Function at 0x1001c6cd
Capabilities:
Create pipe
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x1001ccca
mov dword [ebp - 0x50], 0x7081
mov dword [ebp - 0xec], 0x10008400
cmp dword [ebp - 0x50], 0x726f
jle 0x1001c794
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x40], 0
jmp 0x1001c72d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x477d
jge 0x1001c794
and dword [ebp - 0x1c], 0
jmp 0x1001c743
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5b3
jge 0x1001c792
and dword [ebp - 0x38], 0
jmp 0x1001c759
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x2b5a
jge 0x1001c790
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x38]
cdq
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
mov ecx, 0x1060a8b8
call fcn.1000de0e
jmp 0x1001c752
jmp 0x1001c73c
jmp 0x1001c726
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x84], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x50], 0x6ef8
jge 0x1001c7ba
mov edx, dword [ebp - 0xec]
mov ecx, 0x1060a8b8
call fcn.1000f7c5
jmp 0x1001c7d6
or dword [ebp - 4], 0xffffffff
jmp 0x1001c7e0
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x64], 0x39af
mov dword [ebp - 0x100], 0x10008440
cmp dword [ebp - 0x64], 0x3d23
jle 0x1001c891
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
and dword [ebp - 0x24], 0
jmp 0x1001c825
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1cc2
jge 0x1001c891
and dword [ebp - 0x3c], 0
jmp 0x1001c83b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x171b
jge 0x1001c88f
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x3c]
cdq
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], edx
push dword [ebp - 0xcc]
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x118]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x118]
call fcn.1000dde4
jmp 0x1001c834
jmp 0x1001c81e
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x64], 0x37a2
jge 0x1001c8b6
push dword [ebp - 0x100]
call fcn.1004c266
pop ecx
jmp 0x1001c8d2
or dword [ebp - 4], 0xffffffff
jmp 0x1001c8dc
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xfc], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x68], 0x6684
mov dword [ebp - 0x88], 0x10008490
cmp dword [ebp - 0x68], 0x66b8
jle 0x1001c9b3
and dword [ebp - 0x2c], 0
jmp 0x1001c919
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x21f0
jge 0x1001c9a9
and dword [ebp - 0x44], 0
jmp 0x1001c933
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x2cf8
jge 0x1001c9a4
and dword [ebp - 0x34], 0
jmp 0x1001c949
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x6cc9
jge 0x1001c9a2
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
shl eax, cl
and eax, dword [ebp - 0x34]
cdq
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], edx
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x130]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x130]
call fcn.1000dde4
jmp 0x1001c942
jmp 0x1001c92c
jmp 0x1001c912
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [ebp - 0xbc]
movzx eax, byte [eax]
test eax, eax
je 0x1001cabc
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x5c], 0x4e22
mov dword [ebp - 0x8c], 0x100084c0
cmp dword [ebp - 0x5c], 0x4e8d
jle 0x1001ca40
and dword [ebp - 0x4c], 0
jmp 0x1001c9f4
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x7d17
jge 0x1001ca40
and dword [ebp - 0x48], 0
jmp 0x1001ca0a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x6ec3
jge 0x1001ca3e
mov eax, dword [ebp - 0x4c]
or eax, dword [ebp - 0x48]
cdq
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], edx
push dword [ebp - 0xe4]
push dword [ebp - 0xe8]
mov ecx, 0x1060a8b8
call fcn.1000de0e
jmp 0x1001ca03
jmp 0x1001c9ed
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x5c], 0x4b96
jge 0x1001ca69
mov edx, dword [ebp - 0x8c]
mov ecx, 0x1060a8b8
call fcn.1000f7c5
jmp 0x1001ca85
or dword [ebp - 4], 0xffffffff
jmp 0x1001ca8f
mov eax, dword [ebp - 0xc8]
movzx eax, byte [eax]
test eax, eax
je 0x1001cab7
push 0
push 0x2487
push 0x23b0
push 0x690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1001cc86
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], 0x4118
mov dword [ebp - 0xe0], 0x10008518
cmp dword [ebp - 0x54], 0x431c
jle 0x1001cbea
push 0xa63
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
and dword [ebp - 0x20], 0
jmp 0x1001cb2e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4328
jge 0x1001cbea
and dword [ebp - 0x28], 0
jmp 0x1001cb48
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x7bdc
jge 0x1001cbe5
and dword [ebp - 0x14], 0
jmp 0x1001cb62
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b33
jge 0x1001cbe0
and dword [ebp - 0x18], 0
jmp 0x1001cb78
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6506
jge 0x1001cbdb
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x28]
or eax, ecx
cdq
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], edx
push dword [ebp - 0xf0]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x148]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x148]
call fcn.1000dde4
jmp 0x1001cb71
jmp 0x1001cb5b
jmp 0x1001cb41
jmp 0x1001cb27
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x54], 0x3fb1
jge 0x1001cc0f
push dword [ebp - 0xe0]
call fcn.1004c266
pop ecx
jmp 0x1001cc2b
or dword [ebp - 4], 0xffffffff
jmp 0x1001cc35
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xfffffff9
jmp 0x1001cc5a
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
je 0x1001cc86
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001cc4f
mov dword [ebp - 4], 8
cmp dword [ebp - 0x68], 0x6343
jge 0x1001cca2
push dword [ebp - 0x88]
call fcn.1004c266
pop ecx
jmp 0x1001ccbe
or dword [ebp - 4], 0xffffffff
jmp 0x1001ccc8
jmp 0x1001cd33
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa8], eax
push dword [ebp - 0x90]
push dword [ebp - 0x98]
push dword [ebp - 0xa0]
push 0
push dword [ebp - 0xa8]
push 0x4356
push dword [ebp - 0xb0]
push dword [ebp - 0xb8]
call fcn.10036831
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret