Function at 0x101c83d
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push 0xbc
push 0x10022a0
call fcn.01032098
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], eax
push 0x10402a4
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call ebx
push 0x104030c
call ebx
push 0x10402c0
call ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [ebp - 0x38], eax
xor eax, eax
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp + 0xc]
call fcn.01018f4d
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x101c61d
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov dword [edi], reloc.msvcrt.dll___p__fmode
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [reloc.msvcrt.dll___p__fmode], edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
test byte [ecx + 0x848], 1
je 0x101c524
push edi
push eax
call fcn.0101acc9
test eax, eax
jne 0x101c53d
jmp 0x101c61d
push 0
mov ebx, esi
mov eax, edi
call fcn.0101a0a9
test eax, eax
je 0x101c61d
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x20]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + reloc.msvcrt.dll___p__fmode]
test eax, eax
jbe 0x101c5a7
push eax
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.01019f07
test eax, eax
jne 0x101c56a
and dword [ebp - 0x28], eax
jmp 0x101c61d
mov dword [ebp - 0x54], reloc.ADVAPI32.dll_EnumDependentServicesW
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
add eax, 0x8a0
mov ecx, dword [eax]
mov dword [ebp - 0x50], ecx
cmp dword [eax], 0
je 0x101c598
push ecx
call fcn.01035a36
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x101c59c
jmp 0x101c61d
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
jmp 0x101c5af
and dword [ebp - 0x28], 0
and dword [ebp - 0x30], 0
mov eax, ecx
shl eax, 2
push eax
call fcn.01035a36
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x101c61d
lea eax, [edi + 0x24]
mov dword [ebp - 0x48], eax
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x40]
push eax
call fcn.01018a86
test eax, eax
je 0x101c61d
mov eax, dword [ebp - 0x38]
push dword [eax + 0x30]
add eax, 0x78
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.01018a4b
test eax, eax
je 0x101c61d
mov eax, dword [ebp - 0x38]
add eax, 0x9c
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.010189ce
test eax, eax
je 0x101c61d
lea eax, [ebp - 0x70]
push eax
add esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x101c62b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x101c8af
mov edi, 0x104163c
push edi
call ebx
mov ebx, dword [reloc.msvcrt.dll___p__fmode]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x40]
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
push ecx
sub esp, 0x10
lea esi, [ebp - 0x70]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [ebp - 0x88]
push ecx
mov ecx, dword [ebp - 0x38]
push dword [ecx + 0x34]
mov edi, dword [ebp + 0xc]
push dword [edi + 0x14]
push dword [edi + 0x18]
call dword [eax + 0x880]
mov dword [ebp - 0x60], eax
test eax, eax
jge 0x101c6db
cmp eax, 0x80040006
je 0x101c6cf
cmp eax, 0x8004000b
je 0x101c6c3
cmp eax, 0x8004000c
je 0x101c6b7
cmp eax, 0x8004000d
jle 0x101c6b7
cmp eax, 0x8004000f
jle 0x101c6cf
mov dword [ebp - 0x1c], 0x1f
jmp 0x101c8a8
mov dword [ebp - 0x1c], reloc.ADVAPI32.dll_RevertToSelf
jmp 0x101c8a8
mov dword [ebp - 0x1c], 0x57
jmp 0x101c8a8
xor esi, esi
inc esi
mov dword [ebp - 0x44], esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call fcn.0101c3ec
test eax, eax
jne 0x101c707
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x101c8ac
jmp 0x101c746
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x101c755
mov eax, dword [edi + 0x1c]
mov edx, dword [eax + reloc.msvcrt.dll___p__fmode]
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
jbe 0x101c740
lea eax, [ecx + 4]
cmp dword [eax - 4], 0xc
jne 0x101c74e
mov ecx, dword [eax]
cmp ecx, edx
ja 0x101c74e
test ecx, ecx
je 0x101c74e
cmp dword [eax + 4], 0
je 0x101c74e
inc ebx
add eax, 0xc
cmp ebx, dword [ebp - 0x24]
jb 0x101c721
mov eax, esi
test eax, eax
jne 0x101c752
mov dword [ebp - 0x1c], esi
jmp 0x101c8ac
xor eax, eax
jmp 0x101c742
mov ecx, dword [ebp - 0x28]
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x48]
mov ebx, dword [eax]
cmp ebx, eax
je 0x101c85c
mov dword [ebp - 0x3c], ecx
mov esi, ebx
mov ebx, dword [ebx]
push 0
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + reloc.msvcrt.dll___p__fmode]
and eax, 0x80
push eax
push edi
push dword [esi + 8]
call fcn.01019d01
test eax, eax
je 0x101c874
mov ecx, dword [reloc.msvcrt.dll___p__fmode]
mov dword [eax], reloc.msvcrt.dll___p__fmode
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [reloc.msvcrt.dll___p__fmode], eax
mov dword [eax + reloc.msvcrt.dll___p__fmode], 1
mov ecx, dword [esi + 8]
mov dword [ecx + 0x20], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ecx + edx*4]
mov dword [eax + 0x10], ecx
push eax
push ecx
mov eax, dword [edi + 0x1c]
push dword [eax + 0x850]
call fcn.0102bc6b
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x101c8ac
cmp dword [ebp - 0x28], eax
je 0x101c819
push eax
mov eax, dword [esi + 8]
mov edi, 0x5fc
add eax, edi
push eax
call fcn.01018998
mov ecx, dword [esi + 8]
add ecx, edi
mov eax, dword [ebp - 0x3c]
call fcn.0101892d
test eax, eax
je 0x101c874
push 2
mov ecx, dword [esi + 8]
call fcn.0101e64b
push dword [esi + 8]
call fcn.0101e1c0
test eax, eax
je 0x101c874
push 2
mov ecx, dword [esi + 8]
call fcn.0101e64b
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x101c840
cmp dword [eax + 4], 0
je 0x101c840
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x20]
call fcn.01018fb8
test eax, eax
je 0x101c874
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x1c], eax
inc dword [ebp - 0x34]
add dword [ebp - 0x3c], 0xc
mov edi, dword [ebp + 0xc]
cmp ebx, dword [ebp - 0x48]
jne 0x101c769
mov eax, dword [edi + 0x1c]
cmp dword [eax + reloc.msvcrt.dll___p__fmode], 0
jbe 0x101c87f
mov esi, dword [ebp - 0x20]
call fcn.010190e1
test eax, eax
jne 0x101c87f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x101c8ac
push 1
push dword [ebp - 0x34]
push 1
push edi
call fcn.010193a7
xor esi, esi
jmp 0x101c8ef
or dword [ebp - 4], reloc.msvcrt.dll___p__fmode
mov edi, dword [ebp - 0x20]
xor esi, esi
push esi
push dword [ebp + 0xc]
call fcn.01024e28
cmp dword [ebp - 0x44], esi
je 0x101c8cd
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
call fcn.01018e99
push edi
call fcn.0101b552
cmp edi, esi
je 0x101c8e6
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov dword [edi], esi
mov dword [edi + 4], esi
push 1
mov eax, edi
call fcn.0101a2b5
cmp dword [ebp - 0x30], esi
je 0x101c8fc
push dword [ebp - 0x4c]
call fcn.01035abf
cmp dword [ebp - 0x28], esi
je 0x101c90c
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.010188f2
push dword [ebp - 0x2c]
call fcn.01035abf
push 0x10402c0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push 0x104030c
call esi
push 0x10402a4
call esi
cmp dword [ebp - 0x1c], 0
je 0x101c93e
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 0x1c], eax
sete al
call fcn.010320d3
ret 8