Function at 0x10015fa
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x30
push ebp
xor ebp, ebp
cmp dword [0x10040c4], ebp
push esi
je 0x1001617
push 0x2716
push 2
call fcn.01002ce7
pop ecx
pop ecx
lea eax, [esp + 0x14]
push eax
push dword [0x1004274]
call dword [sym.imp.msvcrt.dll__stat]
test eax, eax
mov esi, dword [0x1004274]
pop ecx
pop ecx
jl 0x100166a
mov eax, dword [esp + 0x1a]
and ax, 0x6000
cmp ax, 0x4000
jne 0x100165a
push esi
push dword [0x1004270]
push 0x2717
push 2
call fcn.01002ce7
add esp, 0x10
jmp 0x1001699
test byte [esp + 0x1b], 0x70
je 0x100166a
mov eax, esi
mov dword [0x1004020], eax
jmp 0x100166f
mov eax, dword [0x1004020]
cmp eax, ebp
jne 0x10016b0
push esi
call fcn.01002a00
cmp eax, ebp
mov dword [0x1004020], eax
jne 0x10016a0
push 0x2720
push 2
push dword [ebx + 0xc8]
lea eax, [ebx + 0x48]
push eax
push ebx
call fcn.010012e0
xor eax, eax
jmp 0x10019a8
mov esi, dword [0x1004274]
mov dword [0x1004024], 1
cmp dword [ebx + 0x3c], ebp
push edi
push 2
mov edi, 0x100115c
pop ecx
jne 0x10017fa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10016e5
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10011a0
push dword [eax + 0x30]
call dword [sym.imp.msvcrt.dll__dup]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__fdopen]
jmp 0x10016f1
push 0x100119c
push eax
call dword [sym.imp.msvcrt.dll_fopen]
cmp eax, ebp
pop ecx
pop ecx
mov dword [esp + 0xc], eax
jne 0x1001734
push dword [0x1004274]
push dword [0x1004270]
push 0x2713
push 2
call fcn.01002ce7
add esp, 0x10
push 0x2720
push 2
push dword [ebx + 0xc8]
lea eax, [ebx + 0x48]
push eax
push ebx
call fcn.010012e0
xor eax, eax
jmp 0x10019a7
mov dword [esp + 0x10], ebp
mov ebp, dword [sym.imp.msvcrt.dll_putc]
push ebx
call fcn.01002900
test eax, eax
je 0x10017c6
mov si, word [ebx + 0x28]
sub si, 4
lea edi, [eax + 4]
movsx eax, si
xor ecx, ecx
cmp eax, dword [ebx + 0xe0]
sete cl
add dword [0x10040c8], eax
mov dword [esp + 0x14], ecx
jmp 0x10017ab
movsx eax, byte [edi]
dec esi
inc edi
cmp dword [esp + 0x10], 0
je 0x100178e
and dword [esp + 0x10], 0
cmp eax, 0xa
push dword [esp + 0xc]
jne 0x100178a
push eax
jmp 0x10017a2
push 0xd
jmp 0x10017a2
cmp eax, 0xd
jne 0x100179d
mov dword [esp + 0x10], 1
jmp 0x10017ab
push dword [esp + 0xc]
push eax
call ebp
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x10017eb
test si, si
jg 0x100176d
cmp dword [esp + 0x14], 0
jne 0x100173e
push dword [esp + 0xc]
call dword [sym.imp.msvcrt.dll_fclose]
jmp 0x1001868
cmp dword [0x1004024], 0
je 0x10017dc
push dword [0x1004020]
call dword [sym.imp.msvcrt.dll__unlink]
pop ecx
push dword [esp + 0xc]
call dword [sym.imp.msvcrt.dll_fclose]
jmp 0x10018ea
push dword [esp + 0xc]
call dword [sym.imp.msvcrt.dll_fclose]
jmp 0x1001975
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x10018f0
mov eax, dword [sym.imp.msvcrt.dll__iob]
push dword [eax + 0x30]
call dword [sym.imp.msvcrt.dll__dup]
pop ecx
mov edi, eax
push ebx
call fcn.01002900
test eax, eax
je 0x1001948
mov cx, word [ebx + 0x28]
sub cx, 4
test cx, cx
je 0x1001861
movsx esi, cx
xor ecx, ecx
cmp esi, dword [ebx + 0xe0]
push esi
sete cl
add dword [0x10040c8], esi
add eax, 4
push eax
push edi
mov ebp, ecx
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
cmp eax, esi
jne 0x100196e
test ebp, ebp
jne 0x1001815
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push ebx
call fcn.010021de
cmp dword [0x1004024], 0
je 0x10019a4
mov eax, dword [0x1004274]
push 2
mov edi, 0x100115c
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x10019a4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [0x1004274]
push dword [0x1004020]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10019a4
push dword [0x1004274]
push dword [0x1004270]
push 0x2713
push 2
call fcn.01002ce7
add esp, 0x10
cmp dword [0x1004024], 0
je 0x100172d
push dword [0x1004020]
call dword [sym.imp.msvcrt.dll__unlink]
pop ecx
jmp 0x100172d
push 0x100
push 0x8301
push eax
call dword [sym.imp.msvcrt.dll__open]
mov edi, eax
add esp, 0xc
cmp edi, ebp
jge 0x1001815
push dword [0x1004274]
push dword [0x1004270]
push 0x2713
push 2
call fcn.01002ce7
add esp, 0x10
push 0x2720
push 2
push dword [ebx + 0xc8]
lea eax, [ebx + 0x48]
push eax
push ebx
call fcn.010012e0
cmp dword [0x1004024], ebp
jmp 0x10018d8
cmp dword [0x1004024], 0
je 0x100172d
push edi
call dword [sym.imp.msvcrt.dll__close]
push dword [0x1004020]
call dword [sym.imp.msvcrt.dll__unlink]
pop ecx
jmp 0x10018ea
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
push 0x2718
call fcn.01002d56
push 0x2721
push 3
push dword [ebx + 0xc8]
lea eax, [ebx + 0x48]
push eax
push ebx
call fcn.010012e0
jmp 0x10018d1
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret