [ebp - 0xa4]
jne 0x759e86d7
push 0x759e8950
jmp 0x759e86dc
push 0x759e8948
push 0x50
push eax
call fcn.759b3d8c
push 0x759e88c8
push 0x50
lea eax, [ebp - 0xa4]
push eax
call fcn.759b3d8c
lea eax, [ebp - 0xa4]
push eax
mov dword [ebx + 0xa0], 3
call fcn.75acfab0
pop ecx
xor edi, edi
push 8
call fcn.75aeb887
pop ecx
test al, al
je 0x759e8785
cmp dword [0x75bcc8ec], edi
jne 0x759e8785
xor eax, eax
push 0xc6
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [0x75bc8d40]
add esp, 0xc
push 0x75bc8d40
call dword [eax + 0x20]
push eax
mov eax, dword [0x75bc8cc8]
push 0x75bc8cc8
call dword [eax + 0x20]
push eax
push 0x759e8870
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.759b4c31
add esp, 0x14
test eax, eax
jl 0x759e8785
lea eax, [ebp - 0xcc]
push eax
call fcn.75ad1dad
pop ecx
mov ecx, dword [ebx + 0xb4]
cmp ecx, edi
je 0x759e87cb
cmp byte [ebp + 0xc], 0
jne 0x759e87a7
cmp byte [ebp + 8], 0
jne 0x759e87a7
test dword [0x75bcc8fc], 0x4000
jne 0x759e87ae
push 1
call fcn.75ad1bcd
mov ecx, dword [ebx + 0xb4]
call fcn.75acf9a8
push dword [ebx + 0xb4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx + 0xb4], edi
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebx + 0x9c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x64], edi
mov dword [esi], edi
test dword [0x75bcc8fc], 0x4000
je 0x759e880b
cmp byte [ebp + 0xc], 0
jne 0x759e880b
cmp byte [ebp + 8], 0
jne 0x759e880b
push dword [0x75bccdd8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebx + 0x68], 0
je 0x759e8822
mov ecx, dword [0x75bccdd8]
xor eax, eax
mov word [ecx], ax
mov dword [0x75bcc8fc], edi
push 0x75bc8ec0
mov dword [0x75bceb74], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x759d12cb
cmp dword [0x75bcc8ec], 2
jne 0x759d1309
mov eax, dword [0x75bcc914]
cmp eax, edi
je 0x759d1309
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc4]
jmp 0x759d1309
call dword [0x75bc8b6c]
mov byte [esi], 0
jmp 0x759d1318