Function at 0x100022b0
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x1c]
push ebp
push esi
push edi
test ecx, ecx
mov dword [esp + 0x10], ebx
je 0x100025b6
mov eax, dword [esp + 0x2c]
cmp eax, 4
jb 0x100025b6
mov edx, dword [ecx]
dec edx
je 0x100023fa
dec edx
jne 0x100025b6
lea esi, [ebx + 0xc78]
mov ecx, esi
call fcn.10001fc0
push 0
push 8
mov ecx, esi
call fcn.10001fd0
mov edi, eax
xor ebp, ebp
cmp edi, ebp
je 0x100025b6
push 8
mov ecx, esi
mov word [edi], 2
mov word [edi + 2], bp
mov dword [edi + 4], ebp
call fcn.100020a0
cmp word [ebx + 0xc94], bp
lea eax, [ebx + 0xc94]
jne 0x1000233c
mov word [edi + 2], 2
mov dword [edi + 4], ebp
jmp 0x100023d9
push 8
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push str.D3DXCheckVer
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
jne 0x10002363
mov word [edi + 2], bp
mov dword [edi + 4], ebp
jmp 0x100023ca
call eax
mov ebp, eax
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov ebx, ecx
mov ecx, esi
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.10001fd0
test eax, eax
mov dword [esp + 0x28], eax
je 0x100023ca
mov ecx, esi
call fcn.10001f70
mov ecx, dword [esp + 0x28]
push ebx
push ecx
push 0xffffffffffffffff
mov edi, eax
push ebp
push 0
push 0
mov word [edi + 2], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
shl eax, 1
push eax
mov ecx, esi
mov dword [edi + 4], eax
call fcn.100020a0
push 2
push 0x10015764
mov ecx, esi
call fcn.10001db0
add dword [edi + 4], eax
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp + 0x10]
mov ecx, esi
call fcn.10002110
push eax
mov ecx, esi
call fcn.10001f70
push eax
mov ecx, ebx
call fcn.1000e330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp eax, 0x18
mov dword [esp + 0x2c], 0
jb 0x10002577
mov ebp, dword [ecx + 0x10]
mov edx, dword [ecx + 8]
lea esi, [edx + ebp + 0x18]
cmp esi, eax
ja 0x10002577
mov esi, dword [ecx + 4]
lea edi, [esi + edx]
cmp edi, eax
ja 0x10002577
mov edi, dword [ecx + 0xc]
lea ebx, [edi + ebp]
cmp ebx, eax
ja 0x10002577
mov eax, edx
lea ebx, [esi + ecx]
shr eax, 1
dec eax
cmp word [ebx + eax*2], 0
jne 0x10002577
test eax, eax
je 0x10002577
test edx, edx
je 0x10002577
add edi, ecx
xor esi, esi
xor eax, eax
mov dword [esp + 0x14], edi
test ebp, ebp
jbe 0x10002476
xor edx, edx
mov dl, byte [eax + edi]
add esi, edx
inc eax
cmp eax, ebp
jb 0x1000246a
cmp dword [ecx + 0x14], esi
jne 0x10002577
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, ebx
call fcn.100025c0
test eax, eax
je 0x10002577
add ebx, 0xc94
push ebx
call fcn.10003440
add esp, 4
test eax, eax
jne 0x10002568
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
mov dword [esp + 0x28], 1
je 0x10002572
test edi, edi
je 0x10002572
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x10002506
lea ecx, [esp + 0x20]
xor eax, eax
push 2
push ecx
push eax
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x10002522
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x10002572
xor edi, edi
test ebp, ebp
jbe 0x10002559
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov eax, ebp
push 0
push edx
sub eax, edi
lea edx, [edi + ecx]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10002551
add edi, dword [esp + 0x18]
cmp edi, ebp
jb 0x10002528
jmp 0x10002559
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10002572
mov dword [esp + 0x2c], 1
jmp 0x10002577
mov word [ebx], 0
mov edi, dword [esp + 0x10]
lea esi, [edi + 0xc78]
mov ecx, esi
call fcn.10001fc0
push 0
push 8
mov ecx, esi
call fcn.10001fd0
test eax, eax
je 0x100025b6
mov cx, word [esp + 0x2c]
push 8
mov word [eax + 2], cx
push eax
mov ecx, edi
mov word [eax], 1
mov dword [eax + 4], 0
call fcn.1000e330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8