Function at 0x10042dab
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 8], edx
xor edx, edx
push edi
mov dword [ebp - 0x24], ecx
mov ebx, edx
mov dword [ebp - 0x1c], edx
mov edi, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
call fcn.10031ab4
mov esi, eax
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
jmp 0x10042e01
push 0xffffffffffffffff
push dword [esi]
push 0xffffffffffffffff
push dword [ebp - 8]
push eax
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
je 0x10042e77
mov esi, dword [esi + 0x14]
push 1
pop eax
test esi, esi
jne 0x10042de0
xor eax, eax
push eax
push 0x80
push 3
push eax
push 7
push 0x80000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10042e3e
mov ecx, eax
call fcn.10051d73
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x10042e55
mov ecx, dword [ebp - 8]
call fcn.10080e5a
test eax, eax
je 0x10043089
mov dword [ebp - 0x10], 2
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x10042e81
push 0xe
pop ebx
jmp 0x10042f14
mov ebx, 0xb7
jmp 0x10042f14
push 6
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
call fcn.10036382
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
call fcn.1003a815
mov edi, dword [ebp - 0x24]
mov ecx, edi
mov dword [esi + 8], eax
call fcn.10030ae2
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10042f57
lea ecx, [ebp - 0xc]
call fcn.100817c6
mov esi, eax
test esi, esi
jns 0x10042f4e
test esi, 0x10000000
je 0x10042f34
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
jne 0x10042f29
mov ebx, esi
mov edi, dword [ebp - 4]
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x10042efd
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10042f10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x10042f1b
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
jmp 0x10042ee1
mov edi, dword [ebp - 4]
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x10042f4a
movzx ebx, si
jmp 0x10042ee4
mov ebx, esi
jmp 0x10042ee4
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push eax
mov ecx, esi
call fcn.1004396c
test eax, eax
jne 0x10042f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10042f30
mov ecx, dword [ebp - 0x18]
mov edx, 0x10008968
call fcn.10080125
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10042f87
push 0xe
pop ebx
jmp 0x10042ee1
lea ecx, [ebp - 0x14]
push ecx
sub esp, 0x10
mov ecx, eax
call fcn.10083005
mov edx, eax
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x10042fab
mov ebx, 0x490
mov edi, dword [ebp - 4]
jmp 0x1004308c
mov ecx, edx
mov dword [ebp - 8], edx
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x10042fb6
sub ecx, dword [ebp - 0x24]
sar ecx, 1
lea eax, [ecx + 1]
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], ebx
jbe 0x10043040
mov edx, dword [ebp - 8]
xor eax, eax
cmp word [edx], ax
je 0x10043040
push 0x3d
push edx
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x10043082
mov edx, dword [ebp - 8]
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
mov ecx, esi
call fcn.10043822
test eax, eax
je 0x10043075
mov edx, dword [ebp - 0x10]
mov ecx, edx
mov dword [ebp - 8], edx
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x10043017
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sar ecx, 1
lea eax, [eax + ecx*2]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, edx
sub eax, dword [ebp - 0x18]
sar eax, 1
cmp eax, dword [ebp - 0x14]
jb 0x10042fd8
mov ecx, edi
call fcn.10031ab4
mov dword [esi + 0x14], eax
test edi, edi
je 0x1004306f
cmp dword [edi], 0xfeedf001
je 0x10043065
cmp dword [edi], 0xfeedf002
jne 0x1004306f
call fcn.10030a0e
mov edi, eax
test edi, edi
je 0x1004306f
mov dword [edi + 0x1b8], esi
xor eax, eax
mov edi, eax
jmp 0x1004308c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10042fa3
mov edi, dword [ebp - 4]
push 0xd
jmp 0x1004308b
push 0xb
pop ebx
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x100430a5
mov ecx, esi
call fcn.10081126
test eax, eax
je 0x100430a5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100430bd
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x10042ee4
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10042ee6