Function at 0x100166a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10023230]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0xc], ebx
lea esi, [ebx - 0xc]
neg esi
lea eax, [ebx + 4]
sbb esi, esi
and esi, eax
je 0x100166d5
lea eax, [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp dword [ebx + 0x8c], 0
je 0x1001685e
and dword [ebx + 0x8c], 0
push edi
push dword [ebx + 0x5c]
call sub.msvcrt.dll_free
pop ecx
mov ecx, dword [ebx + 0x6c]
test ecx, ecx
je 0x1001670e
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x6c], 0
mov ecx, dword [ebx + 0x70]
test ecx, ecx
je 0x10016729
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x70], 0
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x1001677c
mov edi, dword [eax]
lea ecx, [ebp - 8]
push ecx
push 0x1000adfc
push eax
mov ecx, dword [edi]
call dword [0x100241f0]
call dword [edi]
test eax, eax
js 0x1001677c
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100241f0]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10016779
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebp - 8], 0
mov ebx, dword [ebp - 0xc]
and dword [ebx + 0x74], 0
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100167d3
mov edi, dword [eax]
lea ecx, [ebp - 8]
push ecx
push 0x1000adfc
push eax
mov ecx, dword [edi]
call dword [0x100241f0]
call dword [edi]
test eax, eax
js 0x100167d3
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100241f0]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x100167d0
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebp - 8], 0
mov ebx, dword [ebp - 0xc]
and dword [ebx + 0x7c], 0
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x1001682a
mov edi, dword [eax]
lea ecx, [ebp - 8]
push ecx
push 0x1000adfc
push eax
mov ecx, dword [edi]
call dword [0x100241f0]
call dword [edi]
test eax, eax
js 0x1001682a
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x100241f0]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10016827
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebp - 8], 0
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebx + 0x78]
test ecx, ecx
je 0x10016845
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x78], 0
cmp dword [ebx + 0x64], 0
pop edi
je 0x1001685e
push dword [ebx + 0x64]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
push dword [ebx + 0x64]
call sub.msvcrt.dll_free
pop ecx
test esi, esi
je 0x1001686c
add esi, 4
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ddd9
mov esp, ebp
pop ebp
ret