Function at 0x442aa0
Capabilities:
Delete file
Get thread local storage value
Read file on windows

Disassembly:
mov eax, dword [0x468ad4]
sub esp, 0x10
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x442ac4
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0xb08]
mov edx, dword [esi + 0xb0c]
mov dword [esi + 0xab2], ecx
test eax, eax
mov dword [esi + 0xab6], edx
jne 0x442be1
mov al, byte [esi + 0xafc]
mov bl, 8
test bl, al
je 0x442b23
mov eax, dword [esi + 0xc4a]
mov ecx, dword [esi + 0xc52]
mov dword [esi + 0xb04], eax
mov eax, dword [esi + 0xc4e]
mov dword [esi + 0xb08], eax
mov dword [esi + 0xb0c], ecx
mov dword [esi + 0xab2], eax
mov dword [esi + 0xab6], ecx
mov eax, dword [esi + 0xc64]
xor ecx, ecx
mov cx, word [esi + 0xb12]
xor edx, edx
mov dx, word [esi + 0xb10]
mov edi, 0x2800
add ecx, edx
xor edx, edx
push 0
push 0
lea ecx, [ecx + eax + 0x1e]
mov eax, ecx
div edi
mov edi, edx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8cf8]
push ecx
call fcn.004488a0
mov ecx, dword [esi + 0x8cf8]
add esp, 0x10
lea edx, [esp + 0x14]
mov dword [esi + 0x8f4c], eax
mov eax, dword [esi + 0x8ce2]
push 0
push edx
push 0x2800
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x442bcb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x442bcb
mov edx, dword [esi + 0x8ce2]
and eax, 0xffff
sub eax, edi
add edx, edi
mov dword [esi + 0x8cea], eax
mov al, byte [esi + 0xc60]
test bl, al
mov dword [esi + 0x8ce6], edx
je case.0x442c72.1
pop edi
pop esi
mov eax, 0x2e
pop ebx
add esp, 0x10
ret
mov dword [esi + 0x8cea], 0
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x10
ret
mov eax, 3
push ebp
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x8ce2]
mov ebx, dword [esi + 0x50]
xor edi, edi
mov dword [esp + 0x18], ecx
cmp eax, 3
jne 0x442c68
mov edx, 0x2800
lea eax, [esp + 0x10]
sub edx, edi
push eax
mov dword [esp + 0x18], edx
mov ecx, dword [esi + 0xada]
mov eax, dword [esi + 0x54]
mov edx, dword [esi + 0x58]
push ecx
mov ecx, 0x20
call fcn.0044c920
mov edx, dword [esi + 0x54]
mov ecx, dword [esp + 0x20]
push eax
push edx
push ebx
lea edx, [esp + 0x28]
push ecx
mov eax, ebx
push edx
push ebp
sar eax, 0x1f
push 0
call dword [esi + 0xad6]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, eax
add ebp, eax
add edx, eax
mov eax, dword [esp + 0x10]
adc ebx, 0
cmp edi, 0x2800
mov dword [esp + 0x18], edx
jb 0x442bfd
cmp eax, 3
mov dword [esp + 0x14], edi
pop ebp
ja case.0x442c72.1
jmp dword [eax*4 + 0x442d50]
mov eax, dword [esi + 0x8ce2]
and edi, 0xffff
mov dword [esi + 0x8cea], edi
mov dword [esi + 0x8ce6], eax
je 0x442cb4
mov edx, dword [esi + 0x4c]
add edx, edi
mov dword [esi + 0x4c], edx
mov ecx, dword [esi + 0x50]
adc ecx, 0
mov dword [esi + 0x50], ecx
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0x48], ecx
jmp case.0x442c72.1
mov dword [esi + 0x48], 1
mov eax, dword [esi + 0xc84]
test eax, eax
je 0x442cce
call fcn.00442a20
test eax, eax
jne 0x442d3c
mov eax, dword [esi + 0x99e]
mov ebx, dword [esp + 0x20]
test eax, eax
jne 0x442d43
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x442d43
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x442d43
push ebx
call fcn.00447dc0
mov edi, eax
add esp, 4
test edi, edi
jne 0x442d09
call fcn.00448960
mov edi, eax
test edi, edi
jne 0x442d09
cmp dword [esi], 0
je 0x442d3a
mov eax, dword [esi + 0x9068]
cmp eax, 0xffffffff
je 0x442d1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x99e]
test eax, eax
jne 0x442d3a
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x442d3a
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x442d3a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esi + 0x9068], 0xffffffff
jmp 0x442cf9