Function at 0x3000ea09
Capabilities:
Delete file

Disassembly:
pop edi
leave
ret 4
push 3
jmp 0x3000ea2c
mov ecx, 0xc0000000
jmp 0x3000ea4b
mov ecx, SysReAllocString
jmp 0x3000ea4b
mov ecx, dword [ebp + 8]
jmp 0x3000ea4b
xor eax, eax
jmp 0x3000ea60
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x218
push esi
xor esi, esi
sub eax, esi
push edi
mov edi, ecx
je 0x3000d09b
dec eax
jne 0x3001665b
push 2
pop edx
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x3000d0ac
dec eax
je 0x3000d0a2
dec eax
jne 0x3000d0b6
mov ecx, 0x40000000
mov eax, dword [ebp + 0x14]
sub eax, esi
je 0x3000d0be
dec eax
jne 0x30016689
xor eax, eax
inc eax
push esi
push 0x80
push edx
push esi
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [edi + 0x30], eax
je 0x300166a3
cmp dword [ebp + 0xc], esi
jne 0x3000ea95
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
lea ecx, [edi + 8]
call fcn.300115a9
pop edi
pop esi
leave
ret 0x10
dec eax
je 0x30016679
dec eax
je 0x3000d09b
dec eax
je 0x30016672
dec eax
jne 0x30016681
push 5
jmp 0x3000ea2c
push 4
jmp 0x3000ea2c
xor edx, edx
inc edx
jmp 0x3000ea2d
mov edx, dword [ebp + 8]
jmp 0x3000ea2d
dec eax
je 0x30016693
dec eax
jne 0x3001669b
push 2
jmp 0x30016695
push 3
pop eax
jmp 0x3000ea60
mov eax, dword [ebp + 8]
jmp 0x3000ea60
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
push 0x300166e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.30023192
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.30028332
nop
nop
nop
popaw
imul ebp, dword [ebp + 0x64], 0x206f7420
outsd dx, dword [esi]
jo 0x3001675a
outsb dx, byte [esi]
and byte [esi + 0x69], ah
insb byte es:[edi], dx
and byte gs:[edi], ah
and eax, 0x68002753
push 0x8d300167
test esp, esp
std
invalid
imul ebp, dword [ebp + 0x20], 0x6c696166
add byte fs:[eax + 0x72749090], dl
jns 0x300167d5
outsb dx, byte [esi]
and byte [si + 0x6f], dh
and byte [edx + 0x65], dh
popal
and byte fs:[esi + 0x72], ah
outsd dx, dword [esi]
insd dword es:[edi], dx
and byte [ecx + 0x20], ah
imul bp, word [ebp + 0x20], 0x6874
popal
je 0x300167af
jae 0x300167aa
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x300167ae
outsd dx, dword [esi]
jo 0x300167f6
outsb dx, byte [esi]
add byte [edx], dh
shr cl, 0xc5
pop esi
invalid
and byte [eax - 0x80], ch
add byte [eax], al
add byte [eax], al
add bh, bh
jne 0x300167bb
push dword [ebp + 8]
call fcn.30023914
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
call edi
test eax, eax
jne 0x3001680b
call esi
mov ebx, eax
test ebx, ebx
je 0x3001680b
mov ecx, dword [ebp + 8]
call fcn.30012f0c
push eax
push 0x30016814
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.30023192
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x30049d54
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
invalid
xor byte [ebp - 0x10b7b], cl
dec dword [ebp - 0x10b43]
call dword [eax - 0xd]
movsd dword es:[edi], dword [esi]
call fcn.30028332
pop esi
pop ebx
jmp 0x3000d096