Function at 0x102007a
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x103e010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
or dword [ebp - 0x420], 0xffffffff
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x438], eax
mov eax, dword [section..data]
mov esi, section..data
mov ebx, 0x1003ee4
cmp eax, esi
je 0x10200f3
test byte [eax + 0x1c], 4
je 0x10200f3
mov ecx, dword [edi + 0x490]
call fcn.01015d45
push eax
mov eax, dword [section..data]
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
xor eax, eax
mov word [ebp - 0x20c], ax
mov word [ebp - 0x414], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x490]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
push eax
push eax
push eax
call fcn.01015d45
push eax
call fcn.0101a670
mov dword [ebp - 0x418], eax
test eax, eax
jge 0x1020166
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x10205a5
mov eax, dword [ebp - 0x41c]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
pop ecx
mov dword [ebp - 0x424], eax
cmp eax, edi
jne 0x10201c1
mov dword [ebp - 0x418], 0x8007000e
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
jmp 0x10205a5
push edi
push dword [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax + 0x490]
push 0x1fffff
call fcn.01015d45
push eax
call fcn.0101a670
cmp eax, edi
mov dword [ebp - 0x418], eax
jge 0x1020214
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0xd
jmp 0x1020156
mov eax, dword [section..data]
test byte [eax + 0x1c], 4
je 0x1020262
cmp dword [ebp - 0x41c], edi
jbe 0x1020262
cmp eax, esi
je 0x1020259
test byte [eax + 0x1c], 4
je 0x1020259
mov eax, dword [ebp - 0x424]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push eax
mov eax, dword [section..data]
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
mov eax, dword [section..data]
inc edi
cmp edi, dword [ebp - 0x41c]
jb 0x1020227
push 0x100000
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x428], eax
test eax, eax
jne 0x10202a0
mov dword [ebp - 0x418], 0x8007000e
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push ebx
push 0xf
jmp 0x10201b1
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x45c]
rep stosd dword es:[edi], eax
and dword [ebp - 0x444], 0
inc eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x42c]
push eax
mov edi, 0x100000
push edi
push dword [ebp - 0x428]
lea eax, [ebp - 0x45c]
push 0x24
push eax
push 0x1d
mov dword [ebp - 0x458], 0xcfffffff
call dword [sym.imp.ntdll.dll_NtSystemDebugControl]
test eax, eax
jge 0x1020360
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1020320
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x418], eax
mov eax, dword [section..data]
cmp eax, esi
je 0x1020349
test byte [eax + 0x1c], 1
je 0x1020349
push dword [ebp - 0x418]
push ebx
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
push 1
push 0xba0
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
jmp 0x10205a5
push 0
push 0xba0
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmSetDWORD
cmp dword [ebp - 0x42c], edi
jbe 0x10203a9
mov dword [ebp - 0x418], 0x8007006f
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x42c]
push ebx
push 0x11
jmp 0x1020156
mov eax, dword [section..data]
cmp eax, esi
je 0x10203cc
test byte [eax + 0x1c], 4
je 0x10203cc
push dword [ebp - 0x42c]
push ebx
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
xor eax, eax
push eax
push eax
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x1003ed0
push edi
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.01016f84
mov dword [ebp - 0x418], eax
test eax, eax
jge 0x1020420
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0x13
jmp 0x1020156
push edi
mov edi, dword [ebp - 0x430]
push dword [edi + 0x69c]
lea eax, [ebp - 0x414]
push 0x1003854
push 0x104
push eax
call fcn.0100878d
add esp, 0x14
mov dword [ebp - 0x418], eax
test eax, eax
jge 0x1020475
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0x14
jmp 0x1020156
push 0
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x42c]
push dword [ebp - 0x428]
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10204d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10204ae
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x418], eax
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0x15
jmp 0x1020156
cmp dword [ebp - 0x420], 0xffffffff
je 0x10204f5
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x420], 0xffffffff
mov eax, dword [section..data]
cmp eax, esi
je 0x1020519
test byte [eax + 0x1c], 4
je 0x1020519
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008bcd
push 0
lea eax, [ebp - 0x414]
push eax
push 1
push 5
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x6a0]
call sub.wer.dll_WerpAddFile
mov dword [ebp - 0x418], eax
test eax, eax
jge 0x102055f
mov eax, dword [section..data]
cmp eax, esi
je 0x10205a5
test byte [eax + 0x1c], 1
je 0x10205a5
push dword [ebp - 0x418]
push ebx
push 0x17
jmp 0x1020156
mov ecx, dword [edi + 0x490]
push 2
call fcn.01015d45
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.0101d868
test eax, eax
jge 0x102059e
mov ecx, dword [section..data]
cmp ecx, esi
je 0x102059e
test byte [ecx + 0x1c], 1
je 0x102059e
push eax
push ebx
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01008600
and dword [ebp - 0x418], 0
xor edi, edi
cmp dword [ebp - 0x420], edi
je 0x10205c1
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x420], edi
cmp dword [ebp - 0x428], edi
je 0x10205d5
push dword [ebp - 0x428]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
xor ebx, ebx
cmp dword [ebp - 0x41c], ebx
jbe 0x1020600
mov eax, dword [ebp - 0x424]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x10205f7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
inc edi
cmp edi, dword [ebp - 0x41c]
jb 0x10205df
cmp dword [ebp - 0x424], ebx
je 0x1020614
push dword [ebp - 0x424]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x418], ebx
jge 0x1020632
cmp word [ebp - 0x20c], bx
je 0x1020632
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x434]
call fcn.0100f423
push eax
push 0x354
push dword [0x103ec44]
call sub.ntdll.dll_WinSqmIncrementDWORD
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010084d5
leave
ret