Function at 0x1089ccb
Capabilities:
Delete file

Disassembly:
push 0xa54
mov eax, 0x109f7e7
call fcn.010399a9
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa3c], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push edi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0xa38], ax
lea eax, [ebp - 0xa36]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x3c
lea ecx, [ebp - 0xa60]
mov dword [ebp - 0xa40], edi
call fcn.0107fa2d
lea esi, [ebx + 0x6c]
mov eax, dword [esi]
mov dword [ebp - 4], edi
mov dword [ebp - 0xa44], esi
cmp dword [ebp + 0xc], eax
jne 0x1089d8e
xor esi, esi
inc esi
jmp 0x108a314
cmp eax, edi
jne 0x1089de5
push edi
push esi
push dword [ebx + 0x280]
push dword [ebp - 0xa3c]
call fcn.01082802
cmp eax, edi
jne 0x1089de5
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi]
jne 0x1089de5
xor esi, esi
inc esi
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a314
test byte [eax + 0x1c], 4
je 0x108a314
push ecx
push 0x1012400
push 0x6d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010160ad
jmp 0x108a314
push dword [ebp - 0xa3c]
mov edi, 0x104
push 0x1011cd8
push 0x101227c
lea eax, [ebp - 0xa38]
push edi
push eax
call fcn.0103e1ed
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x1089e42
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x6e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010160ad
jmp 0x108a2d7
lea eax, [ebp - 0xa40]
push eax
push 0x10126fc
lea eax, [ebp - 0xa38]
push eax
push 0x80000002
call fcn.0108bb48
test eax, eax
jne 0x1089e9f
xor esi, esi
inc esi
cmp dword [ebp - 0xa40], esi
jne 0x1089e9f
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a314
test byte [eax + 0x1c], 4
je 0x108a314
push 0x1012400
push 0x6f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b76
jmp 0x108a314
push dword [ebp - 0xa3c]
lea eax, [ebp - 0x628]
push 0x1012070
push edi
push eax
call fcn.0103e1ed
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x1089ee7
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x70
jmp 0x1089e32
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebx + 0x280]
push dword [ebp - 0xa3c]
call fcn.01082802
test eax, eax
je 0x1089f3c
jle 0x1089f13
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x71
jmp 0x1089e32
push edi
lea eax, [ebp - 0x830]
push eax
push 0x10126dc
lea eax, [ebp - 0xa38]
push eax
push 0x80000002
call fcn.0108ba03
test eax, eax
je 0x1089fa9
push dword [ebp + 0xc]
lea eax, [ebp - 0x830]
push dword [ebp - 0xa3c]
push 0x1012670
push edi
push eax
call fcn.0103e1ed
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x1089fa9
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x72
jmp 0x1089e32
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0101d307
mov esi, eax
test esi, esi
jge 0x1089fea
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x73
jmp 0x1089e32
lea eax, [ebp - 0x420]
push eax
call fcn.0108c7be
test eax, eax
jne 0x108a037
mov esi, 0x80004005
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2db
test byte [eax + 0x1c], 1
je 0x108a2db
lea ecx, [ebp - 0x420]
push ecx
push 0x1012400
push 0x74
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b9c
jmp 0x108a2db
push 0x1012660
lea eax, [ebp - 0x420]
push eax
call fcn.0108d25f
mov ecx, dword [ebx + 0x60]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.01086f95
mov esi, eax
test esi, esi
jge 0x108a097
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x75
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010160ad
jmp 0x108a2d7
mov ecx, dword [ebx + 0x60]
call fcn.01080458
cmp eax, 0xc8
je 0x108a0d7
mov ecx, dword [0x10a60d8]
cmp ecx, 0x10a60d8
je 0x108a0cd
test byte [ecx + 0x1c], 1
je 0x108a0cd
push eax
push 0x1012400
push 0x76
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010160ad
mov esi, 0x80004005
jmp 0x108a2db
mov ecx, dword [ebx + 0x60]
call fcn.01080464
mov ecx, dword [ebx + 0x60]
mov esi, eax
call fcn.01080470
mov dword [ebp - 0xa48], eax
test esi, esi
je 0x108a2ae
test eax, eax
je 0x108a2ae
cmp dword [esi], 0x434d5153
je 0x108a135
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a12b
test byte [eax + 0x1c], 1
je 0x108a12b
push 0x1012400
push 0x78
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b76
mov esi, 0x10000a0b
jmp 0x108a314
add eax, 0xfffffff0
lea ecx, [esi + 0x10]
push eax
push ecx
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa50], ecx
call fcn.010871c9
cmp dword [esi + 8], eax
je 0x108a16e
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a12b
test byte [eax + 0x1c], 1
je 0x108a12b
push 0x1012400
push 0x79
jmp 0x108a120
mov eax, dword [ebp - 0xa48]
cmp dword [esi + 4], eax
je 0x108a194
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a12b
test byte [eax + 0x1c], 1
je 0x108a12b
push 0x1012400
push 0x7a
jmp 0x108a120
push dword [ebx + 0x44]
lea eax, [ebp - 0x218]
push dword [ebp - 0xa4c]
lea ecx, [ebp - 0xa60]
push dword [ebp - 0xa50]
push eax
call fcn.01089526
mov esi, eax
test esi, esi
jl 0x108a2db
push dword [ebp + 0xc]
lea eax, [ebp - 0x628]
push 0x101216c
push 0
push eax
xor eax, eax
cmp dword [ebx + 0x280], eax
setne al
add eax, 0x80000001
push eax
call fcn.0108bc8f
test eax, eax
je 0x108a21f
jle 0x108a1f6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x7b
jmp 0x1089e32
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebx + 0x74]
push eax
call fcn.0101d307
mov esi, eax
test esi, esi
jge 0x108a25d
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d7
test byte [eax + 0x1c], 1
je 0x108a2d7
push esi
push 0x1012400
push 0x7c
jmp 0x1089e32
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a29f
test byte [eax + 0x1c], 4
je 0x108a29f
mov ecx, dword [ebx + 0x60]
call fcn.01080470
push eax
lea eax, [ebp - 0x830]
push eax
push dword [ebp + 0xc]
mov eax, dword [0x10a60d8]
push dword [ebp - 0xa3c]
push 0x1012400
push 0x7d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0108721b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xa44]
mov dword [ecx], eax
xor esi, esi
jmp 0x108a314
mov eax, dword [0x10a60d8]
cmp eax, 0x10a60d8
je 0x108a2d2
test byte [eax + 0x1c], 1
je 0x108a2d2
push 0x1012400
push 0x77
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015b76
mov esi, 0x80004005
test esi, esi
jge 0x108a314
cmp word [ebp - 0x628], 0
je 0x108a307
push 0x101216c
lea eax, [ebp - 0x628]
push eax
xor eax, eax
cmp dword [ebx + 0x280], eax
setne al
add eax, 0x80000001
push eax
call fcn.0108c021
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.0107fa3f
mov eax, esi
call fcn.01039a3b
ret 8