Function at 0xf04b2f6
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword fs:[0x18]
mov dword [ebp - 0x124], edx
mov edx, 0xffff
mov dword [ebp - 0x120], ecx
mov word [ecx], dx
push 0x104
lea ecx, [ebp - 0x108]
xor ebx, ebx
push ecx
inc ebx
push eax
mov dword [ebp - 0x110], 0x80
mov dword [ebp - 0x11c], ebx
add esi, 0xbf8
call sym.ntvdm.exe_RedirectShortFileName
push eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x138]
push eax
push esi
call dword [0xf0ae238]
test eax, eax
jl 0xf04b6d9
mov edx, dword [ebp + 0xc]
test dl, 8
je 0xf04b394
mov eax, 0x80070001
jmp 0xf04b6d9
mov ecx, dword [ebp + 0x14]
mov eax, ecx
and eax, 0xf
sub eax, 0
push edi
je 0xf04b3cc
dec eax
je 0xf04b3bc
dec eax
jne 0xf04b6d3
not cl
movzx edi, cl
and edi, 0x10
or edi, 0x40
shr edi, 4
jmp 0xf04b3d8
push 0
test cl, 0x10
pop eax
setne al
add eax, 3
mov edi, eax
jmp 0xf04b3d8
cmp cx, 0x10
jne 0xf04b6d3
mov edi, ebx
movzx eax, dx
mov ecx, eax
and ecx, 0x70
je 0xf04b423
cmp ecx, 0x10
je 0xf04b41a
cmp ecx, 0x20
je 0xf04b412
cmp ecx, 0x30
je 0xf04b406
cmp ecx, 0x40
jne 0xf04b6d3
mov dword [ebp - 0x10c], 3
jmp 0xf04b42d
mov dword [ebp - 0x10c], 2
jmp 0xf04b42d
mov dword [ebp - 0x10c], ebx
jmp 0xf04b42d
and dword [ebp - 0x10c], 0
jmp 0xf04b42d
mov dword [ebp - 0x10c], 7
and eax, 0xf
sub eax, 0
mov ecx, 0x80000000
je 0xf04b450
dec eax
je 0xf04b57c
dec eax
je 0xf04b56d
dec eax
dec eax
jne 0xf04b6d3
mov dword [ebp - 0x114], ecx
test edx, 0x9800
jne 0xf04b6d3
test edx, 0x100
je 0xf04b474
mov dword [ebp - 0x110], 0x20000080
test edx, 0x4000
je 0xf04b482
or dword [ebp - 0x110], ecx
mov eax, dword [ebp + 0x10]
and eax, 0x27
or dword [ebp - 0x110], eax
push esi
call fcn.0f048402
and dword [ebp - 0x12c], 0
push 0
push dword [ebp - 0x110]
lea eax, [ebp - 0x130]
push edi
push eax
push dword [ebp - 0x10c]
mov dword [ebp - 0x130], 0xc
push dword [ebp - 0x114]
mov dword [ebp - 0x128], ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0xf04b51d
mov eax, dword fs:[0x18]
cmp dword [eax + 0xc0], 0
je 0xf04b51d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xc0]
test dword [eax + 0x28], 0x200000
je 0xf04b51d
push dword [ebp - 0x110]
lea eax, [ebp - 0x130]
push edi
push eax
push dword [ebp - 0x10c]
push dword [ebp - 0x114]
push esi
call fcn.0f04af1b
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp ebx, 0xffffffff
je 0xf04b5d1
cmp eax, 0xb7
jne 0xf04b597
push 0x12
pop eax
cmp ax, word [ebp + 0x14]
jne 0xf04b5a7
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0xf04b59d
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xf04b58b
call edi
mov esi, eax
push ebx
or esi, 0x80070000
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0xf04b6d8
mov dword [ebp - 0x114], 0xc0000000
jmp 0xf04b456
mov dword [ebp - 0x114], 0x40000000
jmp 0xf04b456
mov dword [ebp - 0x11c], 3
jmp 0xf04b5a7
test byte [ebp + 0x14], 0x10
je 0xf04b5a7
mov dword [ebp - 0x11c], 2
push 0
lea eax, [ebp - 0x118]
push eax
push 0
call sym.ntvdm.exe_VDDAllocateDosHandle
movzx edi, ax
mov dword [ebp - 0x110], edi
test di, di
jge 0xf04b5db
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx eax, di
neg eax
or eax, 0x80070000
jmp 0xf04b6d8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
and dword [ebp - 0x10c], 0
mov edi, 0x208
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x114], eax
test eax, eax
je 0xf04b65c
push 0
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.ntdll.dll_RtlGetFullPathName_U]
test eax, eax
je 0xf04b641
cmp eax, edi
ja 0xf04b641
mov esi, dword [ebp - 0x114]
cmp word [esi + 2], 0x3a
jne 0xf04b647
movzx eax, word [esi]
push eax
call dword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
sub ax, 0x41
movzx eax, ax
mov dword [ebp - 0x10c], eax
jmp 0xf04b647
mov esi, dword [ebp - 0x114]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x118]
mov ecx, eax
and ecx, 0x7f
mov word [edx + 2], cx
mov ecx, dword [ebp - 0x118]
mov byte [ecx + 4], 0
mov ecx, dword [ebp - 0x118]
and eax, 0x80
shl eax, 5
mov word [ecx + 5], ax
mov eax, dword [ebp - 0x118]
movzx cx, byte [ebp - 0x10c]
or word [eax + 5], cx
mov eax, dword [ebp - 0x118]
or dword [eax + 7], 0xffffffff
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x124]
mov dword [eax + 0x1d], ebx
mov ax, word [ebp - 0x11c]
mov word [ecx], ax
mov ax, word [ebp - 0x110]
mov ecx, dword [ebp - 0x120]
mov word [ecx], ax
xor eax, eax
jmp 0xf04b6d8
mov eax, 0x80070057
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0x1c