Function at 0x101029b
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x23c], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], esi
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x244]
mov dword [ebp - 0x248], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x22c], esi
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x21c], esi
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
cmp ebx, esi
jne 0x1010355
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10109bd
test byte [eax + 0x1c], 1
je 0x10109bd
push 0x1002b5c
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x10109bd
cmp dword [ebp - 0x23c], esi
jne 0x1010380
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10109bd
test byte [eax + 0x1c], 1
je 0x10109bd
push 0x1002b5c
push 0x2d
jmp 0x1010345
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x234]
push edi
push ebx
mov ecx, esi
call fcn.0100bdc0
mov esi, dword [esi + eax*4]
mov ebx, 0x1002b5c
jmp 0x10103b4
push dword [ebp - 0x238]
push esi
call fcn.0100c696
test eax, eax
je 0x10103b1
cmp dword [esi + 0x10], edi
je 0x10103ff
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x101039c
mov ecx, dword [ebp - 0x234]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x238]
call fcn.0100cc45
mov edi, eax
test edi, edi
jge 0x101040f
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x2e
jmp 0x101083a
mov eax, dword [esi + 0x18]
xor edi, edi
mov dword [ebp - 0x230], eax
jmp 0x101084d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x844
test eax, eax
je 0x10104fb
push esi
call fcn.01011b9e
pop ecx
test eax, eax
je 0x101043f
push 1
mov ecx, eax
call fcn.0100bcee
jmp 0x1010441
xor eax, eax
mov dword [ebp - 0x230], eax
test eax, eax
jne 0x1010479
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010963
test byte [eax + 0x1c], 1
je 0x1010963
push esi
push ebx
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1010963
mov ecx, dword [ebp - 0x234]
push dword [ecx + 0x194]
lea ecx, [ebp - 0x20c]
push ecx
push 0
mov ecx, eax
call fcn.0101cc02
mov edi, eax
test edi, edi
jge 0x10104c3
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10104c3
test byte [eax + 0x1c], 1
je 0x10104c3
push edi
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004f4d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10104fb
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10104fb
test byte [eax + 0x1c], 1
je 0x10104fb
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
push 0x103501c
push dword [ebp - 0x238]
call fcn.0100c696
cmp dword [ebp - 0x230], 0
mov dword [ebp - 0x240], eax
jne 0x10107cf
test byte [ebp + 0x18], 1
je 0x1010845
push esi
call fcn.01011b9e
pop ecx
test eax, eax
je 0x1010540
push 1
mov ecx, eax
call fcn.0100bcee
mov esi, eax
jmp 0x1010542
xor esi, esi
mov dword [ebp - 0x230], esi
test esi, esi
jne 0x1010573
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010963
test byte [eax + 0x1c], 1
je 0x1010963
push 0x844
push ebx
push 0x32
jmp 0x1010469
mov eax, dword [ebp - 0x234]
push 1
push dword [eax + 0x194]
mov ecx, esi
push 0
call fcn.0101c95a
mov edi, eax
test edi, edi
jge 0x10105b3
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x33
jmp 0x101083a
push dword [ebp - 0x23c]
mov ecx, esi
call fcn.0101a1d4
mov edi, eax
test edi, edi
jge 0x10105e9
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x34
jmp 0x101083a
mov eax, dword [ebp - 0x240]
neg eax
sbb eax, eax
and eax, 0xffffdcd8
add eax, 0x2710
push eax
mov ecx, esi
call fcn.0101a800
mov edi, eax
test edi, edi
jge 0x101062e
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x35
jmp 0x101083a
lea eax, [ebp - 0x21c]
push eax
call fcn.0100c6f4
test eax, eax
jne 0x101066b
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010963
test byte [eax + 0x1c], 1
je 0x1010963
push ebx
push 0x36
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x1010963
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.0101a4ce
mov edi, eax
test edi, edi
jge 0x10106a2
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x37
jmp 0x101083a
mov eax, dword [ebp - 0x234]
push dword [eax + 0x1b0]
mov ecx, esi
call fcn.0101a937
mov edi, eax
test edi, edi
jge 0x10106de
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x38
jmp 0x101083a
cmp dword [ebp + 0xc], 0
jne 0x1010761
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.0101a536
mov edi, eax
test edi, edi
jge 0x101071b
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x39
jmp 0x101083a
cmp dword [ebp - 0x240], 0
je 0x10107cf
push 0xca0200
mov ecx, esi
call fcn.0101a159
mov edi, eax
test edi, edi
jge 0x10107cf
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x3a
jmp 0x101083a
cmp dword [ebp - 0x240], 0
je 0x10107cf
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.0101a536
mov edi, eax
test edi, edi
jge 0x10107a1
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x3b
jmp 0x101083a
push 0xca0100
mov ecx, esi
call fcn.0101a159
mov edi, eax
test edi, edi
jge 0x10107cf
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x3c
jmp 0x101083a
push dword [ebp - 0x230]
mov ecx, dword [ebp - 0x234]
push dword [ebp + 0xc]
push dword [ebp - 0x238]
call fcn.0100bfd7
mov edi, eax
test edi, edi
jge 0x1010807
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x3d
jmp 0x101083a
push dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x230]
push 0
push 0
push 0x19
call fcn.0101bfe6
mov edi, eax
test edi, edi
jge 0x101084d
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010845
test byte [eax + 0x1c], 1
je 0x1010845
push edi
push ebx
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
test edi, edi
jl 0x1010963
mov esi, dword [ebp - 0x230]
test esi, esi
je 0x1010888
push dword [ebp + 0x10]
mov ecx, esi
call fcn.0101a827
mov edi, eax
test edi, edi
jge 0x1010890
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010888
test byte [eax + 0x1c], 2
je 0x1010888
push edi
push ebx
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
test edi, edi
jl 0x1010963
test esi, esi
je 0x101095f
push 0x103501c
push dword [ebp - 0x238]
call fcn.0100c696
test eax, eax
je 0x101095f
lea eax, [ebp - 0x248]
push eax
mov ecx, esi
call fcn.0101a3fa
test eax, eax
jl 0x101093f
mov edx, dword [ebp - 0x23c]
mov ecx, dword [edx + 4]
mov eax, dword [edx]
cmp ecx, dword [ebp - 0x244]
jb 0x101095f
ja 0x10108e3
cmp eax, dword [ebp - 0x248]
jb 0x101095f
sub eax, dword [ebp - 0x248]
sbb ecx, dword [ebp - 0x244]
cmp ecx, 0xc9
jb 0x101095f
ja 0x1010900
cmp eax, 0x2a69c000
jb 0x101095f
mov ecx, dword [ebp - 0x234]
push 1
push edx
push dword [ebp + 0xc]
push dword [ebp - 0x238]
push esi
call fcn.0100f95a
test eax, eax
jge 0x101095f
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101095f
test byte [eax + 0x1c], 1
je 0x101095f
push edi
push ebx
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x101095f
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101095f
test byte [eax + 0x1c], 1
je 0x101095f
push ebx
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
test edi, edi
jge 0x10109bd
cmp dword [ebp - 0x230], 0
je 0x10109bd
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x234]
push dword [ebp - 0x238]
call fcn.0100d1db
test eax, eax
jge 0x10109a9
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10109bd
test byte [ecx + 0x1c], 1
je 0x10109bd
push eax
push ebx
push 0x42
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
jmp 0x10109bd
mov ecx, dword [ebp - 0x230]
push 1
call fcn.0100bfb1
and dword [ebp - 0x230], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x230]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01011f27
leave
ret 0x14