Function at 0x1000299c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, eax
add ecx, 0xfffffefe
xor ebx, ebx
xor edi, edi
xor eax, eax
xor edx, edx
cmp ecx, 0x29
ja case.0x100029c1.275
jmp dword [ecx*4 + 0x10002ec0]
push dword [ebp + 0x14]
push esi
call fcn.1000254d
jmp 0x10002e32
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push 0x8c
lea eax, [ebp - 0xa0]
push ebx
push eax
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0xa8]
call fcn.10006b57
mov edi, eax
cmp edi, ebx
jne 0x10002e9b
lea eax, [ebp - 0xa8]
push eax
push 0x10
push dword [ebp + 8]
mov esi, 0x94
call fcn.1000ae1f
test eax, eax
je 0x10002a43
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ae78
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002e9b
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x1002c1ad
call fcn.100039c4
mov edi, eax
cmp edi, ebx
jne 0x10002e9b
mov edx, dword [ebp + 8]
push ebx
push dword [0x1002b224]
push dword [ebp - 4]
call fcn.10011b12
mov eax, dword [0x1002b110]
cmp eax, ebx
je 0x10002a98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002b110], ebx
push 5
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.1000e558
mov edi, eax
cmp edi, ebx
jne 0x10002aba
call fcn.100037d5
push ebx
push dword [ebp + 0x14]
call fcn.100014bb
push dword [ebp + 8]
jmp 0x10002d1a
push ebx
jmp 0x10002ac7
push 1
push dword [ebp + 0x10]
push esi
call fcn.10001696
jmp 0x10002e3c
mov edi, 0x1002b11c
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jle 0x10002af2
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp case.0x100029c1.275
push ebx
push ebx
push 0x117
push esi
call fcn.10002151
jmp 0x10002e32
xor edi, edi
inc edi
push edi
push dword [ebp + 0x10]
mov eax, esi
call fcn.10001ac3
jmp 0x10002e3c
call fcn.10001596
jmp 0x10002e3c
call fcn.100015cf
jmp 0x10002e3c
push dword [ebp + 0x14]
push ebx
push 0x100011b3
jmp 0x10002e2d
push dword [ebp + 0x14]
push ebx
push 0x10001ec3
jmp 0x10002e2d
push dword [ebp + 0x14]
push ebx
push fcn.10001edc
jmp 0x10002e2d
push dword [ebp + 0x14]
push ebx
push 0x10001fdf
jmp 0x10002e2d
push dword [ebp + 0x10]
push esi
call fcn.1000ac09
jmp case.0x100029c1.275
lea eax, [ebp + 0xc]
push eax
call fcn.1000acbe
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, ebx
je 0x10002bb9
cmp dword [ebp + 8], ebx
je 0x10002ba4
push dword [ebp + 0xc]
push 0x10
push dword [ebp + 8]
call fcn.1000ae1f
test eax, eax
je 0x10002ba4
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ae78
push dword [ebp + 0xc]
push ebx
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x100029c1.275
push 0x12
pop edi
jmp 0x10002eac
cmp dword [0x1002b108], ebx
jne case.0x100029c1.275
cmp dword [ebp + 0x10], 0x10
jne 0x10002bde
push esi
call fcn.10001f47
jmp 0x10002e3c
push 0x57
pop edi
jmp 0x10002e9b
call fcn.10001fbd
jmp 0x10002e3c
xor eax, eax
inc eax
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 8]
push eax
call fcn.100026b7
jmp 0x10002e32
cmp esi, ebx
jne 0x10002c18
push ebx
push ebx
push ebx
push 0x1002c1a4
call fcn.10003a63
mov dword [0x1002b2a8], ebx
mov dword [0x1002b2f4], ebx
push ebx
mov dword [0x1002b2c0], ebx
call fcn.100026b7
mov edi, esi
call fcn.1001ea09
push 4
xor eax, eax
pop edx
inc eax
mov dword [0x1002b2a8], eax
mov dword [0x1002b2f4], eax
mov dword [0x1002b2c0], eax
mov eax, dword [0x1002a5c4]
and eax, 0xfffb
or eax, edx
push eax
mov eax, dword [0x1002a5c0]
push ebx
call fcn.10003c25
mov edi, eax
cmp esi, ebx
je 0x10002e3e
mov eax, dword [ebp + 0x10]
push ebx
push dword [0x1002b224]
mov edx, esi
call fcn.10011aca
push 3
push dword [ebp + 0x10]
push esi
push 0x1002c1a4
call fcn.10003a63
jmp 0x10002e3e
push dword [ebp + 0x14]
push 1
push 0x1000234e
jmp 0x10002e2d
push dword [ebp + 0x14]
push ebx
push 0x100018fb
jmp 0x10002e2d
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x14], ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], 4
jne case.0x100029c1.275
push dword [esi]
push dword [ebp + 0x14]
call fcn.100014bb
jmp case.0x100029c1.275
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [0x1002b150]
call fcn.1000e527
mov edi, eax
cmp edi, ebx
jne 0x10002e9b
push dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 0x10
push dword [ebp + 8]
call fcn.1000ae1f
test eax, eax
je 0x10002d17
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ae78
push dword [ebp + 0xc]
push ebx
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10002e9b
push dword [0x1002b150]
xor edi, edi
call fcn.1000e428
mov esi, eax
cmp esi, ebx
je 0x10002e9b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002d56
push esi
call fcn.10010764
mov edi, eax
push esi
call fcn.100012ff
jmp 0x10002e9b
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push 1
jmp 0x10002db3
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push 7
jmp 0x10002db3
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push 3
jmp 0x10002db3
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push 0xd
push dword [ebp + 0x10]
push esi
call fcn.10002674
jmp 0x10002e32
push dword [ebp + 0x14]
push ebx
push 0x100025c2
jmp 0x10002e2d
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], ebx
je case.0x100029c1.275
push ebx
push dword [ebp + 0x10]
mov edi, esi
mov dword [ebp + 8], 0x57
call fcn.1000d3a5
test eax, eax
je 0x10002e03
push 3
push dword [ebp + 0x10]
push esi
push 0x1002c1a0
call fcn.10003a63
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
jmp 0x10002e3e
mov eax, dword [0x1002b118]
test eax, eax
jne case.0x100029c1.275
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], 4
jne case.0x100029c1.275
push dword [ebp + 0x14]
push dword [esi]
push 0x10002022
call fcn.100024ac
mov edi, eax
jmp 0x10002e9b
push esi
call fcn.100027d8
mov edi, eax
cmp edi, ebx
jne 0x10002e9b
push ebx
push dword [ebp + 0x14]
call fcn.100014bb
jmp 0x10002e9b
xor eax, eax
inc eax
cmp esi, ebx
je case.0x100029c1.275
cmp dword [ebp + 0x10], 1
jbe case.0x100029c1.275
mov ecx, dword [ebp + 0x10]
mov byte [esi + ecx - 1], bl
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.1000290e
mov edi, eax
cmp edi, ebx
jne 0x10002e9b
lea eax, [ebp - 0x10]
push eax
push 0x10
push dword [ebp + 8]
push 8
pop esi
call fcn.1000ae1f
test eax, eax
je 0x10002eb5
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ae78
cmp edi, 0xffffffff
jne 0x10002ea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
je 0x10002eb5
push edi
push dword [ebp + 0x14]
call fcn.100014bb
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10