Function at 0x10011420
Capabilities:
Bypass mark of the web
Delete file
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
push ebp
push esi
push edi
cmp dword [ebx], 0
je 0x1001164f
cmp dword [ebx + 4], 0
je 0x1001164f
test eax, eax
je 0x1001164f
mov edx, 1
mov ecx, eax
call fcn.10001820
test eax, eax
je 0x1001164f
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x101d1eb4
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.100100c0
mov ebp, dword [esp + 0x1c]
mov edx, 2
mov edi, dword [esp + 0x18]
lea eax, [ebp + 1]
lea ecx, [eax + 1]
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x20]
jle 0x100114d9
xor eax, eax
mov esi, edi
cmp edi, 0x101d1eb4
cmove esi, eax
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push esi
call fcn.1014d427
add esp, 8
test eax, eax
je 0x100114e2
mov edi, eax
mov eax, dword [esp + 0x14]
mov dword [edi + ebp*2], 0x3b
mov ebp, eax
test ebp, ebp
je 0x100114f3
lea eax, [ebp + 1]
push eax
push edi
call fcn.1014d5cd
add esp, 8
push edi
push str..exe_.com_.msi_.scr_.bat_.cmd_.pif_.bat_.lnk_.zip_.zipx_.rar_.7z_.alz_.egg_.cab_.bh_.001_.arj_.lha_.lzh_.pma_.ace_.arc_.aes_.zpaq_.tar_.gz_.tgz_.bz_.bz2_.tbz_.tbz2_.xz_.txz_.lzma_.tlz_.lz_.z_.jar_.war_.apk_.ipa_.xpi_.j2j_.wgt_.hv3_.isz_.i00_.msi.iso_.img_.isz_.udf_.wim_.bin_.i00_.tar_.iso_.bin_.udf_.wim_.img_.apk_.ipa_.msi_.docx_.doc_.xls_.xlsx_.ppt_.pptx_.wiz_.js_.jse_.vbs_.vbe_.wsf.url_.reg_
call fcn.1014437b
add esp, 8
test eax, eax
je 0x1001163a
test edi, edi
je 0x1001151e
cmp edi, 0x101d1eb4
je 0x1001151e
push edi
call fcn.10146720
add esp, 4
push dword [esp + 0x10]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x101d1eb4
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.100100c0
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
lea eax, [ebp + 0x11]
cmp eax, dword [esp + 0x20]
jle 0x10011580
xor ecx, ecx
mov esi, edi
cmp edi, 0x101d1eb4
mov edx, 2
cmove esi, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push esi
call fcn.1014d427
add esp, 8
test eax, eax
je 0x1001159e
mov edi, eax
movups xmm0, xmmword [str.:Zone.Identifier]
xor eax, eax
movups xmmword [edi + ebp*2], xmm0
movups xmm0, xmmword [0x101d213c]
movups xmmword [edi + ebp*2 + 0x10], xmm0
mov word [edi + ebp*2 + 0x20], ax
push 0
push 0x80
push 4
push 0
push 7
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1001160c
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push dword [ebx + 4]
push dword [ebx]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10011605
cmp dword [esp + 0x10], 0
je 0x10011605
mov eax, dword [esp + 0x24]
cmp eax, dword [ebx + 4]
jne 0x10011605
mov bl, 1
jmp 0x1001160e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor bl, bl
test edi, edi
je 0x10011623
cmp edi, 0x101d1eb4
je 0x10011623
push edi
call fcn.10146720
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10142783
add esp, 0x1c
ret 4
test edi, edi
je 0x1001164f
cmp edi, 0x101d1eb4
je 0x1001164f
push edi
call fcn.10146720
add esp, 4
mov ecx, dword [esp + 0x28]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x1c
ret 4