Function at 0x10029c31
Capabilities:
Delete file
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065864
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
mov byte [esp + 0x28], cl
push ebx
push esi
push edi
test cl, cl
je 0x10029c6a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1002a3ea
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x5c]
push 4
mov dword [esp + 0x44], esi
call fcn.100038f5
xor ebx, ebx
lea ecx, [esp + 0x74]
push 2
mov dword [esp + 0x120], ebx
call fcn.100038f5
push ebx
xor eax, eax
mov edx, 0x6384
inc eax
push 0x3e8f
mov byte [esp + 0x124], al
lea eax, [esp + 0x58]
push 0x6162
push eax
lea eax, [esp + 0x6c]
push eax
push 0x169f
push 0x2f0b
call fcn.1002a68c
add esp, 0x1c
lea eax, [esp + 0x74]
mov edx, 0x3a74
push eax
push 0x12ae
push ecx
push ecx
lea eax, [esp + 0x60]
push eax
push ecx
push ecx
xor cl, cl
call fcn.10027542
add esp, 0x18
mov byte [esp + 0x29], bl
lea eax, [esp + 0x29]
push eax
push ecx
push ecx
push ebx
push ecx
push 0x2c83
call fcn.100290e3
add esp, 0x1c
lea eax, [esp + 0x5c]
lea edx, [esp + 0x74]
xor cl, cl
push eax
call fcn.1002ca22
pop ecx
lea ecx, [esp + 0x74]
call fcn.10003978
or dword [esp + 0x11c], 0xffffffff
lea ecx, [esp + 0x5c]
call fcn.10003978
mov eax, dword [esi]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.1002c4e6
pop ecx
pop ecx
push 0x2bd2
push ebx
push 0x79aa
push ecx
push 0x5a64
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 2
call fcn.10027db4
add esp, 0x14
lea ecx, [esp + 0x38]
call fcn.1002ae99
mov edi, ebx
mov dword [esp + 0xc], 0x399841b3
mov dword [esp + 0xc], ebx
jmp 0x10029ee3
mov dword [esp + 0x1c], 0x57102d14
lea ecx, [esp + 0x80]
push 3
call fcn.100038f5
lea eax, [esp + 0xac]
mov dword [esp + 0x11c], 2
push eax
push 0x21c0
push ecx
mov dword [esp + 0x2c], 0xfffffffb
lea edx, [esp + 0x8c]
xor cl, cl
call fcn.10029400
mov dword [esp + 0x28], 0xffffffe9
add esp, 0xc
cmp dword [esp + 0x1c], 0xfffffff4
jg 0x10029ecb
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], 4
mov dword [esp + 0x20], 0x7383cc4
mov dword [esp + 0x10], ebx
jmp 0x10029e0c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x98], 0xfc520ea
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10029df9
mov dword [esp + 0x14], ebx
jmp 0x10029eb1
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jg 0x10029ead
push ecx
lea ecx, [esp + 0x6c]
call fcn.100038f5
push ecx
push ecx
push 0x38b1
lea eax, [esp + 0x74]
mov byte [esp + 0x128], 3
push eax
lea eax, [esp + 0xb8]
mov dword [esp + 0x30], 6
push eax
push 0x26ee
mov dl, 1
call fcn.100271ea
add esp, 0x18
lea eax, [esp + 0x68]
mov edx, 0x1042
push 0x69a5
push eax
push ecx
mov cl, 1
call fcn.10029400
add esp, 0xc
call fcn.1002aa52
lea ecx, [esp + 0x68]
mov byte [esp + 0x11c], 2
call fcn.10003978
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
push 1
pop ecx
jle 0x10029e32
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x10029e1b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff4
jle 0x10029de3
or dword [esp + 0x11c], 0xffffffff
lea ecx, [esp + 0x80]
call fcn.10003978
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x10
jge 0x10029d85
mov esi, dword [esp + 0x40]
mov dl, 0xb8
mov cl, byte [edi + esi]
call fcn.10030c72
mov byte [edi + esi], al
inc edi
cmp edi, 4
jb 0x10029d74
mov dword [esp + 0x30], 0xfff9
mov dword [esp + 0x1c], 0x2aa6
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x14], 0x151d
cmp dword [esp + 0x14], 0x16a5
jle 0x10029f9f
mov esi, ebx
mov dword [esp + 0xc], ebx
mov edi, ebx
mov ecx, edi
mov dword [esp + 0x18], esi
sar esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0xb0]
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029f62
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push 0
push 1
lea ecx, [esp + 0xb8]
call fcn.10003c82
inc ebx
cmp ebx, 0x7db0
jl 0x10029f43
mov esi, dword [esp + 0xc]
inc edi
push 0
pop ebx
cmp edi, 0x105e
jl 0x10029f3b
inc esi
mov dword [esp + 0xc], esi
cmp esi, 0x23e9
jl 0x10029f39
mov dword [esp + 0x44], 1
cmp dword [esp + 0x14], 0x13de
jge 0x10029fbc
push str.gju_miaylfjd_fldu_eeutmndj_gqsgxbt_pnnvtt_ztzlecqb_dbe
call fcn.1004c11f
pop ecx
or dword [esp + 0x11c], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x18], 0x25f0
cmp dword [esp + 0x18], 0x2834
jle 0x1002a078
mov esi, ebx
mov dword [esp + 0x28], ebx
mov ebx, esi
mov dword [esp + 0x14], 0xb63
mov esi, ebx
mov dword [esp + 0xc], 0x724a
xor edi, edi
mov eax, esi
lea ecx, [esp + 0xe0]
and eax, edi
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a01b
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push 0
push 1
lea ecx, [esp + 0xe8]
call fcn.10003c82
inc edi
cmp edi, 0x20a1
jl 0x10029ffe
dec esi
dec dword [esp + 0xc]
jne 0x10029ffc
dec ebx
dec dword [esp + 0x14]
jne 0x10029ff2
mov esi, dword [esp + 0x28]
inc esi
mov dword [esp + 0x28], esi
cmp esi, 0x3f0f
jl 0x10029fe8
push 0x57f
push 0x1c9a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x18], 0x23f6
jge 0x1002a093
push str.efceob_dmnp_aquhsyzhj_osnt_hrj_hfk_pntaohtrs_fpbyu_pbby_ogommxqn_ofchu_pwtbv_bjkckoqk_bpt
call fcn.1004c11f
pop ecx
or dword [esp + 0x11c], 0xffffffff
xor edx, edx
inc edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], 0xd53d2ae4
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x48], 0x493a
mov dword [esp + 0xc], ebx
jmp 0x1002a0d0
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x54], 0x4e5477a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1002a0c0
mov eax, dword [esp + 0x30]
dec eax
neg eax
sbb eax, eax
inc eax
neg eax
jne 0x1002a0f4
mov eax, dword [esp + 0x10]
mov ecx, ebx
imul eax, dword [esp + 0x1c]
test eax, eax
je 0x1002a0f6
mov ecx, edx
mov eax, dword [esp + 0x44]
sub ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
cmp eax, 0xe6b6cd3
setg cl
add ecx, 0xffff
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp edx, eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x1002a1cb
mov dword [esp + 0x18], 0x61e
cmp dword [esp + 0x18], 0x78a
jle 0x1002a198
mov esi, ebx
mov edi, esi
mov ebx, 0x61d5
mov eax, edi
lea ecx, [esp + 0xc8]
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a172
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
xor eax, eax
lea ecx, [esp + 0xc8]
push 0
inc eax
push eax
call fcn.10003c82
dec edi
dec ebx
jne 0x1002a157
inc esi
cmp esi, 0x5899
jl 0x1002a150
mov byte [esp + 0x26], bl
cmp dword [esp + 0x18], 0x334
jge 0x1002a1b1
push str.elwxae_girxd_oaaiietss_tmrmot_aqylhghr
call fcn.1004c11f
pop ecx
or dword [esp + 0x11c], 0xffffffff
lea edx, [esp + 0x26]
push 0x2ec9
xor cl, cl
call fcn.1002a62d
jmp 0x1002a1e8
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], bl
je 0x1002a1ec
push ecx
push 0x1db
mov edx, 0x206b
xor cl, cl
call fcn.1002ac7e
pop ecx
xor edx, edx
inc edx
pop ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x14], 0x8e6b
sub eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x30]
jle 0x1002a3b9
cmp dword [esp + 0x10], ebx
je 0x1002a3b9
mov dword [esp + 0x54], edx
lea ecx, [esp + 0x8c]
push edx
call fcn.100038f5
mov dword [esp + 0x11c], 0xa
lea ecx, [esp + 0x9c]
mov dword [esp + 0x20], ebx
push 2
call fcn.100038f5
mov byte [esp + 0x11c], 0xb
xor edx, edx
mov dword [esp + 0x20], 0x5ab171c2
inc edx
mov dword [esp + 0x2c], ebx
jmp 0x1002a281
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edx
jl 0x1002a26f
lea eax, [esp + 0x9c]
push eax
push 0x1ae3
push ebx
lea eax, [esp + 0x38]
push eax
xor eax, eax
push 0x71e8
lea ecx, [eax + 1]
call fcn.1002a711
mov dword [esp + 0x20], 0x6218
add esp, 0x14
cmp dword [esp + 0xc], 0x63b4
jle 0x1002a361
mov esi, ebx
mov dword [esp + 0x28], esi
jmp 0x1002a2cc
xor ebx, ebx
mov edi, ebx
mov dword [esp + 0x18], edi
jmp 0x1002a2d6
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x20], esi
mov edi, esi
sar edi, cl
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0xf8]
xor eax, edi
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a303
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
xor eax, eax
lea ecx, [esp + 0xf8]
push 0
inc eax
push eax
call fcn.10003c82
inc esi
cmp esi, 0x372f
jl 0x1002a2e2
inc ebx
cmp ebx, 0x71a1
jl 0x1002a2e0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x4ce4
jl 0x1002a2d4
inc esi
mov dword [esp + 0x28], esi
cmp esi, 0x69fa
jl 0x1002a2ca
push 0
push 0xe96
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x43e8
push 0x71c1
push 0x61ea
xor ecx, ecx
lea eax, [esp + 0x54]
inc ecx
push 0x7472
push ecx
mov dl, cl
xor cl, cl
push eax
call fcn.1002938c
add esp, 0x18
cmp dword [esp + 0xc], 0x60d3
jge 0x1002a39f
push str.ismkzi_hckogdjv_zyrurlyk_ctwsretro_nwpkoki_wqy_ogtt_dmqj_onqfgk_tumajsd_imqh_fqqjxafme_yqybx
call fcn.1004c11f
pop ecx
lea ecx, [esp + 0x9c]
call fcn.10003978
lea ecx, [esp + 0x8c]
call fcn.10003978
jmp 0x1002a3e1
push ecx
push ecx
lea eax, [esp + 0x54]
mov dword [esp + 0x5c], ebx
push eax
push 0x317
lea eax, [esp + 0x40]
mov dword [esp + 0x5c], edx
push 0x56d4
push eax
xor dl, dl
call fcn.100271ea
add esp, 0x18
mov ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x3c]
mov dword [ecx], eax
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret