Function at 0x10002bd8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
add ecx, 0xfffffefe
xor eax, eax
or edi, 0xffffffff
xor edx, edx
mov dword [ebp - 4], ebx
cmp ecx, 0x2c
ja case.0x10002c01.275
jmp dword [ecx*4 + 0x1000310c]
push dword [ebp + 0x14]
push esi
call fcn.100024a9
jmp 0x1000307e
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push 0x8c
lea eax, [ebp - 0xa0]
push ebx
push eax
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0xa8]
call fcn.100072a9
mov edi, eax
cmp edi, ebx
jne 0x100030e7
lea eax, [ebp - 0xa8]
push eax
push 0x10
push dword [ebp + 8]
mov esi, 0x94
call fcn.1000b9fc
test eax, eax
je 0x10002c83
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ba55
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100030e7
push dword [ebp + 0x10]
push esi
call fcn.10002a33
jmp 0x10003088
push ebx
jmp 0x10002ca7
push 1
push dword [ebp + 0x10]
push esi
call fcn.10001659
jmp 0x10003088
push 0x1002c0f8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jg 0x10002cdc
push ebx
push ebx
push 0x117
push esi
call fcn.100020a5
mov edi, eax
cmp edi, ebx
je 0x100030e7
push 0x1002c0f8
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x100030e7
mov dword [ebp - 4], 1
push dword [ebp - 4]
mov eax, esi
push dword [ebp + 0x10]
call fcn.10001a04
jmp 0x10003088
call fcn.10001559
jmp 0x10003088
call fcn.10001592
jmp 0x10003088
push dword [ebp + 0x14]
push ebx
push 0x100011b3
jmp 0x10003079
push dword [ebp + 0x14]
push ebx
push 0x10001e00
jmp 0x10003079
push dword [ebp + 0x14]
push ebx
push fcn.10001e19
jmp 0x10003079
push dword [ebp + 0x14]
push ebx
push fcn.10004f15
jmp 0x10003079
push dword [ebp + 0x14]
push ebx
push 0x10001f1c
jmp 0x10003079
mov eax, dword [0x1002c27c]
cmp eax, ebx
jne 0x10002d7a
call fcn.100040e5
mov dword [0x1002c27c], eax
cmp eax, ebx
je case.0x10002c01.275
cmp dword [ebp + 8], ebx
je 0x10003101
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [0x1002c27c]
mov esi, eax
push 0x10
push dword [ebp + 8]
inc esi
call fcn.1000b9fc
test eax, eax
je 0x10003101
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ba55
jmp 0x10003101
push dword [ebp + 0x10]
push esi
call fcn.1000b7e6
jmp case.0x10002c01.275
lea eax, [ebp + 0xc]
push eax
call fcn.1000b89b
cmp eax, ebx
je 0x10002e08
cmp dword [ebp + 8], ebx
je 0x10002df3
push dword [ebp + 0xc]
mov esi, eax
push 0x10
push dword [ebp + 8]
call fcn.1000b9fc
test eax, eax
je 0x10002df3
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ba55
push dword [ebp + 0xc]
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x10002c01.275
push 0x12
pop edi
jmp 0x100030f8
cmp dword [0x1002c0e8], ebx
jne case.0x10002c01.275
cmp dword [ebp + 0x10], 0x10
jne 0x10002e2d
push esi
call fcn.10001e84
jmp 0x10003088
push 0x57
pop edi
jmp 0x100030e7
call fcn.10001efa
jmp 0x10003088
xor eax, eax
inc eax
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 8]
push eax
call fcn.10002613
jmp 0x1000307e
cmp esi, ebx
jne 0x10002e67
push ebx
push ebx
push ebx
push 0x1002d1ca
call fcn.10003d51
mov dword [0x1002c2e4], ebx
mov dword [0x1002c330], ebx
push ebx
mov dword [0x1002c2fc], ebx
call fcn.10002613
mov edi, esi
call fcn.10018360
push 4
xor eax, eax
pop edx
inc eax
mov dword [0x1002c2e4], eax
mov dword [0x1002c330], eax
mov dword [0x1002c2fc], eax
mov eax, dword [0x1002b4f0]
and eax, 0xfffb
or eax, edx
push eax
mov eax, dword [0x1002b4ec]
push ebx
call fcn.10003f13
mov edi, eax
cmp esi, ebx
je 0x1000308a
push dword [0x1002c1f4]
mov edx, esi
push dword [ebp + 0x10]
call fcn.10013bae
push 3
push dword [ebp + 0x10]
push esi
push 0x1002d1ca
call fcn.10003d51
jmp 0x1000308a
push dword [ebp + 0x14]
push 1
push 0x100022a2
jmp 0x10003079
push dword [ebp + 0x14]
push ebx
push 0x1000179d
jmp 0x10003079
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x14], ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], 4
jne case.0x10002c01.275
push dword [esi]
push dword [ebp + 0x14]
call fcn.1000147f
jmp case.0x10002c01.275
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [0x1002c12c]
call fcn.1000fd84
mov edi, eax
cmp edi, ebx
jne 0x100030e7
push dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 0x10
push dword [ebp + 8]
call fcn.1000b9fc
test eax, eax
je 0x10002f65
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ba55
push dword [ebp + 0xc]
push ebx
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100030e7
push dword [0x1002c12c]
xor edi, edi
call fcn.1000fc85
mov esi, eax
cmp esi, ebx
je 0x100030e7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002fa4
push esi
call fcn.1001210a
mov edi, eax
push esi
call fcn.100012ff
jmp 0x100030e7
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push 1
jmp 0x10003001
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push 7
jmp 0x10003001
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push 3
jmp 0x10003001
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push 0xd
push dword [ebp + 0x10]
push esi
call fcn.100025d0
jmp 0x1000307e
push dword [ebp + 0x14]
push ebx
push 0x1000251e
jmp 0x10003079
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], ebx
je case.0x10002c01.275
push ebx
push dword [ebp + 0x10]
mov edi, esi
call fcn.1001527d
test eax, eax
je 0x10003049
push 3
push dword [ebp + 0x10]
push esi
push 0x1002d1c6
call fcn.10003d51
jmp 0x1000304e
mov eax, 0xbf
mov edi, eax
cmp eax, ebx
jmp 0x1000308c
mov eax, dword [0x1002c0f4]
test eax, eax
jne case.0x10002c01.275
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], 4
jne case.0x10002c01.275
push dword [ebp + 0x14]
push dword [esi]
push 0x10001f5f
call fcn.10002408
mov edi, eax
jmp 0x100030e7
push esi
call fcn.10002734
mov edi, eax
cmp edi, ebx
jne 0x100030e7
push ebx
push dword [ebp + 0x14]
call fcn.1000147f
jmp 0x100030e7
xor eax, eax
inc eax
cmp esi, ebx
je case.0x10002c01.275
cmp dword [ebp + 0x10], 1
jbe case.0x10002c01.275
mov ecx, dword [ebp + 0x10]
mov byte [esi + ecx - 1], bl
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.1000286a
mov edi, eax
cmp edi, ebx
jne 0x100030e7
lea eax, [ebp - 0x10]
push eax
push 0x10
push dword [ebp + 8]
push 8
pop esi
call fcn.1000b9fc
test eax, eax
je 0x100030e7
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000ba55
cmp edi, 0xffffffff
jne 0x100030f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
je 0x10003101
push edi
push dword [ebp + 0x14]
call fcn.1000147f
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10