Function at 0x101b062
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x103ff58]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
mov word [ebp - 0x20c], bx
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10402a4
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], 1
call edi
push 0x104030c
call edi
mov edi, dword [esi + 0x444]
mov eax, dword [edi + 0x34]
cmp eax, ebx
je 0x101b0e7
push 0x103
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push dword [edi + 0x34]
call fcn.01035abf
mov dword [edi + 0x34], ebx
lea ebx, [esi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebx]
sub eax, dword [esi + 0x18]
mov ecx, dword [ebx + 4]
sbb ecx, dword [esi + 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x454]
cmp eax, 8
mov dword [esi + 0x2c], ecx
jne 0x101b120
mov dword [esi + 0x30], 1
and dword [ebp - 0x210], 0
jmp 0x101b1e4
cmp eax, 0xb
jne 0x101b1ba
mov eax, dword [esi + 0x458]
dec eax
cmp eax, 0xe
ja case.0x101b13c.2
movzx eax, byte [eax + 0x101b3fa]
jmp dword [eax*4 + 0x101b3e6]
mov ebx, 0x10416f8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
test byte [eax + 0x30], 4
jne 0x101b165
cmp dword [eax + 0x18], 0
jne 0x101b165
and dword [ebp - 0x214], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x210], 1
mov eax, dword [0x1040588]
test eax, eax
je 0x101b1e4
add eax, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x101b1e4
call fcn.01018df3
mov dword [ebp - 0x210], eax
jmp 0x101b176
and dword [ebp - 0x210], 0
jmp 0x101b176
call fcn.01018df3
mov dword [ebp - 0x210], eax
mov eax, dword [0x1040588]
test eax, eax
je 0x101b1e4
add eax, 0x28
jmp 0x101b182
cmp eax, 0xc
je 0x101b114
cmp eax, 0xd
je 0x101b114
cmp eax, 0x40000001
jne 0x101b1e4
and dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 1
push dword [ebp - 0x210]
push edi
call fcn.0102861d
cmp dword [ebp - 0x210], 0
jne 0x101b21b
mov ebx, 0x104022c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1040208], 0xffffffff
je 0x101b214
push edi
call fcn.0101725a
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x458]
mov ecx, dword [edi + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add ecx, 0x494
mov dword [edi + 0x598], eax
lea eax, [edi + 0x398]
push ecx
push eax
call ebx
xor eax, eax
cmp dword [ebp - 0x210], eax
jne 0x101b277
cmp dword [esi + 0x30], eax
jne 0x101b277
cmp dword [edi + 0x598], eax
jne 0x101b26f
push 0x1001818
lea eax, [edi + 0x398]
push eax
mov dword [edi + 0x598], 0xc
call ebx
push edi
call fcn.010187c1
xor eax, eax
cmp dword [esi + 0x30], eax
mov ebx, 0x200
je 0x101b2a4
push ebx
mov ecx, edi
call fcn.0101e64b
push edi
call fcn.0101da92
mov eax, dword [edi + 0x158]
inc dword [eax + 0xe4]
and dword [ebp - 0x210], 0
jmp 0x101b2ba
cmp dword [esi + 0x43c], eax
je 0x101b2b2
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], eax
jne 0x101b2eb
push 1
push edi
call fcn.0101dc5d
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x388], ecx
mov ecx, dword [eax + 0x1c]
mov dword [edi + 0x38c], ecx
mov ecx, dword [eax + 0x20]
mov dword [edi + 0x390], ecx
mov eax, dword [eax + 0x24]
mov dword [edi + 0x394], eax
jmp 0x101b30e
push 0x40
mov ecx, edi
call fcn.0101e64b
and dword [edi + 0x20], 0
cmp dword [ebp - 0x214], 1
push edi
jne 0x101b309
call fcn.0101e4f6
jmp 0x101b30e
call fcn.0101e1c0
push edi
push 2
call fcn.0102969c
mov eax, dword [esi + 8]
push 1
push 0xffffffffffffffff
push 1
mov dword [eax + 0x2c], 0x20100000
push dword [esi + 8]
call fcn.010193a7
push esi
call fcn.0101a8ad
xor esi, esi
cmp dword [edi + 0x608], ebx
mov dword [edi + 0x20], esi
jne 0x101b358
mov ebx, dword [edi + 0x18]
push esi
push 1
push 1
push edi
call fcn.0101fa0a
push ebx
push 0x17
push esi
call fcn.010284c5
push dword [0x10402f8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x101b372
mov dword [0x10402f0], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0x104030c
push esi
call ebx
push 0x10402a4
call ebx
cmp dword [ebp - 0x210], 0
jne 0x101b3b6
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
call fcn.01019311
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push 1
push 1
push edi
call fcn.0101fa0a
push esi
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
pop edi
pop esi
pop ebx
je 0x101b3d7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
call fcn.01031d91
leave
ret 4