Function at 0x1006ec43
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018cdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x74], esi
xor ebx, ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.100528a8
push ebx
push 0x100
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.100643db
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], ebx
jae 0x1006ecad
lea eax, [ebp - 0x2c]
mov edi, dword [esi]
mov dword [ebp - 0x60], eax
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x101d880c]
mov ecx, edi
call esi
lea ecx, [ebp - 0x64]
push ecx
push 0x200
push dword [ebp - 0x60]
push ebx
push 0x1001f7d0
push eax
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
mov esi, eax
test esi, esi
jle 0x1006eced
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1006f189
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
push 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
pop esi
cmp dword [ebp - 0x18], esi
jae 0x1006ed12
lea eax, [ebp - 0x2c]
push eax
push 0x1001f854
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1006ed3f
movsx eax, byte [0x1001bfc0]
neg eax
sbb eax, eax
and eax, 0x17f
push eax
push 0x1001bfc0
jmp 0x1006edde
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1006ed4a
lea eax, [ebp - 0x2c]
push eax
push 0x1001f8c4
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1006ed74
movsx eax, byte [0x1001c140]
neg eax
sbb eax, eax
and eax, 0x184
push eax
push 0x1001c140
jmp 0x1006edde
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1006ed7f
lea eax, [ebp - 0x2c]
push eax
push 0x1001f830
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1006eda9
movsx eax, byte [0x1001c2c8]
neg eax
sbb eax, eax
and eax, 0x17e
push eax
push 0x1001c2c8
jmp 0x1006edde
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1006edb4
lea eax, [ebp - 0x2c]
push eax
push 0x1001f8a0
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1006f0aa
movsx eax, byte [0x1001c448]
neg eax
sbb eax, eax
and eax, 0xa
push eax
push 0x1001c448
lea ecx, [ebp - 0x44]
call fcn.10043d0a
push ebx
push 0x104
lea ecx, [ebp - 0x5c]
call fcn.100643db
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x48], esi
jae 0x1006ee03
lea eax, [ebp - 0x5c]
mov edi, dword [ebp - 0x74]
mov dword [ebp - 0x60], eax
mov edi, dword [edi]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x101d880c]
mov ecx, edi
call esi
lea ecx, [ebp - 0x64]
push ecx
push 0x208
push dword [ebp - 0x60]
push ebx
push 0x1001f874
push eax
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDataW]
mov esi, eax
test esi, esi
jle 0x1006ee46
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1006ee83
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1006ee6e
test byte [eax + 0x44], 1
je 0x1006ee6e
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x16
pop ecx
call fcn.1004a069
push esi
lea ecx, [ebp - 0x78]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1006f1bf
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], ebx
push eax
lea ecx, [ebp - 0x98]
call fcn.100440e8
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x60]
test esi, esi
jns 0x1006eedb
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1006eec6
test byte [eax + 0x44], 1
je 0x1006eec6
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x17
pop ecx
call fcn.1004a069
push esi
lea ecx, [ebp - 0x7c]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1006f1bf
lea ecx, [ebp - 0x5c]
call fcn.1006ea84
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x48], 8
mov eax, dword [ebp - 0x5c]
jae 0x1006eef6
lea eax, [ebp - 0x5c]
push ebx
push 0x8100080
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x60]
call fcn.1006f4f2
cmp dword [ebp - 0x60], 0xffffffff
jne 0x1006ef94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x101c33f0]
mov edi, 0x101c33f0
cmp eax, edi
je 0x1006ef50
test byte [eax + 0x44], 1
je 0x1006ef50
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x18
pop ecx
call fcn.1004a069
mov eax, dword [0x101c33f0]
test esi, esi
jle 0x1006ef5f
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1006ef99
cmp eax, edi
je 0x1006ef7f
test byte [eax + 0x44], 1
je 0x1006ef7f
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x19
pop ecx
call fcn.1004a069
push esi
lea ecx, [ebp - 0x80]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1006f1bf
mov edi, 0x101c33f0
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], ebx
jae 0x1006efa8
lea eax, [ebp - 0x44]
push ebx
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006f00f
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x34]
jne 0x1006f00f
lea ecx, [ebp - 0x60]
call fcn.1006f562
lea ecx, [ebp - 0x98]
call fcn.1004417d
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.10052803
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.10043c5c
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10052803
cmp dword [ebp - 0x6c], 0
je 0x1006f16d
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1006f16d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x101c33f0]
cmp eax, edi
je 0x1006f03a
test byte [eax + 0x44], 1
je 0x1006f03a
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x1a
pop ecx
call fcn.1004a069
push ebx
lea ecx, [ebp - 0x60]
call fcn.1006f4f2
cmp dword [ebp - 0x48], 8
mov eax, dword [ebp - 0x5c]
jae 0x1006f04f
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jle 0x1006f063
movzx esi, si
or esi, 0x80070000
lea ecx, [ebp - 0x60]
call fcn.1006f562
lea ecx, [ebp - 0x98]
call fcn.1004417d
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.10052803
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.10043c5c
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10052803
cmp dword [ebp - 0x6c], 0
je 0x1006f0a3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
jmp 0x1006f16f
mov eax, dword [0x101c33f0]
mov edi, 0x101c33f0
cmp eax, edi
je 0x1006f104
test byte [eax + 0x44], 4
je 0x1006f0e2
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x1006f0c9
lea ecx, [ebp - 0x2c]
push ecx
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x14
pop ecx
call fcn.1004a093
mov eax, dword [0x101c33f0]
cmp eax, edi
je 0x1006f104
test byte [eax + 0x44], 1
je 0x1006f104
push 0x8000ffff
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x15
pop ecx
call fcn.1004a069
push 0x8000ffff
lea ecx, [ebp - 0x84]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
jmp 0x1006f1bf
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101885f0
leave
ret
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x1006f1af
test byte [eax + 0x44], 1
je 0x1006f1af
push esi
push dword [eax + 0x3c]
mov edx, 0x1001f8e8
push dword [eax + 0x38]
push 0x13
pop ecx
call fcn.1004a069
push esi
lea ecx, [ebp - 0x70]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3