Function at 0x100623cd
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0x74
mov eax, 0x10166bd5
call fcn.10163edf
mov ebx, ecx
lea ecx, [ebp - 0x68]
call fcn.10046025
and dword [ebp - 4], 0
mov eax, dword [0x101923c0]
mov edi, 0x101923c0
mov esi, 0x1001b4a0
cmp eax, edi
je 0x10062413
test byte [eax + 0x44], 4
je 0x10062413
push dword [ebx + 8]
mov edx, esi
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x3e
pop ecx
call fcn.10040085
push 0x1001b87c
push dword [ebx + 0x30]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
push 0x1001b8a0
push dword [ebx + 0x30]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
cmp byte [ebx + 0x12], 0
jne 0x10062461
mov eax, dword [0x101923c0]
cmp eax, edi
je 0x100627e3
test byte [eax + 0x44], 4
je 0x100627e3
push dword [eax + 0x3c]
mov edx, esi
push dword [eax + 0x38]
push 0x3f
pop ecx
call fcn.10040067
jmp 0x100627e3
xor ecx, ecx
mov dword [ebp - 0x74], 0x1000155c
mov dword [ebp - 0x70], ecx
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x80], ecx
push eax
push 6
push ecx
push 0x1001b8d0
mov ecx, ebx
call fcn.10064620
cmp dword [ebp - 0x70], 0
jne 0x100624bd
mov eax, dword [0x101923c0]
cmp eax, edi
je 0x100627db
test byte [eax + 0x44], 4
je 0x100627db
push dword [eax + 0x3c]
mov edx, esi
push dword [eax + 0x38]
push 0x40
pop ecx
call fcn.10040067
jmp 0x100627db
push dword [ebp - 0x70]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.10045b1f
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
push 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
pop esi
cmp dword [ebp - 0x18], esi
jae 0x100624fa
lea eax, [ebp - 0x2c]
push eax
push 0x1001b91c
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10062518
mov eax, 0x100182d8
mov ecx, 0x17f
jmp 0x10062593
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x10062523
lea eax, [ebp - 0x2c]
push eax
push 0x1001b93c
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10062541
mov eax, 0x10018458
mov ecx, 0x184
jmp 0x10062593
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1006254c
lea eax, [ebp - 0x2c]
push eax
push 0x1001b960
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1006256a
mov eax, 0x100185e0
mov ecx, 0x17e
jmp 0x10062593
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x10062575
lea eax, [ebp - 0x2c]
push eax
push 0x1001b984
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10062795
push 0xa
mov eax, 0x10018760
pop ecx
push ecx
push eax
lea ecx, [ebp - 0x64]
call fcn.10057a2d
push 0x1001b9a8
lea edx, [ebx + 0x14]
lea ecx, [ebp - 0x48]
call fcn.100608c4
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jae 0x100625c1
lea eax, [ebp - 0x48]
push ecx
push 0x8100080
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x6c]
call fcn.10064d0f
mov esi, dword [ebp - 0x6c]
cmp esi, 0xffffffff
jne 0x10062649
mov eax, dword [0x101923c0]
cmp eax, edi
je 0x10062616
test byte [eax + 0x44], 1
je 0x10062616
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x101923c0]
mov edx, 0x1001b4a0
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x42
pop ecx
call fcn.100401e4
xor ebx, ebx
lea ecx, [ebp - 0x48]
push ebx
push 1
call fcn.10045ee3
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.10057988
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10045ee3
lea ecx, [ebp - 0x74]
call fcn.10064cef
cmp dword [ebp - 0x68], ebx
jmp 0x100627e7
and dword [ebp - 0x7c], 0
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x10062659
lea eax, [ebp - 0x64]
push 0
lea ecx, [ebp - 0x7c]
push ecx
push dword [ebp - 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10062725
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x54]
jne 0x10062725
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x1006268a
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0x1001b87c
push dword [ebx + 0x30]
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov edi, eax
test edi, edi
jle 0x100626b7
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100627f5
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
jae 0x100626c9
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x38]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0x1001b8a0
push dword [ebx + 0x30]
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov edi, eax
test edi, edi
jle 0x100626f6
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x10062773
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1006281b
test byte [eax + 0x44], 1
je 0x1006281b
push edi
push dword [eax + 0x3c]
mov edx, 0x1001b4a0
push dword [eax + 0x38]
push 0x45
jmp 0x10062815
mov eax, dword [0x101923c0]
cmp eax, edi
je 0x10062753
test byte [eax + 0x44], 1
je 0x10062753
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x101923c0]
mov edx, 0x1001b4a0
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x43
pop ecx
call fcn.100401e4
push 0
lea ecx, [ebp - 0x6c]
call fcn.10064d0f
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x10062769
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x6c]
mov byte [ebp - 4], 4
test esi, esi
je 0x10062787
cmp esi, 0xffffffff
je 0x10062787
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10045ee3
jmp 0x100627c3
mov eax, dword [0x101923c0]
cmp eax, edi
je 0x100627c3
test byte [eax + 0x44], 4
je 0x100627c3
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x100627af
lea ecx, [ebp - 0x2c]
push ecx
push dword [eax + 0x3c]
mov edx, 0x1001b4a0
push dword [eax + 0x38]
push 0x41
pop ecx
call fcn.10040085
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.10057988
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10045ee3
lea ecx, [ebp - 0x74]
call fcn.10064cef
cmp dword [ebp - 0x68], 0
je 0x100627ef
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.10163e8e
ret
mov eax, dword [0x101923c0]
cmp eax, 0x101923c0
je 0x1006281b
test byte [eax + 0x44], 1
je 0x1006281b
push edi
push dword [eax + 0x3c]
mov edx, 0x1001b4a0
push dword [eax + 0x38]
push 0x44
pop ecx
call fcn.100401e4
push edi
lea ecx, [ebp - 0x78]
call fcn.1003f8d8
push 0x10191580
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3