Function at 0x100107e0
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002706b
mov eax, dword fs:[0]
push eax
mov eax, 0x1258
call fcn.10024eb0
mov eax, dword [0x10031018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor al, al
xor edi, edi
mov dword [ebp - 0x123c], esi
mov dword [ebp - 0x1244], edx
mov dword [ebp - 0x1240], ecx
mov byte [ebp - 0x1235], al
cmp ebx, edi
je 0x10010cd7
cmp dword [ebp + 0x10], edi
jbe 0x10010cd7
cmp edx, edi
je 0x10010cd7
cmp ecx, edi
je 0x10010cd7
cmp word [ecx], di
je 0x10010cd7
lea eax, [ebp - 0x54c]
push eax
call fcn.100017c0
test al, al
je 0x10010c14
xor eax, eax
xor ecx, ecx
xor edx, edx
mov word [ebp - 0xa34], ax
lea eax, [ebp - 0x624]
mov word [ebp - 0x624], cx
mov word [ebp - 0x1234], cx
mov esi, 0x1002c63c
mov ecx, eax
mov word [ebp - 0x424], dx
mov dword [ebp - 0x1248], edi
mov edx, 0x100
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x100108ce
movzx ecx, word [esi + eax]
cmp cx, di
je 0x100108ce
mov word [eax], cx
add eax, 2
dec edx
jne 0x100108b0
jmp 0x100108d2
cmp edx, edi
jne 0x100108d5
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [ebp - 0x123c]
add eax, 4
push eax
mov esi, 0x100
lea ebx, [ebp - 0x624]
call fcn.1000d1d0
push 0x1002c63c
call fcn.1000d1d0
lea eax, [ebp - 0x424]
mov edx, 0x1002c63c
mov ecx, eax
mov esi, 0x208
sub edx, ecx
lea ecx, [esi + 0x7ffffdf6]
test ecx, ecx
je 0x10010930
movzx ecx, word [edx + eax]
test cx, cx
je 0x10010930
mov word [eax], cx
add eax, 2
dec esi
jne 0x10010912
jmp 0x10010934
test esi, esi
jne 0x10010937
sub eax, 2
mov edi, dword [ebp - 0x1240]
xor edx, edx
push edi
mov esi, 0x208
lea ebx, [ebp - 0x424]
mov word [eax], dx
call fcn.1000d1d0
push 0x1002c63c
call fcn.1000d1d0
mov edx, esi
lea eax, [ebp - 0xa34]
mov esi, 0x1002c63c
mov ecx, eax
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x1001098e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001098e
mov word [eax], cx
add eax, 2
dec edx
jne 0x10010970
jmp 0x10010992
test edx, edx
jne 0x10010995
sub eax, 2
xor edx, edx
push 0x1002c63c
mov esi, 0x208
lea ebx, [ebp - 0xa34]
mov word [eax], dx
call fcn.1000d1d0
lea eax, [ebp - 0x1234]
mov esi, str._LPT
mov ecx, eax
mov edx, 0x400
sub esi, ecx
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x100109e1
movzx ecx, word [esi + eax]
test cx, cx
je 0x100109e1
mov word [eax], cx
add eax, 2
dec edx
jne 0x100109c3
jmp 0x100109e5
test edx, edx
jne 0x100109e8
sub eax, 2
xor edx, edx
push 0x1002c64c
mov esi, 0x400
lea ebx, [ebp - 0x1234]
mov word [eax], dx
call fcn.1000d1d0
lea eax, [ebp - 0x624]
push eax
call fcn.1000d1d0
push 0x1002c64c
call fcn.1000d1d0
lea ecx, [ebp - 0x424]
push ecx
call fcn.1000d1d0
push 0x1002c64c
call fcn.1000d1d0
lea edx, [ebp - 0xa34]
push edx
call fcn.1000d1d0
lea eax, [ebp - 0x1248]
push eax
mov ecx, ebx
push ecx
call fcn.10010f70
mov eax, dword [ebp - 0x1248]
mov edx, dword [ebp - 0x123c]
mov dword [edx + 0x650], eax
test eax, eax
jne 0x10010bf0
xor ecx, ecx
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x424]
mov word [ebp - 0xa34], cx
mov esi, edi
mov ecx, eax
mov edx, 0x208
sub esi, ecx
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x10010aa2
movzx ecx, word [esi + eax]
test cx, cx
je 0x10010aa2
mov word [eax], cx
add eax, 2
dec edx
jne 0x10010a84
jmp 0x10010aa6
test edx, edx
jne 0x10010aa9
sub eax, 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x424]
push eax
call esi
dec eax
mov ebx, 0x5c
js 0x10010ade
cmp word [ebp + eax*2 - 0x424], bx
je 0x10010ad4
dec eax
jns 0x10010ac5
jmp 0x10010ade
xor ecx, ecx
mov word [ebp + eax*2 - 0x424], cx
lea edx, [ebp - 0x424]
push edx
call esi
cmp word [ebp + eax*2 - 0x426], bx
je 0x10010b06
push 0x1002b2bc
mov esi, 0x208
lea ebx, [ebp - 0x424]
call fcn.1000d1d0
lea eax, [ebp - 0xa34]
lea esi, [ebp - 0x424]
mov ecx, eax
mov edx, 0x208
sub esi, ecx
jmp 0x10010b20
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x10010b3e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10010b3e
mov word [eax], cx
add eax, 2
dec edx
jne 0x10010b20
jmp 0x10010b42
test edx, edx
jne 0x10010b45
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [ebp - 0x123c]
add eax, 4
push eax
mov esi, 0x208
lea ebx, [ebp - 0xa34]
call fcn.1000d1d0
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x10010be0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1244]
push 0
lea ecx, [ebp - 0x1240]
push ecx
push edx
push eax
push esi
mov dword [ebp - 0x1240], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010bb2
mov bl, 1
jmp 0x10010bc8
mov ecx, dword [ebp - 0x123c]
mov bl, byte [ebp - 0x1235]
mov dword [ecx + 0x650], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0xa34]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
jmp 0x10010bf6
mov eax, dword [ebp - 0x123c]
mov dword [eax + 0x650], 0x4c
mov al, byte [ebp - 0x1235]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001cf84
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - method.CPtProv.virtual_0], vtable.CPtProv.0
mov dword [ebp - 0x125c], edi
mov dword [ebp - 0x1258], edi
mov dword [ebp - 0x1254], edi
mov dword [ebp - 0x1250], edi
mov dword [ebp - 0x124c], edi
mov eax, ebx
lea esi, [ebp - 0x1260]
mov dword [ebp - 4], edi
call fcn.1001c3d0
test al, al
je 0x10010cb7
mov esi, dword [ebp - 0x1240]
push esi
push ebx
lea ecx, [ebp - 0x1260]
push ecx
call fcn.1001c9b0
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1244]
push edx
lea eax, [ebp - 0x1260]
push eax
mov edx, esi
call fcn.1001c780
test al, al
je 0x10010c97
lea ecx, [ebp - 0x1260]
mov byte [ebp - 0x1235], 1
call fcn.1001c3a0
jmp 0x10010bf0
mov ecx, dword [ebp - 0x123c]
mov dword [ecx + 0x650], 0x44
lea ecx, [ebp - 0x1260]
call fcn.1001c3a0
jmp 0x10010bf0
mov edx, dword [ebp - 0x123c]
lea ecx, [ebp - 0x1260]
mov dword [edx + 0x650], 5
call fcn.1001c3a0
jmp 0x10010bf0
mov dword [esi + 0x650], 2
jmp 0x10010bf6