Function at 0x100017b0
Capabilities:
Delete file
Get disk information
Get thread local storage value

Disassembly:
mov eax, 0x28f4
call fcn.10033810
mov eax, dword [0x10044ee0]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x10001810
call fcn.10001190
test eax, eax
jne 0x100017ef
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x28f4
ret 4
mov ecx, dword [0x10044ee0]
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x10001810
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x28f4
ret 4
cmp dword [esi + 0x96], ebx
je 0x1000184b
mov edx, dword [esp + 0x2908]
mov dword [esi + 0xaf62], ebx
push esi
mov eax, dword [edx + 0x2c]
push eax
push 0x10044ccc
push 1
call fcn.10007150
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
mov edi, dword [esp + 0x2908]
mov dword [esi + 0x8c6], ebx
mov dword [esi + 0x8d2], ebx
mov dword [esi + 0x96], 1
mov dword [esi + 0xc988], ebx
mov dword [esi + 0xaf62], ebx
mov dword [esi + 0x9a], ebx
mov dword [esi + 0x9e], ebx
mov dword [esi + 0x8ba], ebx
mov dword [esi + 0x8be], ebx
mov dword [esi + 0x8ca], ebx
mov dword [esi + 0x8c2], ebx
mov dword [esi + 0x8d6], ebx
mov dword [esi + 0x8ce], ebx
mov dword [esi + 0x8da], ebx
mov dword [esi + 0x8de], ebx
mov dword [esi + 0x8e6], ebx
mov dword [esi + 0x902], ebx
mov dword [esi + 0x906], ebx
mov dword [esi + 0x90a], ebx
mov dword [esi + 0x90e], ebx
mov dword [esi + 0x912], ebx
mov dword [esi + 0x916], ebx
mov dword [esi + 0x91a], ebx
mov dword [esi + 0x922], 0xffffffff
mov dword [esi + 0x3dfc], ebx
mov dword [esi + 0x3e00], ebx
mov dword [esi + 0x8aa], ebx
mov dword [esi + 0x8ae], ebx
mov ecx, dword [edi + 0x88]
push edi
mov dword [esi + 0x3e0c], ecx
call fcn.10003320
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
lea edx, [esi + 0x35e4]
push 0x10044ccc
push edx
call ebp
lea eax, [esi + 0x2de4]
push 0x10044ccc
push eax
call ebp
mov eax, dword [edi]
add eax, 0xffffff6c
cmp eax, 0x48
ja case.0x1000194d.151
xor ecx, ecx
mov cl, byte [eax + 0x10002218]
jmp dword [ecx*4 + 0x10002204]
mov dword [esi + 0x3e10], 0x64
jmp 0x10001982
mov dword [esi + 0x3e10], 0xc8
jmp 0x10001982
mov dword [esi + 0x3e10], 0x12c
jmp 0x10001982
mov dword [esi + 0x3e10], 0x1f4
lea edx, [esp + 0x24]
push edi
push edx
mov dword [esp + 0x2c], 0xdc
call fcn.10001350
add esp, 8
test eax, eax
je 0x100019a2
mov eax, dword [edi + 0x2c]
push esi
jmp 0x100019d2
mov ecx, dword [esp + 0xb8]
mov dword [esi + 0x3dfc], ecx
mov edx, dword [esp + 0xbc]
mov dword [esi + 0x3e00], edx
mov eax, dword [esp + 0x28]
cmp eax, 6
mov eax, dword [esp + 0x2c]
je 0x100019fa
cmp eax, ebx
jne 0x100019fa
mov eax, dword [esp + 0x50]
push esi
push eax
push 0x10044ccc
push 0x10
call fcn.10007150
add esp, 0x10
mov dword [esi + 0x96], ebx
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
lea ecx, [esi + 0x15e4]
push eax
push ecx
call fcn.10006b30
mov cx, word [esp + 0xc8]
lea edi, [esi + 0x25e4]
mov word [esi + 0x4ee0], cx
mov edx, dword [esp + 0xca]
shr edx, 1
and edx, 1
push edi
mov dword [esi + 0x9e], edx
mov eax, dword [esp + 0xce]
shr eax, 4
and eax, 1
mov dword [esp + 0x1c], edi
mov dword [esi + 0x4fb4], eax
mov ecx, dword [esp + 0xce]
shr ecx, 5
and ecx, 1
mov dword [esi + 0x4fb8], ecx
mov edx, dword [esp + 0xce]
shr edx, 6
and edx, 1
mov dword [esi + 0x902], edx
mov eax, dword [esp + 0xce]
shr eax, 7
and eax, 1
mov dword [esi + 0x906], eax
mov ecx, dword [esp + 0xce]
shr ecx, 9
and ecx, 1
mov dword [esi + 0x90a], ecx
mov edx, dword [esp + 0xce]
shr edx, 0xa
and edx, 1
mov dword [esi + 0x90e], edx
mov eax, dword [esp + 0xce]
shr eax, 8
and eax, 1
mov dword [esi + 0x912], eax
mov ecx, dword [esp + 0xce]
shr ecx, 0xe
and ecx, 1
xor eax, eax
mov dword [esi + 0x916], ecx
mov edx, dword [esp + 0xce]
shr edx, 0xb
and edx, 1
mov dword [esi + 0x91a], edx
mov ecx, dword [esp + 0xec]
cmp ecx, ebx
setne al
mov dword [esi + 0x91e], eax
mov ecx, dword [esp + 0xce]
shr ecx, 0xc
and ecx, 1
mov dword [esi + 0x8e6], ecx
call fcn.10002270
mov al, byte [esp + 0xce]
add esp, 0xc
test al, 1
je 0x10001b24
mov dword [esi + 0x15dc], 1
jmp 0x10001b2a
mov dword [esi + 0x15dc], ebx
mov eax, dword [esp + 0xc0]
test ah, 0x80
je 0x10001c1e
lea eax, [esi + 0x15e4]
push eax
call fcn.1000b950
mov ebp, eax
push esi
push ebp
call fcn.1000aa40
add esp, 0xc
test eax, eax
jne 0x10001b66
push esi
push 0x10044ccc
push ebx
push ebx
push ebx
push 5
jmp 0x10001be6
cmp dword [esp + 0x28], 4
jne 0x10001b96
cmp dword [esp + 0x5c], ebx
jne 0x10001b96
cmp dword [esp + 0x60], ebx
jne 0x10001b96
cmp dword [esp + 0x6c], ebx
jne 0x10001b96
mov ax, word [esi + 0x4ee0]
test ah, 0x40
je 0x10001bc9
test eax, 0x703
je 0x10001c1e
mov eax, dword [esp + 0x50]
push esi
push eax
push 0x10044ccc
push 0x14
call fcn.10007150
push edi
mov dword [esi + 0x96], ebx
call fcn.100022e0
add esp, 0x14
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
mov ecx, dword [esp + 0x30]
push ecx
push ebp
call fcn.1000ba00
add esp, 8
test eax, eax
je 0x10001c1e
push esi
push 0x10044ccc
push ebx
push ebx
push ebx
push 6
call fcn.1000c200
mov edx, dword [esp + 0x68]
push esi
push edx
push 0x10044ccc
push 0x14
call fcn.10007150
push edi
mov dword [esi + 0x96], ebx
call fcn.100022e0
add esp, 0x2c
mov eax, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
push esi
call fcn.1000a580
mov dword [esi + 0x3de4], ebx
mov dword [esi + 0x3df0], ebx
mov dword [esi + 0x3e04], 1
mov ecx, dword [esp + 0xd0]
mov dword [esi + 0x926], ecx
mov edx, dword [esp + 0xd4]
mov dword [esi + 0x92a], edx
mov eax, dword [esp + 0xd8]
add esp, 4
cmp eax, ebx
je 0x10001c7d
push 0x12c
push eax
lea eax, [esi + 0xaae]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + 0xbd9], bl
jmp 0x10001c8f
lea ecx, [esi + 0xaae]
push str.Compress_Progress
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x3de8], edx
mov eax, dword [esp + 0x40]
mov dword [esi + 0x3dec], eax
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x3df4], ecx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x3df8], edx
mov dword [esi + 0x8a6], ebx
mov eax, dword [esp + 0x28]
cmp eax, ebx
jle 0x100021cf
cmp eax, 7
jg 0x100021cf
mov ax, word [esi + 0x4ee0]
test ah, 0x80
je 0x10001fa1
cmp dword [esp + 0x54], ebx
je 0x10001cee
cmp dword [esp + 0x58], ebx
jne 0x10001cf7
test ah, 0x40
je 0x10001fa1
test byte [esi + 0x4ee1], 0x40
mov dword [esi + 0xa2], 0xffffffff
je 0x10001e6c
lea eax, [esp + 0x904]
lea ecx, [esp + 0x1904]
push eax
lea edx, [esp + 0x2108]
push ecx
lea eax, [esp + 0x110c]
push edx
push eax
lea eax, [esi + 0x15e4]
push eax
call fcn.1000b540
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x14
lea ecx, [esp + 0x1104]
lea edx, [esp + 0x104]
push ecx
push edx
call ebp
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x103]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x10001d84
lea ecx, [esp + 0x104]
push 0x100420a8
push ecx
call edi
push ebx
lea edx, [esp + 0x104]
push ebx
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push ebx
lea ecx, [esp + 0x11c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x10001dbc
cmp dword [esp + 0x14], 0xff
jb 0x10001dbc
mov dword [esi + 0x8a6], 1
mov eax, dword [esi + 0x8a6]
push str..z01
cmp eax, ebx
je 0x10001dd7
lea edx, [esp + 0x908]
push edx
call edi
jmp 0x10001de1
lea eax, [esp + 0x908]
push eax
call ebp
lea ecx, [esp + 0x904]
lea edx, [esp + 0x1904]
push ecx
lea eax, [esp + 0x2108]
push edx
lea ecx, [esp + 0x110c]
lea ebp, [esi + 0xa6]
push eax
push ecx
push ebp
call fcn.1000b6f0
add esp, 0x14
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xa2], eax
jne 0x10001fa1
mov edx, dword [esp + 0x50]
push esi
push edx
push 0x10044ccc
push 0xa
call fcn.10007150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x96], ebx
push eax
call fcn.100022e0
add esp, 0x14
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
mov ecx, dword [esp + 0x58]
lea ebp, [esi + 0x1de4]
push ecx
push ebp
call fcn.10006b30
push ebp
call fcn.1000b950
push esi
push eax
call fcn.1000aa40
add esp, 0x14
test eax, eax
jne 0x10001f61
push esi
push ebp
call fcn.1000aad0
add esp, 8
cmp edx, ebx
jl 0x10001f61
jg 0x10001eb4
cmp eax, 0x200000
jb 0x10001f61
lea edi, [esi + 0xa6]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi + 0xa5], 0x5c
je 0x10001edf
push 0x100420a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push str.__XXXXXX
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ebp, 0x25
mov ecx, eax
div ebp
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x18], al
mov eax, 0xbacf914d
mul ecx
mov eax, ecx
mov ecx, ebp
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 5
div ecx
lea eax, [esp + 0x18]
push eax
push edi
mov dl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_]
mov byte [esp + 0x21], dl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__mktemp
add esp, 4
test eax, eax
je 0x10001f61
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xa2], eax
cmp dword [esi + 0xa2], 0xffffffff
jne 0x10001fa1
mov ecx, dword [esp + 0x50]
push esi
push ecx
push 0x10044ccc
push 0xa
call fcn.10007150
mov edx, dword [esp + 0x20]
mov dword [esi + 0x96], ebx
push edx
call fcn.100022e0
add esp, 0x14
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
mov eax, dword [esp + 0xdc]
mov dword [esi + 0x8c6], eax
mov dword [esi + 0x8ca], ebx
cmp dword [esp + 0xd8], ebx
je 0x10001fea
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x10001fea
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10001fea
mov edi, 1
mov dword [esi + 0x8ba], edi
mov ecx, dword [esp + 0xd8]
mov dword [esi + 0x8ce], ecx
jmp 0x10001fef
mov edi, 1
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x1000201a
mov edx, dword [eax + 4]
mov dword [esi + 0x8fa], edx
mov eax, dword [esp + 0xc4]
mov ecx, dword [eax + 8]
mov dword [esi + 0x8fe], ecx
mov eax, dword [esp + 0xc4]
cmp dword [esi + 0x8e6], ebx
je 0x1000202b
cmp eax, ebx
je 0x10002061
cmp dword [eax + 4], ebx
je 0x10002061
cmp dword [esp + 0x28], 6
jne 0x10002083
mov eax, dword [esi + 0x8ba]
mov dword [esi + 0x8de], edi
cmp eax, ebx
jne 0x10002061
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x10002061
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x10002061
cmp dword [eax + 4], ebx
jne 0x10002083
mov edx, dword [esp + 0x50]
push esi
push edx
push 0x10044ccc
push 0x10
call fcn.10007150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x96], ebx
push eax
jmp 0x100021e8
cmp dword [esp + 0x28], 7
jne 0x100020c5
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x10002105
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10002105
mov eax, dword [esp + 0xc4]
cmp eax, ebx
je 0x10002105
cmp dword [eax + 4], ebx
je 0x10002105
mov dword [esi + 0x8c6], ebx
mov dword [esi + 0x8ba], edi
mov dword [esi + 0x8be], edi
mov dword [esi + 0x8ca], ebx
test byte [esp + 0xc2], 4
je 0x100020ee
mov dword [esi + 0xaa6], ebx
mov dword [esi + 0xaa2], edi
mov eax, dword [esp + 0xc2]
and eax, 8
push eax
call fcn.100043b0
add esp, 4
mov eax, dword [esi + 0x8de]
push esi
cmp eax, ebx
je 0x10002127
lea ecx, [esp + 0x28]
push ecx
call fcn.1000a6a0
jmp 0x10002131
mov ecx, dword [esp + 0x50]
push esi
push ecx
push 0x10044ccc
push 0x10
call fcn.10007150
mov edx, dword [esp + 0x20]
mov dword [esi + 0x96], ebx
push edx
jmp 0x100021e8
lea edx, [esp + 0x28]
push edx
call fcn.100081b0
mov ebp, eax
mov eax, dword [esi + 0xa9e]
add esp, 8
cmp eax, ebx
mov dword [esi + 0xaa2], ebx
je 0x10002151
call fcn.100044e0
mov dword [esi + 0xaa6], ebx
mov eax, dword [esi + 0xa2]
cmp eax, 0xffffffff
je 0x10002183
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [esi + 0x4ee1], 0x40
jne 0x10002179
lea eax, [esi + 0xa6]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 0xa2], 0xffffffff
mov ecx, dword [esp + 0x50]
push esi
push ecx
push 0x10044ccc
push ebp
call fcn.10007150
mov edx, dword [esp + 0x20]
mov dword [esi + 0x96], ebx
push edx
call fcn.100022e0
mov eax, dword [esi + 0x4ed0]
add esp, 0x14
cmp eax, ebx
je 0x100021c0
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [esi + 0x4ed0], ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4
mov ecx, dword [esp + 0x50]
push esi
push ecx
push 0x10044ccc
push 0x10
call fcn.10007150
mov dword [esi + 0x96], ebx
push edi
call fcn.100022e0
add esp, 0x14
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28f4
ret 4