Function at 0x100b3a6a
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x460
xor eax, eax
push ebp
mov ebp, dword [esp + 0x484]
lea eax, [ebp - 1]
cmp eax, 0x1f
ja case.0x100b3a63.2
movzx eax, byte [eax + 0x100b403c]
jmp dword [eax*4 + 0x100b4034]
mov eax, 1
push ebx
push esi
push edi
cmp ebp, 8
jg 0x100b3adc
mov esi, eax
mov ecx, ebp
shl esi, cl
mov eax, ebp
lea ecx, [esi*4 + 0x36]
dec eax
je 0x100b3ab3
sub eax, 3
je 0x100b3aa4
mov edx, dword [esp + 0x47c]
sub eax, 4
jne 0x100b3a9e
mov eax, edx
jmp 0x100b3acd
mov eax, dword [esp + 0x18]
jmp 0x100b3acd
mov eax, dword [esp + 0x47c]
inc eax
cdq
sub eax, edx
sar eax, 1
jmp 0x100b3ac6
mov eax, dword [esp + 0x47c]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, dword [esp + 0x47c]
lea ebx, [eax + 3]
and ebx, 0xfffffffc
jne 0x100b3b01
mov ebx, 4
jmp 0x100b3b01
mov esi, dword [esp + 0x18]
mov eax, ebp
cdq
mov ecx, 0x36
and edx, 7
lea ebx, [edx + eax]
mov edx, dword [esp + 0x47c]
sar ebx, 3
imul ebx, edx
add ebx, 3
and ebx, 0xfffffffc
mov eax, dword [esp + 0x480]
mov edi, ebx
imul edi, eax
mov ebp, 0x4d42
mov dword [esp + 0x50], eax
mov eax, 1
mov word [esp + 0x38], bp
mov word [esp + 0x54], ax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x474]
lea ebp, [edi + ecx]
mov dword [esp + 0x42], ecx
mov dword [esp + 0x3a], ebp
xor ebp, ebp
mov dword [esp + 0x3e], ebp
mov ebp, dword [esp + 0x490]
mov dword [esp + 0x48], 0x28
mov dword [esp + 0x4c], edx
mov word [esp + 0x56], bp
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
test eax, eax
je 0x100b3bb5
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jmp 0x100b3bc6
push 1
push dword [esp + 0x3e]
call fcn.100b7d70
mov dword [esp + 0x20], eax
test eax, eax
je 0x100b401a
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push 0xe
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100b4060
add esp, 0xc
test eax, eax
je 0x100b3fbf
push 0x28
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100b4060
add esp, 0xc
test eax, eax
je 0x100b3fbf
cmp ebp, 1
je 0x100b3e44
cmp ebp, 4
je 0x100b3e44
cmp ebp, 8
je 0x100b3e44
mov esi, dword [esp + 0x494]
cmp esi, 0x18
je 0x100b3c36
cmp esi, 0x20
jne 0x100b3c70
test byte [esp + 0x488], 2
je 0x100b3c70
cmp dword [esp + 0x484], ebx
jne 0x100b3c70
push edi
push dword [esp + 0x47c]
lea eax, [esp + 0x24]
push eax
call fcn.100b4060
add esp, 0xc
test eax, eax
je 0x100b3fbf
mov ebp, 1
jmp 0x100b3fc1
push ebx
push 8
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x100b3fbf
mov eax, dword [esp + 0x480]
mov ebp, 1
mov dword [esp + 0x14], ebp
mov dword [esp + 0x2c], 0
test eax, eax
jle 0x100b3e30
mov ebp, dword [esp + 0x484]
mov edx, dword [esp + 0x488]
neg ebp
mov dword [esp + 0x18], ebp
and edx, 2
lea ebp, [eax - 1]
mov dword [esp + 0x34], edx
imul ebp, dword [esp + 0x484]
mov edx, dword [esp + 0x478]
mov dword [esp + 0x28], edx
add ebp, edx
mov dword [esp + 0x30], ebp
cmp dword [esp + 0x34], 0
mov edi, edx
jne 0x100b3cef
mov edi, ebp
mov eax, dword [esp + 0x47c]
test eax, eax
jle 0x100b3dcf
mov ebp, eax
cmp esi, 0x20
jne 0x100b3d98
movzx esi, byte [edi + 2]
movzx eax, byte [edi + 3]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 2], al
movzx esi, byte [edi + 1]
movzx eax, byte [edi + 3]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 1], al
movzx esi, byte [edi]
movzx eax, byte [edi + 3]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
mov esi, dword [esp + 0x494]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, 4
jmp 0x100b3dac
movzx eax, byte [edi + 2]
mov byte [ecx + 2], al
movzx eax, byte [edi + 1]
mov byte [ecx + 1], al
movzx eax, byte [edi]
add edi, 3
cmp dword [esp + 0x490], 0x20
mov byte [ecx], al
jne 0x100b3dc1
mov byte [ecx + 3], 0
add ecx, 4
jmp 0x100b3dc4
add ecx, 3
dec ebp
jne 0x100b3d00
mov ebp, dword [esp + 0x30]
push ebx
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
call fcn.100b4060
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x100b3e2e
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
inc edi
add edx, dword [esp + 0x484]
add ebp, dword [esp + 0x18]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], ebp
cmp edi, dword [esp + 0x480]
jl 0x100b3ce4
mov ebp, dword [esp + 0x14]
push ecx
push 0
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100b3fc1
xor ebp, ebp
push ecx
push 0
push dword [0x1021bd34]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100b3fc1
push dword [esp + 0x48c]
mov eax, dword [esp + 0x480]
push ebp
push dword [esp + 0x48c]
mov ebp, dword [esp + 0x48c]
push dword [esp + 0x4a0]
push ebp
push eax
push dword [esp + 0x490]
call fcn.100b4525
add esp, 0x1c
mov dword [esp + 0x10], eax
xor edx, edx
test esi, esi
jle 0x100b3eb0
lea ecx, [eax + 0x51]
jmp 0x100b3e90
movzx eax, byte [ecx + 1]
lea ecx, [ecx + 4]
mov byte [esp + edx*4 + 0x72], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx*4 + 0x71], al
movzx eax, byte [ecx - 5]
mov byte [esp + edx*4 + 0x70], al
inc edx
cmp edx, esi
jl 0x100b3e90
lea eax, [esi*4]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100b4060
add esp, 0xc
test eax, eax
je 0x100b3ed6
mov dword [esp + 0x14], 1
test byte [esp + 0x488], 2
mov esi, dword [esp + 0x1c]
je 0x100b3f5d
xor edi, edi
test ebp, ebp
jle 0x100b3fad
mov ebp, dword [esp + 0x24]
add ebp, dword [esp + 0x20]
push edi
push dword [esp + 0x14]
call fcn.100b472c
add esp, 8
test esi, esi
je 0x100b3f34
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b3f21
cmp dword [esp + 0x18], ebx
je 0x100b3f41
push dword [esp + 0x10]
xor ebp, ebp
call fcn.100b46e0
add esp, 4
jmp 0x100b3fc5
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebp, ebx
inc edi
cmp edi, dword [esp + 0x480]
jl 0x100b3ef6
push dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
call fcn.100b46e0
add esp, 4
jmp 0x100b3fc5
lea edi, [ebp - 1]
test edi, edi
js 0x100b3fad
mov ebp, dword [esp + 0x24]
add ebp, dword [esp + 0x20]
lea esp, [esp]
push edi
push dword [esp + 0x14]
call fcn.100b472c
add esp, 8
test esi, esi
je 0x100b3f9d
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b3f21
cmp dword [esp + 0x18], ebx
jne 0x100b3f21
jmp 0x100b3faa
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebp, ebx
dec edi
jns 0x100b3f70
push dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
call fcn.100b46e0
add esp, 4
jmp 0x100b3fc5
xor ebp, ebp
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x474]
test edi, edi
je 0x100b3fef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x100b401c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x460
ret
test ebp, ebp
je 0x100b4004
mov ebp, dword [esp + 0x20]
mov eax, ebp
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x460
ret
push dword [esp + 0x20]
call fcn.100b7c30
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x460
ret
xor ebp, ebp
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x460
ret
xor eax, eax
pop ebp
add esp, 0x460
ret