Function at 0x10019a44
Capabilities:
Delete file
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x10086084]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
xor esi, esi
mov dword [esp + 0x1c], edx
push edi
xor edi, edi
mov dword [esp + 0x1c], ecx
inc edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], 0x11
mov byte [esp + 0x44], al
mov dword [esp + 0x48], 0x12
mov byte [esp + 0x4c], al
mov dword [esp + 0x50], 8
mov byte [esp + 0x54], al
mov dword [esp + 0x38], eax
test ecx, ecx
je 0x1001a1d3
test ebx, ebx
je 0x1001a1d3
cmp word [ebx], ax
je 0x1001a1d3
cmp dword [ecx], 0xfeedf001
jne 0x1001a1d3
test edx, edx
je 0x10019aee
cmp dword [edx], 0xfeedf002
jne 0x1001a1d3
test dword [ebp + 0xc], 0xf9cd5ecd
jne 0x1001a1d3
mov ecx, ebx
call fcn.10080e5a
test eax, eax
je 0x1001a1db
mov ecx, dword [esp + 0x1c]
call fcn.10030eb9
test al, 1
je 0x10019b1e
push 5
jmp 0x1001a1d5
xor eax, eax
xor edx, edx
push eax
mov ecx, ebx
call fcn.1003670e
mov dword [esp + 0x18], eax
test eax, eax
je 0x1001a1db
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, eax
call fcn.10036b2c
mov ebx, eax
test ebx, ebx
jns 0x10019b9d
push ebx
push 0xabe
mov ecx, 0x10004478
call fcn.1003a254
test ebx, 0x10000000
je 0x10019b7c
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x10019b93
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x10019b8d
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x10019b93
movzx eax, bx
mov dword [esp + 0x14], eax
jmp 0x10019b97
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov edi, ebx
jmp 0x10019bbd
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x10019bb1
cmp eax, 4
jne 0x10019bbb
mov dword [esp + 0x14], 0xa1
jmp 0x10019b97
xor ebx, ebx
cmp dword [esp + 0x10], esi
je 0x10019bd5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1001a120
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.10030b0c
lea ecx, [esp + 0x10]
xor edx, edx
push ecx
mov ecx, eax
call fcn.1003670e
mov dword [esp + 0x30], eax
test eax, eax
je 0x10019c18
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10019c18
xor ecx, ecx
cmp word [eax], cx
je 0x10019c18
mov word [eax], cx
xor eax, eax
jmp 0x10019c26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, eax
test edi, edi
je 0x1001a120
push 0x410
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x18], 0x208
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
lea edx, [esp + 0x58]
mov ecx, ebx
push eax
call fcn.1001b88e
test eax, eax
jne 0x10019c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x660
jne 0x10019c7b
cmp dword [esp + 0x10], esi
jne 0x10019c7b
mov eax, dword [esp + 0x30]
push eax
push ebx
call sym.WIMGAPI.DLL_WIMSetTemporaryPath
xor eax, eax
mov dword [esp + 0x10], 0x208
push 0x410
push eax
lea eax, [esp + 0x60]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
lea edx, [esp + 0x58]
mov ecx, ebx
push eax
call fcn.1001b88e
test eax, eax
je 0x10019cb5
xor eax, eax
cmp ax, word [esp + 0x58]
jne 0x10019cc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, eax
jmp 0x10019cc7
xor eax, eax
test edi, edi
je 0x1001a120
push eax
xor edx, edx
mov ecx, ebx
call fcn.100314e2
mov esi, eax
test esi, esi
je 0x10019eba
mov edx, dword [esp + 0x18]
mov ecx, esi
call fcn.100337f8
mov ebx, eax
lea edx, [esp + 0x24]
xor eax, eax
mov ecx, esi
push eax
call fcn.10030a2b
test eax, eax
je 0x10019d0a
mov dword [esp + 0x34], 1
mov eax, dword [ebp + 0xc]
test al, 2
je 0x10019d1e
push 2
pop edx
mov ecx, esi
call fcn.1001538a
mov eax, dword [ebp + 0xc]
test al, 0x10
jne 0x10019d27
test bl, 8
jne 0x10019d34
push 0x10
pop edx
mov ecx, esi
call fcn.1001538a
mov eax, dword [ebp + 0xc]
test al, 0x20
jne 0x10019d3d
test bl, 8
jne 0x10019d47
push 0x20
pop edx
mov ecx, esi
call fcn.1001538a
mov ebx, dword [ebp + 0xc]
mov edx, 0x2000000
test edx, ebx
je 0x10019d5a
mov ecx, esi
call fcn.1001538a
mov eax, 0x4000000
test eax, ebx
je 0x10019d6c
mov edx, eax
mov ecx, esi
call fcn.1001538a
mov edx, 0x200000
test edx, ebx
je 0x10019d7c
mov ecx, esi
call fcn.1001538a
mov edx, 0x8000
test edx, ebx
je 0x10019d8c
mov ecx, esi
call fcn.1001538a
mov edx, 0x100
test edx, ebx
je 0x10019d9e
mov ecx, esi
call fcn.1001538a
jmp 0x10019da9
mov ecx, dword [esp + 0x1c]
or dword [ecx + 0x28], 0x80
mov eax, 0x20000
mov ecx, esi
mov edx, eax
test eax, ebx
jne 0x10019dbb
mov edx, 0x10000
call fcn.1001538a
mov ecx, dword [esp + 0x1c]
call fcn.10030d9c
mov ecx, 0x2000
cmp eax, 7
jne 0x10019dd8
or ebx, ecx
mov dword [ebp + 0xc], ebx
test ecx, ebx
je 0x10019e45
test ebx, 0x100000
jne 0x10019e03
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.1001700c
test eax, eax
jne 0x10019dfe
xor eax, eax
mov edi, eax
jmp 0x1001a0a3
mov ecx, 0x2000
mov edx, ecx
mov ecx, esi
call fcn.1001538a
mov ecx, dword [esp + 0x18]
mov edx, 0x10003c78
call fcn.10080125
mov dword [esp + 0x3c], eax
test eax, eax
je 0x10019e45
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x18]
push eax
call fcn.1003ab83
test eax, eax
je 0x10019e45
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.100314aa
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10019e50
mov dword [esi + 0x30], eax
xor eax, eax
test edi, edi
je 0x1001a0a3
test ebx, 0x20000
jne 0x10019ef8
test esi, esi
je 0x10019e76
push eax
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.10030a2b
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x40]
push 3
call fcn.10039af9
mov edi, eax
test edi, edi
jns 0x10019ef0
push edi
push 0xbc8
mov ecx, 0x10004478
call fcn.1003a254
test edi, 0x10000000
je 0x10019ecd
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x10019ee7
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x10019ede
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, eax
jmp 0x10019e52
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x10019ee7
movzx eax, di
mov dword [esp + 0x14], eax
jmp 0x10019df5
mov dword [esp + 0x14], edi
jmp 0x10019df5
mov dword [esp + 0x38], 1
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x10]
xor eax, eax
mov ecx, ebx
mov dword [esp + 0x10], eax
call fcn.1004234b
mov edi, eax
test edi, edi
je 0x1001a0a1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10019f31
test esi, esi
je 0x10019f31
cmp dword [esi], 0xfeedf002
jne 0x10019f31
mov dword [esi + 0xd8], ecx
push 1
push 1
xor eax, eax
or edx, 0xffffffff
push eax
push ebx
push eax
mov ecx, esi
call fcn.10032571
mov ebx, eax
test ebx, ebx
je 0x10019f64
test esi, esi
je 0x10019f54
mov dword [esi + 0x8c], ebx
mov edx, dword [esp + 0x18]
mov ecx, esi
push ebx
call fcn.100190a8
test eax, eax
jne 0x10019f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, eax
mov edx, 0x10000
mov ecx, esi
call fcn.1001534c
test edi, edi
je 0x1001a0a1
mov ecx, dword [esp + 0x1c]
call fcn.100371cd
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x10019fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, eax
jmp 0x10019fa9
xor eax, eax
test edi, edi
je 0x1001a0a3
mov ecx, eax
mov edx, eax
mov eax, esi
test esi, esi
je 0x10019fca
cmp dword [esi + 0x34], 0
je 0x10019fc4
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x70]
mov edx, dword [eax + 0x74]
push edx
push ecx
push dword [0x100866bc]
xor edx, edx
mov ecx, esi
push dword [0x100866b8]
call fcn.10030d34
push edx
push eax
push dword [0x100866bc]
xor edx, edx
mov ecx, esi
push dword [0x100866b8]
call fcn.10030ccc
push edx
push eax
mov ecx, esi
call fcn.1001bcc7
xor edx, edx
mov ecx, esi
push 1
inc edx
call fcn.100313f3
mov eax, dword [esp + 0x2c]
mov edx, ebx
push ecx
push eax
mov ecx, esi
call fcn.10018d35
test eax, eax
jne 0x1001a030
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov dword [esp + 0x14], eax
mov edi, ebx
jmp 0x1001a032
xor ebx, ebx
test edi, edi
je 0x1001a096
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x5c]
mov dword [esp + 0x14], ebx
call fcn.10019721
test eax, eax
je 0x1001a086
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x1001a084
mov edx, ebx
mov ecx, esi
call fcn.100281e9
test eax, eax
jne 0x1001a071
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001a086
xor ebx, ebx
test edi, edi
je 0x1001a096
mov ecx, dword [esp + 0x1c]
push 0x10
pop edx
call fcn.10030fbd
xor edx, edx
mov ecx, esi
push ebx
inc edx
call fcn.100313f3
xor eax, eax
cmp dword [esp + 0x34], 0
je 0x1001a0b6
push eax
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.10030a60
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x1001a124
test esi, esi
je 0x1001a124
test ebx, ebx
je 0x1001a131
test dword [ebp + 0xc], 0x4000000
je 0x1001a124
xor edi, edi
lea edx, [esp + 0x24]
push edi
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.10030a2b
push edi
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.10030a60
mov eax, dword [esi]
cmp eax, dword [ebx]
jne 0x1001a116
cmp eax, 0xfeedf001
je 0x1001a112
cmp eax, 0xfeedf002
je 0x1001a105
push 6
jmp 0x1001a118
mov edx, esi
mov ecx, ebx
call fcn.1001ca8d
mov edi, eax
jmp 0x1001a124
push 0x78
jmp 0x1001a118
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001a124
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x1001a131
test esi, esi
je 0x1001a131
xor eax, eax
mov dword [esi + 0x30], eax
cmp dword [esp + 0x38], 0
je 0x1001a14e
test dword [esp + 0x28], 0x20000
jne 0x1001a14e
push 3
pop edx
lea ecx, [esp + 0x40]
call fcn.10039c22
test edi, edi
jne 0x1001a160
test esi, esi
je 0x1001a160
push esi
call sym.WIMGAPI.DLL_WIMCloseHandle
mov esi, edi
jmp 0x1001a162
xor edi, edi
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x1001a180
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1001a197
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1001a1c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001a1cf
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1001a1dd
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10083b20
mov esp, ebp
pop ebp
ret 8