Function at 0x10182f9
Capabilities:
Delete file

Disassembly:
push 0xa54
mov eax, 0x103226d
call fcn.01011faf
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa3c], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push edi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0xa38], ax
lea eax, [ebp - 0xa36]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x3c
lea ecx, [ebp - 0xa60]
mov dword [ebp - 0xa40], edi
call fcn.0101cfc9
lea esi, [ebx + 0x6c]
mov eax, dword [esi]
mov dword [ebp - 4], edi
mov dword [ebp - 0xa44], esi
cmp dword [ebp + 0xc], eax
jne 0x10183bc
xor esi, esi
inc esi
jmp 0x1018942
cmp eax, edi
jne 0x1018413
push edi
push esi
push dword [ebx + 0x280]
push dword [ebp - 0xa3c]
call fcn.010200c8
cmp eax, edi
jne 0x1018413
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi]
jne 0x1018413
xor esi, esi
inc esi
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018942
test byte [eax + 0x1c], 4
je 0x1018942
push ecx
push 0x1003a20
push 0x6d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1018942
push dword [ebp - 0xa3c]
mov edi, 0x104
push 0x1002610
push 0x10025e8
lea eax, [ebp - 0xa38]
push edi
push eax
call fcn.01006a35
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x1018470
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x6e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1018905
lea eax, [ebp - 0xa40]
push eax
push 0x1003d14
lea eax, [ebp - 0xa38]
push eax
push 0x80000002
call fcn.01012bef
test eax, eax
jne 0x10184cd
xor esi, esi
inc esi
cmp dword [ebp - 0xa40], esi
jne 0x10184cd
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018942
test byte [eax + 0x1c], 4
je 0x1018942
push 0x1003a20
push 0x6f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x1018942
push dword [ebp - 0xa3c]
lea eax, [ebp - 0x628]
push 0x1003ca0
push edi
push eax
call fcn.01006a35
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x1018515
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x70
jmp 0x1018460
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebx + 0x280]
push dword [ebp - 0xa3c]
call fcn.010200c8
test eax, eax
je 0x101856a
jle 0x1018541
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x71
jmp 0x1018460
push edi
lea eax, [ebp - 0x830]
push eax
push 0x1003c7c
lea eax, [ebp - 0xa38]
push eax
push 0x80000002
call fcn.01012aaa
test eax, eax
je 0x10185d7
push dword [ebp + 0xc]
lea eax, [ebp - 0x830]
push dword [ebp - 0xa3c]
push 0x1003c10
push edi
push eax
call fcn.01006a35
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x10185d7
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x72
jmp 0x1018460
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.010069ac
mov esi, eax
test esi, esi
jge 0x1018618
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x73
jmp 0x1018460
lea eax, [ebp - 0x420]
push eax
call fcn.010137b9
test eax, eax
jne 0x1018665
mov esi, 0x80004005
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018909
test byte [eax + 0x1c], 1
je 0x1018909
lea ecx, [ebp - 0x420]
push ecx
push 0x1003a20
push 0x74
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
jmp 0x1018909
push 0x1003a14
lea eax, [ebp - 0x420]
push eax
call fcn.010147c7
mov ecx, dword [ebx + 0x60]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.01024858
mov esi, eax
test esi, esi
jge 0x10186c5
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x75
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1018905
mov ecx, dword [ebx + 0x60]
call fcn.0101dade
cmp eax, 0xc8
je 0x1018705
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10186fb
test byte [ecx + 0x1c], 1
je 0x10186fb
push eax
push 0x1003a20
push 0x76
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
mov esi, 0x80004005
jmp 0x1018909
mov ecx, dword [ebx + 0x60]
call fcn.0101daea
mov ecx, dword [ebx + 0x60]
mov esi, eax
call fcn.0101daf6
mov dword [ebp - 0xa48], eax
test esi, esi
je 0x10188dc
test eax, eax
je 0x10188dc
cmp dword [esi], 0x434d5153
je 0x1018763
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018759
test byte [eax + 0x1c], 1
je 0x1018759
push 0x1003a20
push 0x78
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
mov esi, 0x10000a0b
jmp 0x1018942
add eax, 0xfffffff0
lea ecx, [esi + 0x10]
push eax
push ecx
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa50], ecx
call fcn.01015721
cmp dword [esi + 8], eax
je 0x101879c
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018759
test byte [eax + 0x1c], 1
je 0x1018759
push 0x1003a20
push 0x79
jmp 0x101874e
mov eax, dword [ebp - 0xa48]
cmp dword [esi + 4], eax
je 0x10187c2
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018759
test byte [eax + 0x1c], 1
je 0x1018759
push 0x1003a20
push 0x7a
jmp 0x101874e
push dword [ebx + 0x44]
lea eax, [ebp - 0x218]
push dword [ebp - 0xa4c]
lea ecx, [ebp - 0xa60]
push dword [ebp - 0xa50]
push eax
call fcn.01017b54
mov esi, eax
test esi, esi
jl 0x1018909
push dword [ebp + 0xc]
lea eax, [ebp - 0x628]
push 0x100299c
push 0
push eax
xor eax, eax
cmp dword [ebx + 0x280], eax
setne al
add eax, 0x80000001
push eax
call fcn.01012d36
test eax, eax
je 0x101884d
jle 0x1018824
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x7b
jmp 0x1018460
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebx + 0x74]
push eax
call fcn.010069ac
mov esi, eax
test esi, esi
jge 0x101888b
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018905
test byte [eax + 0x1c], 1
je 0x1018905
push esi
push 0x1003a20
push 0x7c
jmp 0x1018460
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10188cd
test byte [eax + 0x1c], 4
je 0x10188cd
mov ecx, dword [ebx + 0x60]
call fcn.0101daf6
push eax
lea eax, [ebp - 0x830]
push eax
push dword [ebp + 0xc]
mov eax, dword [0x1035014]
push dword [ebp - 0xa3c]
push 0x1003a20
push 0x7d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101583b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xa44]
mov dword [ecx], eax
xor esi, esi
jmp 0x1018942
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1018900
test byte [eax + 0x1c], 1
je 0x1018900
push 0x1003a20
push 0x77
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
mov esi, 0x80004005
test esi, esi
jge 0x1018942
cmp word [ebp - 0x628], 0
je 0x1018935
push 0x100299c
lea eax, [ebp - 0x628]
push eax
xor eax, eax
cmp dword [ebx + 0x280], eax
setne al
add eax, 0x80000001
push eax
call fcn.010130c8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.0101cfdb
mov eax, esi
call fcn.01012003
ret 8