Function at 0x103d8d5
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x10619c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0xffffffff
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov word [ebp - 0x20c], cx
mov esi, 0x104
push esi
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
xor ebx, ebx
push ecx
push eax
mov ecx, edi
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ebx
call fcn.0103d308
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x103da5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x103d961
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jge 0x103da5b
mov eax, dword [section..data]
cmp eax, section..data
je 0x103d995
test byte [eax + 0x1c], 4
je 0x103d995
push ebx
push 0x100ab34
push 0x100aaac
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104e22f
xor esi, esi
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0xffffffff
je 0x103d9ac
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x20c], si
je 0x103d9c2
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, esi
jl 0x103dcc2
cmp dword [ebp + 8], esi
jne 0x103dc7e
push 0xa28
lea esi, reloc.Secur32.dll_LsaDeregisterLogonProcess
push esi
push dword [ebp - 0x628]
push dword [ebp - 0x620]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x103dcae
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103da11
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x103da38
test byte [eax + 0x1c], 4
je 0x103da38
push ebx
push 0x100aaac
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101b900
and dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
push 0x1450
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
and dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
jmp 0x103d995
xor ebx, ebx
call fcn.0104d243
test eax, eax
mov eax, 0x100ab20
je 0x103da8b
cmp dword [ebp + 8], ebx
jne 0x103da75
mov eax, 0x100ab08
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push 0x100aae8
jmp 0x103daa9
cmp dword [ebp + 8], ebx
jne 0x103da95
mov eax, 0x100ab08
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push 0x100aad0
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push esi
push eax
call fcn.0101b185
mov ebx, eax
xor esi, esi
add esp, 0x18
cmp ebx, esi
jge 0x103daf8
mov eax, dword [section..data]
cmp eax, section..data
je 0x103d997
test byte [eax + 0x1c], 4
je 0x103d997
push ebx
push 0x1003b48
push 0x100aaac
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104e22f
jmp 0x103d997
push esi
push 0x8000000
push 3
push esi
push esi
push 0x80000000
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
cmp eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
jne 0x103db67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x103db33
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x103d997
test byte [eax + 0x1c], 4
je 0x103d997
push ebx
push 0x100aaac
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101b900
jmp 0x103d997
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
jne 0x103dbb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x103db8a
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x103d997
test byte [eax + 0x1c], 4
je 0x103d997
push ebx
push 0x100aaac
push 0xe
jmp 0x103db57
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], ecx
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
jne 0x103dc49
cmp ecx, 0xa28
ja 0x103dc49
push ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push esi
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push dword [ebp - 0x628]
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
push eax
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x103d997
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x103dc20
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x103d997
test byte [eax + 0x1c], 4
je 0x103d997
push ebx
push 0x100aaac
push 0x10
jmp 0x103db57
mov eax, dword [section..data]
cmp eax, section..data
je 0x103dc74
test byte [eax + 0x1c], 4
je 0x103dc74
push ecx
push dword [ebp - 0x62c]
push 0x100aaac
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d5f9
mov ebx, 0x80004005
jmp 0x103d997
push dword [ebp - 0x628]
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push dword [ebp - 0x620]
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 1
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
jmp 0x103dcff
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 1
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
xor esi, esi
jmp 0x103dd02
push 0x1450
push esi
cmp dword [ebp + 8], esi
je 0x103dce7
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
call sub.msvcrt.dll_memset
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
jmp 0x103dcff
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
call sub.msvcrt.dll_memset
mov dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
add esp, 0xc
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], esi
pop edi
pop esi
pop ebx
je 0x103dd19
push dword [ebp - 0x620]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
xor ecx, ebp
call fcn.01041ea8
leave
ret 8