Function at 0x1000bf18
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c7
push 0
push 0
dec ecx
jne 0x1000bf20
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x1000c7d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1000c7ec
call sub.kernel32.dll_LoadLibraryA
push 0x1000c7fc
call sub.kernel32.dll_LoadLibraryA
push 0x1000c80c
call sub.kernel32.dll_LoadLibraryA
push 0x1000c818
call sub.kernel32.dll_LoadLibraryA
push 0x1000c820
call sub.kernel32.dll_LoadLibraryA
push 0x1000c82c
call sub.kernel32.dll_LoadLibraryA
push 0x1000c83c
call sub.kernel32.dll_LoadLibraryA
push 0x1000c848
call sub.kernel32.dll_LoadLibraryA
push 0x1000c858
call sub.kernel32.dll_LoadLibraryA
push 0x1000c864
call sub.kernel32.dll_LoadLibraryA
push 0x1000c874
call sub.kernel32.dll_LoadLibraryA
lea eax, [ebp - 0x13b8]
mov edx, 0x1390
call fcn.100050d8
lea esi, [ebx + 0x210]
lea edi, [ebp - 0x13b8]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x13bc]
mov ecx, 0x105
call fcn.100038e0
lea eax, [ebp - 0x13bc]
mov edx, 0x1000c884
call fcn.10003928
mov eax, dword [ebp - 0x13bc]
call fcn.1000390c
call fcn.10005690
cmp al, 1
jne 0x1000c12b
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15cc]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15cc]
push 0x1000c8b0
lea eax, [ebp - 0x15d0]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15d0]
push 0x1000c8dc
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.100039ec
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15d4]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15d4]
push 0x1000c8b0
lea eax, [ebp - 0x15d8]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15d8]
push 0x1000c8ec
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.100039ec
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15dc]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15dc]
push 0x1000c8b0
lea eax, [ebp - 0x15e0]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15e0]
push 0x1000c8fc
mov eax, dword [0x1000e120]
mov edx, 4
call fcn.100039ec
jmp 0x1000c23b
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15e4]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15e4]
push 0x1000c90c
lea eax, [ebp - 0x15e8]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15e8]
push 0x1000c8dc
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.100039ec
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15ec]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15ec]
push 0x1000c90c
lea eax, [ebp - 0x15f0]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15f0]
push 0x1000c8ec
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.100039ec
lea eax, [ebp - 0x15c8]
call fcn.10005664
lea edx, [ebp - 0x15c8]
lea eax, [ebp - 0x15f4]
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x15f4]
push 0x1000c90c
lea eax, [ebp - 0x15f8]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
push dword [ebp - 0x15f8]
push 0x1000c8fc
mov eax, dword [0x1000e120]
mov edx, 4
call fcn.100039ec
lea eax, [ebp - 0x15fc]
push eax
mov cx, 0x3a
mov dx, 0x20
mov ax, 0x2f
call fcn.10006b14
mov eax, dword [ebp - 0x15fc]
push eax
push 2
lea eax, [ebp - 0x1608]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100034b0
mov ecx, dword [ebp - 0x1608]
lea eax, [ebp - 0x1604]
mov edx, 0x1000c918
call fcn.1000352c
mov edx, dword [ebp - 0x1604]
lea eax, [ebp - 0x1600]
call fcn.100038fc
mov edx, dword [ebp - 0x1600]
mov ecx, 0x1000c928
mov eax, 0x80000001
call fcn.1000577c
mov eax, dword [ebp - 0xc]
call fcn.1000390c
mov esi, eax
mov eax, esi
call fcn.10005ca4
test al, al
je 0x1000c361
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
lea edx, [ebp - 0x24]
call fcn.10005e30
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
call fcn.10005f1c
push 0
push 2
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.10003fd4
mov edx, eax
lea eax, [ebp - 8]
call fcn.10003be4
mov eax, dword [ebp - 8]
call fcn.1000390c
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
call fcn.100050d0
lea ecx, [ebp - 0x160c]
mov edx, 0x1000c948
mov eax, dword [ebp - 8]
call fcn.10006234
mov edx, dword [ebp - 0x160c]
lea eax, [ebp - 8]
call fcn.100037d0
lea eax, [ebp - 0x13b8]
mov edx, 0x1390
call fcn.100050d8
mov eax, dword [ebp - 8]
call fcn.1000390c
mov edx, eax
lea eax, [ebp - 0x13b8]
mov ecx, 0x1390
call fcn.100050d0
cmp dword [ebp - 0x30], 0x1e240
je 0x1000c39e
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesW
push esi
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x13b8]
mov edx, 0x1390
call fcn.100050d8
lea esi, [ebx + 0x210]
lea edi, [ebp - 0x13b8]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40e]
push eax
push 0
push 0
call fcn.10004df0
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000c3c4
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0x1610]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x1610]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x13b8]
call fcn.1000a09c
lea edx, [ebp - 0x13b8]
mov eax, dword [ebp - 4]
call fcn.1000a518
cmp byte [ebp - 0x7e7], 1
jne 0x1000c422
lea edx, [ebp - 0x1614]
mov eax, dword [ebp - 4]
call fcn.10005d78
mov eax, dword [ebp - 0x1614]
call fcn.10005f1c
mov eax, dword [ebp - 4]
call fcn.10005f1c
cmp byte [ebp - 0x410], 1
jne 0x1000c483
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x1620]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100034b0
mov ecx, dword [ebp - 0x1620]
lea eax, [ebp - 0x161c]
mov edx, 0x1000c918
call fcn.1000352c
mov edx, dword [ebp - 0x161c]
lea eax, [ebp - 0x1618]
call fcn.100038fc
mov edx, dword [ebp - 0x1618]
mov ecx, 0x1000c95c
mov eax, 0x80000001
call fcn.1000577c
cmp byte [ebp - 0x7e8], 1
jne 0x1000c518
lea eax, [ebp - 0x1624]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x1624]
mov edx, dword [ebp - 4]
call fcn.10003a34
je 0x1000c518
lea eax, [ebp - 0x1628]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x1628]
push eax
lea edx, [ebp - 0x162c]
xor eax, eax
call fcn.10005954
mov edx, dword [ebp - 0x162c]
pop eax
call fcn.10003a34
je 0x1000c518
xor esi, esi
jmp 0x1000c506
push 0x80
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_DeleteFileW
push 0x1f4
call sub.kernel32.dll_Sleep
inc esi
mov edi, ebx
mov eax, edi
call fcn.10005ca4
cmp al, 1
jne 0x1000c518
cmp esi, 5
jl 0x1000c4ea
mov eax, 0x1000f814
call fcn.10003770
mov eax, dword [0x1000e124]
lea edx, [ebp - 0x29c]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x1000e118]
mov dl, byte [ebp - 0x29f]
mov byte [eax], dl
mov eax, dword [0x1000e0fc]
lea edx, [ebp - 0x222]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x1000e108]
lea edx, [ebp - 0x1a8]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x1000e10c]
lea edx, [ebp - 0x12e]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x1000e114]
mov edx, dword [ebp - 0xb4]
mov dword [eax], edx
mov eax, dword [0x1000e11c]
mov dl, byte [ebp - 0xb0]
mov byte [eax], dl
mov eax, dword [0x1000e110]
mov dl, byte [ebp - 0x29e]
mov byte [eax], dl
mov eax, dword [0x1000e104]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100038e0
mov eax, dword [0x1000e100]
lea edx, [ebp - 0xae]
mov ecx, 0x3d
call fcn.100038e0
cmp byte [ebp - 0x2a0], 1
jne 0x1000c5e2
call fcn.100093e4
cmp byte [ebp - 0x34], 1
jne 0x1000c5fc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x1000b840]
call fcn.1000b8b0
call fcn.10009ab0
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x13b8]
mov dl, 1
mov eax, dword [0x1000b0f8]
call fcn.1000b168
call fcn.10009ab0
jmp 0x1000c61e
call fcn.10006058
cmp byte [0x1000e0e8], 0
je 0x1000c619
call fcn.10008d4c
lea eax, [ebp - 8]
mov edx, dword [0x1000f814]
call fcn.100037d0
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.1000390c
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0x1390
mov eax, ebx
lea edx, [ebp - 0x13b8]
call fcn.10005eb4
mov eax, dword [ebp - 4]
push eax
push 2
lea eax, [ebp - 0x1638]
lea edx, [ebp - 0x40e]
mov ecx, 0x3d
call fcn.100034b0
mov ecx, dword [ebp - 0x1638]
lea eax, [ebp - 0x1634]
mov edx, 0x1000c918
call fcn.1000352c
mov edx, dword [ebp - 0x1634]
lea eax, [ebp - 0x1630]
call fcn.100038fc
mov edx, dword [ebp - 0x1630]
mov ecx, 0x1000c978
mov eax, 0x80000001
call fcn.1000577c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
call fcn.1000391c
add eax, eax
push eax
lea eax, [ebp - 0x28]
mov ecx, 1
mov edx, dword [0x1000ade0]
call fcn.10004584
add esp, 4
mov eax, dword [ebp - 8]
call fcn.1000391c
add eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.1000390c
mov edx, eax
mov eax, dword [ebp - 0x28]
pop ecx
call fcn.100050d0
xor eax, eax
test al, al
jne 0x1000c730
xor esi, esi
lea edx, [ebp - 0x163c]
xor eax, eax
call fcn.10005954
mov edx, dword [ebp - 0x163c]
mov eax, dword [ebp - 0x28]
call fcn.1000ae20
inc esi
cmp esi, 0xa
jg 0x1000c730
cmp al, 1
jne 0x1000c70b
push 0
call sub.kernel32.dll_ExitProcess_1