Function at 0x1002476b
Capabilities:
Delete file

Disassembly:
push 0xed8
mov eax, 0x1002fb0f
call fcn.1002b85a
mov ebx, ecx
mov dword [ebp - reloc.advapi32.dll_TraceMessage], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x220], ax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
mov dword [ebp - reloc.advapi32.dll_TraceMessage], esi
call sub.msvcrt.dll_memset
xor eax, eax
push edi
xor ecx, ecx
mov word [ebp - 0x838], ax
push ecx
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
push eax
mov word [ebp - 0x630], ax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
push eax
mov word [ebp - 0xa40], ax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x428], ax
xor edi, edi
lea eax, reloc.advapi32.dll_TraceMessage
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x3c
lea ecx, reloc.advapi32.dll_TraceMessage
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
call fcn.10004f6b
xor ecx, ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
mov dword [ebp - reloc.advapi32.dll_TraceMessage], ecx
mov dword [ebp - reloc.advapi32.dll_TraceMessage], ecx
lea ecx, reloc.advapi32.dll_TraceMessage
stosd dword es:[edi], eax
call fcn.1000fced
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 1
call fcn.10011711
xor eax, eax
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 2
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
call fcn.10004f6b
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 3
call fcn.10011d1f
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 4
call fcn.10003a3d
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 5
call fcn.1001e217
lea edi, [ebx + 0x7c]
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
cmp dword [edi], eax
je 0x100248bb
xor esi, esi
inc esi
jmp 0x1002525e
push eax
push edi
push dword [ebx + 0x29c]
push esi
call fcn.10003a3d
test eax, eax
je 0x100248d1
xor eax, eax
mov dword [edi], eax
mov eax, dword [edi]
push esi
push 0x10001020
push 0x10006950
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov edi, 0x104
lea eax, reloc.advapi32.dll_TraceMessage
push edi
push eax
call fcn.10003a3d
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x10024931
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
jmp 0x10025220
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x100252ec
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x80000002
call fcn.10003a3d
test eax, eax
jne 0x1002498f
cmp dword [ebp - reloc.advapi32.dll_TraceMessage], 1
jne 0x1002498f
xor esi, esi
inc esi
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002525e
test byte [eax + 0x1c], 4
je 0x1002525e
push 0x1000c0b0
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
jmp 0x1002525e
push dword [ebp - 0xd50]
lea eax, reloc.advapi32.dll_TraceMessage
push 0x1000bfb0
push edi
push eax
call fcn.10003a3d
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x100249d7
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x3f
jmp 0x10024921
lea eax, reloc.advapi32.dll_TraceMessage
push eax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10011261
mov esi, eax
test esi, esi
js 0x10025224
push 0x10
call fcn.10003a3d
pop ecx
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x10024a19
mov ecx, eax
call fcn.1002a6e5
jmp 0x10024a1b
xor eax, eax
mov edi, eax
mov byte [ebp - 4], 6
test edi, edi
jne 0x10024a2f
mov esi, 0x8007000e
jmp 0x10025224
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
push edi
call fcn.10003a3d
push dword [ebp - 0xd54]
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
push dword [ebp - 0xd50]
add ecx, 8
mov eax, dword [ecx]
push 0x100030ac
call dword [eax + reloc.advapi32.dll_RegisterTraceGuidsW]
mov esi, eax
test esi, esi
js 0x10025224
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
add ecx, 8
mov eax, dword [ecx]
push 0x1002531c
call dword [eax + 0x24]
mov eax, dword [edi]
push 0x1002532c
mov ecx, edi
call dword [eax + 0x14]
mov esi, eax
test esi, esi
js 0x10025224
mov edi, dword [ebp - reloc.advapi32.dll_TraceMessage]
push edi
call fcn.10003a3d
test al, 0x10
je 0x10024aa2
xor eax, eax
inc eax
jmp 0x10024aa8
mov eax, dword [ebp - reloc.advapi32.dll_TraceMessage]
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.100113aa
push dword [ebx + 0x294]
push dword [ebx + 0x290]
call fcn.10003a3d
test eax, eax
jne 0x10024af2
xor esi, esi
inc esi
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002525e
test byte [eax + 0x1c], 4
je 0x1002525e
push 0x1000c0b0
push 0x40
jmp 0x1002497f
xor eax, eax
cmp dword [ebx + reloc.advapi32.dll_TraceMessage], eax
mov eax, 0x1000c1a8
jne 0x10024b06
mov eax, 0x1000c1b8
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10003a3d
push 0x10025340
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push dword [ebx + 0x40]
xor ecx, ecx
push ecx
push dword [ebx + 0x5c]
lea eax, reloc.advapi32.dll_TraceMessage
push dword [ebx + 0x298]
push ebx
push 0x10032490
push eax
push ecx
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10003a3d
mov esi, eax
test esi, esi
js 0x10025224
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1000f4a9
lea ecx, reloc.advapi32.dll_TraceMessage
mov esi, eax
call fcn.1000f4a9
cmp eax, esi
je 0x10024b77
mov esi, 0x8007003a
jmp 0x10025224
lea eax, reloc.advapi32.dll_TraceMessage
push eax
xor eax, eax
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10003a3d
mov esi, eax
test esi, esi
js 0x10025224
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
call fcn.1000fa75
cmp eax, 1
jne 0x10024b6d
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
lea eax, reloc.advapi32.dll_TraceMessage
push eax
xor eax, eax
push eax
call fcn.10003a3d
mov esi, eax
test esi, esi
js 0x10025224
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
mov eax, dword [ecx]
push 0x1000c1c8
call dword [eax + 4]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10024b6d
mov esi, dword [ebp - reloc.advapi32.dll_TraceMessage]
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call dword [eax + 0x14]
movzx eax, word [ebp - 0x18]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
mov eax, dword [ebp - reloc.advapi32.dll_TraceMessage]
cmp dword [ebp - reloc.advapi32.dll_TraceMessage], eax
je 0x100248b3
lea eax, reloc.advapi32.dll_TraceMessage
push eax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push dword [ebx + 0x29c]
push edi
call fcn.10003a3d
mov esi, eax
test esi, esi
je 0x10024c71
jle 0x10024c4a
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x41
jmp 0x10024921
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x104
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10003a3d
mov esi, eax
test esi, esi
jns 0x10024cb6
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x42
jmp 0x10024921
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10003a3d
test eax, eax
jne 0x10024d03
mov esi, 0x80004005
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025224
test byte [eax + 0x1c], 1
je 0x10025224
lea ecx, reloc.advapi32.dll_TraceMessage
push ecx
push 0x1000c0b0
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
jmp 0x10025224
push dword [ebx + 0x294]
push dword [ebx + 0x290]
call fcn.10003a3d
test eax, eax
jne 0x10024d41
xor esi, esi
inc esi
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002525e
test byte [eax + 0x1c], 4
je 0x1002525e
push 0x1000c0b0
push 0x44
jmp 0x1002497f
push 0x1000bda4
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10003a3d
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10003a3d
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1001242e
neg eax
sbb edi, edi
push 0x104
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x10025358
lea eax, reloc.advapi32.dll_TraceMessage
push eax
and edi, 0x20
push 0x80000002
or edi, 2
call fcn.10003a3d
test eax, eax
je 0x10024fec
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10004765
xor esi, esi
test eax, eax
je 0x10024def
cmp word [eax], si
je 0x10024def
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1000503e
mov esi, eax
test esi, esi
jns 0x10024e52
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x45
jmp 0x10024921
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10005871
test eax, eax
je 0x10024fb6
cmp word [eax], si
je 0x10024fb6
push eax
push 0x100030ac
lea eax, reloc.advapi32.dll_TraceMessage
push 0x100252e0
push eax
call fcn.10003a3d
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10024e52
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x47
jmp 0x10024921
xor eax, eax
lea ecx, reloc.advapi32.dll_TraceMessage
cmp dword [ebx + 0x5c], eax
je 0x10024ec7
call fcn.10012412
mov esi, 0x10025378
test eax, eax
jne 0x10024e72
mov esi, 0x10025384
push dword [ebp - 0xd50]
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.100031bf
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1000476f
push eax
push esi
push dword [ebx + 0x5c]
lea eax, reloc.advapi32.dll_TraceMessage
push 0x10025390
push 0x104
push eax
call fcn.10003a3d
add esp, 0x20
lea ecx, reloc.advapi32.dll_TraceMessage
mov esi, eax
call fcn.10012412
mov edi, eax
neg edi
sbb edi, edi
neg edi
jmp 0x10024f8b
call fcn.10012424
lea ecx, reloc.advapi32.dll_TraceMessage
test ax, ax
je 0x10024ee1
call fcn.10012424
movzx esi, ax
jmp 0x10024ef5
call fcn.10012412
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x16b
add esi, 0x50
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10012412
mov dword [ebp - 0xd54], 0x10025378
test eax, eax
jne 0x10024f18
mov dword [ebp - 0xd54], 0x10025384
push dword [ebp - 0xd50]
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.100031bf
push eax
push esi
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1000476f
push eax
push dword [ebp - 0xd54]
lea eax, reloc.advapi32.dll_TraceMessage
push 0x100253c4
push 0x104
push eax
call fcn.10003a3d
add esp, 0x20
lea ecx, reloc.advapi32.dll_TraceMessage
mov esi, eax
call fcn.10012412
test eax, eax
je 0x10024f8b
lea ecx, reloc.advapi32.dll_TraceMessage
or edi, 1
call fcn.1001241b
test eax, eax
jne 0x10024f87
test byte [ebx + 0x298], 1
jne 0x10024f87
push 0x40
pop eax
jmp 0x10024f89
xor eax, eax
or edi, eax
test esi, esi
jns 0x10024fec
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push InitializeCriticalSection
jmp 0x10024921
mov esi, 0x80070035
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025224
test byte [eax + 0x1c], 1
je 0x10025224
push 0x1000c0b0
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
jmp 0x10025224
push dword [ebx + 0x40]
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10003a3d
mov esi, eax
test esi, esi
js 0x10025224
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push edi
lea eax, reloc.advapi32.dll_TraceMessage
push eax
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10003a3d
mov esi, eax
test esi, esi
js 0x10025224
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1001e36c
cmp eax, 0xc8
jne 0x10024b6d
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.1001e3b8
lea ecx, reloc.advapi32.dll_TraceMessage
mov esi, eax
call fcn.1001e3ac
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
mov edx, eax
mov dword [ebx + 0x7c], ecx
test edx, edx
je 0x100251f7
cmp esi, 0x10
jbe 0x100251f7
cmp dword [edx], reloc.advapi32.dll_TraceMessage
je 0x100250a8
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002509e
test byte [eax + 0x1c], 1
je 0x1002509e
push 0x1000c0b0
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov esi, 0x10000a0b
jmp 0x1002525e
xor eax, eax
lea edi, [esi - 0x10]
mov ecx, eax
lea eax, [edx + 0x10]
mov dword [ebp - reloc.advapi32.dll_TraceMessage], edi
mov dword [ebp - reloc.advapi32.dll_TraceMessage], eax
test edi, edi
je 0x100250dc
mov ebx, eax
movzx eax, byte [ebx]
imul ecx, ecx, 0x65
add ecx, eax
inc ebx
dec edi
jne 0x100250c4
mov ebx, dword [ebp - reloc.advapi32.dll_TraceMessage]
lea edi, [esi - 0x10]
lea eax, [edx + 0x10]
cmp dword [edx + 8], ecx
je 0x100250fc
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002509e
test byte [eax + 0x1c], 1
je 0x1002509e
push 0x1000c0b0
push 0x4b
jmp 0x10025093
cmp dword [edx + 4], esi
je 0x1002511f
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002509e
test byte [eax + 0x1c], 1
je 0x1002509e
push 0x1000c0b0
push 0x4c
jmp 0x10025093
push dword [ebx + 0x40]
lea ecx, reloc.advapi32.dll_TraceMessage
push edi
push eax
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call fcn.10027cb3
mov esi, eax
test esi, esi
js 0x10025224
push dword [ebp - 0xd4c]
xor ecx, ecx
push 0x1000c024
push ecx
lea eax, reloc.advapi32.dll_TraceMessage
push eax
xor eax, eax
cmp dword [ebx + reloc.advapi32.dll_TraceMessage], ecx
setne al
add eax, 0x80000001
push eax
call fcn.10003a3d
mov esi, eax
test esi, esi
je 0x100251a6
jle 0x1002517f
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x4d
jmp 0x10024921
lea eax, reloc.advapi32.dll_TraceMessage
push eax
push 0x104
lea eax, [ebx + 0x84]
push eax
call fcn.10003a3d
mov esi, eax
test esi, esi
jns 0x100251e3
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x10025220
test byte [eax + 0x1c], 1
je 0x10025220
push esi
push 0x1000c0b0
push 0x4e
jmp 0x10024921
mov eax, dword [ebp - reloc.advapi32.dll_TraceMessage]
mov ecx, dword [ebp - reloc.advapi32.dll_TraceMessage]
mov dword [ecx], eax
xor eax, eax
mov esi, eax
jmp 0x1002525e
mov eax, dword [0x100320c8]
cmp eax, 0x100320c8
je 0x1002521b
test byte [eax + 0x1c], 1
je 0x1002521b
push 0x1000c0b0
push reloc.kernel32.dll_InitializeCriticalSection
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003a3d
mov esi, 0x10000a0b
test esi, esi
jns 0x1002525e
cmp word [ebp - 0x428], 0
je 0x10025252
push 0x1000c024
lea eax, reloc.advapi32.dll_TraceMessage
push eax
xor eax, eax
xor ecx, ecx
cmp dword [ebx + reloc.advapi32.dll_TraceMessage], ecx
setne al
add eax, 0x80000001
push eax
call fcn.10003a3d
lea eax, reloc.advapi32.dll_TraceMessage
push eax
call sub.kernel32.dll_DeleteFileW
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10012a99
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 5
call fcn.1001e2e0
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 4
call fcn.10012649
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 3
call fcn.10011db1
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 2
call fcn.10004fde
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], 1
call fcn.1001175a
xor eax, eax
lea ecx, reloc.advapi32.dll_TraceMessage
mov byte [ebp - 4], al
call fcn.1000fd84
or dword [ebp - 4], 0xffffffff
lea ecx, reloc.advapi32.dll_TraceMessage
call fcn.10004fde
mov eax, esi
call fcn.1002b897
ret 8