Function at 0x10088ad0
Capabilities:
Delete file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101631e0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
xor ebx, ebx
cmp dword [esp + 0x24], ebx
jne 0x10088b26
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10088f79
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
cmp eax, 3
jge 0x10088b39
cmp byte [ebp + 0xc], bl
je 0x10088f79
mov edi, dword [esi + 8]
push ebx
lea eax, [esp + 0x50]
call fcn.100164f0
mov dword [esp + 0x50], 0xffffffff
mov byte [esp + 0x58], bl
push ebx
push ebx
push 2
push ebx
push ebx
mov dword [esp + 0x8c], ebx
mov edx, dword [esp + 0x60]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10088bad
call fcn.10023ad0
mov dword [esp + 0x54], eax
cmp eax, ebx
jle 0x10088b8b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea eax, [esp + 0x4c]
call fcn.10023300
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
push 0x800
mov dword [esp + 0x54], eax
mov byte [esp + 0x5c], 0
mov dword [esp + 0x58], ebx
mov dword [esp + 0x6c], edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 0x800
mov byte [esp + 0x64], 1
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x24]
push 4
lea ecx, [esp + 0x4c]
mov edx, ebx
lea esi, [esp + 0x50]
mov dword [ebx], eax
call fcn.10023600
movzx eax, al
cmp eax, edi
jge 0x10088c42
mov eax, dword [esp + 0x54]
cmp eax, edi
jle 0x10088c16
and eax, 0xffff
or eax, 0x80070000
push ebx
mov esi, eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x4c]
call fcn.10023300
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
cmp dword [esp + 0x24], edi
jle 0x10088f30
xor esi, esi
mov dword [esp + 0x20], esi
mov ebx, dword [ebp + 8]
mov byte [esp + 0x78], 2
mov eax, dword [ebx + 0x70]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x60]
push edx
lea edi, [esp + 0x28]
call fcn.1008a540
mov edi, eax
add esp, 8
cmp edi, esi
jl 0x10088f90
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebx + 0x9c]
mov edx, dword [esp + 0x28]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x20]
mov dword [ebx + edi], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov cx, word [esp + 0x10]
mov word [ebx + edi + 4], cx
mov byte [esp + 0x78], 3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push ecx
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [esp + 0x2c]
mov dword [ebx + edi + 6], ecx
add edi, 0xa
xor eax, eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], eax
mov byte [esp + 0x78], 4
cmp dword [esp + 0x2c], esi
jle 0x10088dc6
xor ebx, ebx
mov edi, dword [esp + 0x1c]
cmp eax, ebx
je 0x10088d56
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebx
mov ecx, dword [edi]
mov eax, dword [ecx + 0x10]
push esi
push edi
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [esp + 0x38]
push ecx
lea edx, [esp + 0x60]
push edx
lea edi, [esp + 0x28]
call fcn.1008a540
mov edi, eax
add esp, 8
cmp edi, ebx
jl 0x10088fde
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, ebx
je 0x10088daf
cmp dword [esp + 0x3c], 6
je 0x10088db3
inc dword [esp + 0x28]
mov eax, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x2c]
jl 0x10088d46
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x20]
cmp dword [esp + 0x3c], 5
jne 0x10088e8a
mov ecx, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x3c], esi
test ecx, ecx
je 0x10088e05
push ecx
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], esp
test eax, eax
je 0x10088df8
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea esi, [esp + 0x40]
call fcn.1008afd0
mov esi, dword [esp + 0x3c]
mov byte [esp + 0x78], 5
test esi, esi
je 0x10088e2a
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x40]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x44]
push ecx
push esi
call edx
jmp 0x10088e32
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x40]
mov dword [ebx + edi], eax
mov ecx, dword [esp + 0x44]
add edi, 4
push ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x24], edi
push edx
lea edi, [esp + 0x28]
call fcn.1008a540
mov edi, eax
xor ebx, ebx
add esp, 8
cmp edi, ebx
jl 0x10089092
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x78], 4
cmp esi, ebx
je 0x10088e7e
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x50]
xor esi, esi
mov dword [esp + 0x48], esi
cmp ecx, 0xffffffff
jne 0x10088ea0
lea edi, [esi + 6]
xor cl, cl
jmp 0x10088ec4
push esi
lea eax, [esp + 0x4c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x10088ec0
mov edi, 0xfffffffd
xor cl, cl
jmp 0x10088ec4
xor edi, edi
mov cl, 1
movzx ecx, cl
mov dword [esp + 0x54], edi
cmp ecx, esi
jl 0x100890f7
mov byte [esp + 0x78], 3
cmp eax, esi
je 0x10088ee8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], esi
mov byte [esp + 0x78], 2
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x10088f01
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x10088f16
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
cmp eax, dword [esp + 0x24]
jl 0x10088c54
cmp byte [esp + 0x64], 0
je 0x10088f3a
push ebx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
je 0x10088f4a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x58], 0
mov esi, dword [esp + 0x4c]
je 0x10088f5c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x10088f79
lea ecx, [esi - 0xc]
test ecx, ecx
je 0x10088f79
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x10088f79
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x10088fa9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
cmp byte [esp + 0x64], 0
je 0x10088fbe
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x4c]
call fcn.10023300
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esp + 0x78], 3
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10088ff7
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x78], 2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10089010
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10089029
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], ebx
cmp byte [esp + 0x64], bl
je 0x1008903d
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
je 0x1008904d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
cmp byte [esp + 0x58], bl
je 0x1008905e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, ebx
je 0x1008907b
lea ecx, [esi - 0xc]
test ecx, ecx
je 0x1008907b
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x1008907b
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esp + 0x78], 4
cmp esi, ebx
je 0x100890a3
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov byte [esp + 0x78], 3
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100890bc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x78], 2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x100890d5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100890ee
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], ebx
cmp byte [esp + 0x64], bl
jmp 0x10088fae
cmp edi, esi
jle 0x10089107
and edi, 0xffff
or edi, 0x80070000
mov byte [esp + 0x78], 3
cmp eax, esi
je 0x1008911c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], esi
mov byte [esp + 0x78], 2
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x10089135
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x1008914e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
cmp byte [esp + 0x64], 0
je 0x1008915f
push ebx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
je 0x1008916f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x58], 0
mov ebx, dword [esp + 0x4c]
je 0x10089181
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, esi
je 0x10088fc7
lea eax, [ebx - 0xc]
test eax, eax
je 0x10088fc7
dec dword [ebx - 0xc]
lea eax, [ebx - 0xc]
jne 0x10088fc7
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
jmp 0x10088fc7