Function at 0x1002758
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0xd20
push 0x1001370
call fcn.01006094
mov eax, dword [0x100e008]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc54], eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0xc50], esi
mov dword [ebp - 0xc60], esi
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xc6c], esi
mov dword [ebp - 0xc68], esi
mov dword [ebp - 0xc80], esi
mov dword [ebp - 0xc7c], esi
mov dword [ebp - 0xc94], esi
lea eax, [ebp - 0xc94]
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xc90], esi
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc74], 1
mov dword [ebp - 0xcc0], 0x10012b0
mov dword [ebp - 0xcbc], esi
mov dword [ebp - 0xcb8], esi
xor eax, eax
lea edi, [ebp - 0xcb4]
stosd dword es:[edi], eax
mov dword [ebp - 0xcd0], 0x1001340
mov dword [ebp - 0xccc], esi
mov dword [ebp - 0xcc8], esi
lea edi, [ebp - 0xcc4]
stosd dword es:[edi], eax
lea eax, [ebp - 0xcd0]
mov dword [ebp - 0xcac], eax
mov dword [ebp - 0xca8], esi
mov dword [ebp - 0xca4], esi
push dword [ebx + 0x14]
push 0x28
push 3
call fcn.01004a3e
push 0x29
push 3
call fcn.01004a3e
add esp, 0x14
cmp byte [ebx + 0x32], 0
je 0x100284b
mov dword [ebp - 0xc7c], 2
cmp dword [ebx + 0x1c], esi
jne 0x1002857
or dword [ebp - 0xc7c], 1
cmp byte [ebx + 0x31], 0
jne 0x1002863
mov dword [ebp - 0xc98], esi
cmp byte [ebx + 0x36], 0
je 0x1002875
lea eax, [ebp - 0xcc0]
mov dword [ebp - 0xca8], eax
lea eax, [ebp - 0xc90]
push eax
push dword [ebp - 0xc98]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
lea eax, [ebp - 0xc80]
push eax
push dword [ebp - 0xc7c]
push dword [ebx + 0x28]
push dword [ebp - 0xc54]
lea eax, [ebp - 0xd30]
push eax
call fcn.01007951
push 0xb
pop ecx
mov esi, eax
lea edi, [ebp - 0xd04]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xd04], 0
je 0x10028db
push dword [ebp - 0xd04]
push 7
call fcn.01003f59
mov dword [ebp - 0xc50], eax
test eax, eax
jne 0x1002a59
xor esi, esi
cmp dword [ebx + 0x1c], esi
jne 0x10028fc
mov eax, dword [ebp - 0xc80]
cmp eax, esi
jne 0x10028f9
push 0x79
push 1
call fcn.01004a3e
pop ecx
pop ecx
jmp 0x10028fc
mov dword [ebx + 0x1c], eax
cmp byte [ebx + 0x32], 0
je 0x1002919
cmp dword [ebp - 0xc90], esi
jne 0x1002919
push 0x7a
push 1
call fcn.01004a3e
pop ecx
pop ecx
mov byte [ebx + 0x32], 0
cmp byte [ebx + 0x31], 0
je 0x1002936
cmp dword [ebp - 0xc94], esi
jne 0x1002936
push 0x76
push 1
call fcn.01004a3e
pop ecx
pop ecx
mov byte [ebx + 0x31], 0
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x5c]
cmp eax, esi
je 0x100294b
push eax
call fcn.0100c632
mov dword [0x100efe0], eax
mov eax, dword [ebx + 0x60]
cmp eax, esi
je 0x100295d
push eax
call fcn.0100c632
mov dword [0x100efe4], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc58]
xor esi, esi
cmp byte [ebx + 0x31], 0
jne 0x1002d03
cmp eax, esi
jne 0x100297a
mov eax, dword [ebx + 0x24]
lea ecx, [ebp - 0xcb0]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0xcac]
push ecx
push esi
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x58]
push dword [ebx + 0x1c]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_194]
add esp, 0x2c
mov edi, eax
cmp edi, esi
jne 0x10029cc
lea eax, [ebp - 0xc60]
push eax
push dword [ebp - 0xcb0]
push dword [ebp - 0xc54]
call fcn.0100c664
add esp, 0xc
mov edi, eax
cmp edi, esi
je 0x10029fd
push edi
call dword [sym.imp.WLDAP32.dll_Ordinal_118]
push eax
push 0x2e
push 7
call fcn.01004a3e
add esp, 0x10
push dword [ebp - 0xc54]
call fcn.010044ca
push edi
call fcn.01004138
mov dword [ebp - 0xc50], eax
cmp eax, esi
jne 0x1002a59
xor esi, esi
mov eax, dword [ebp - 0xc58]
cmp eax, esi
je 0x1002b4b
mov ecx, dword [eax]
cmp ecx, esi
je 0x1002a29
xor edi, edi
push ecx
call fcn.0100c41a
add edi, 4
mov eax, dword [ebp - 0xc58]
mov ecx, dword [edi + eax]
cmp ecx, esi
jne 0x1002a13
push eax
call fcn.0100c41a
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc78], 1
jmp 0x1002b51
xor edi, edi
mov eax, dword [0x100efdc]
cmp eax, edi
je 0x1002a6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc6c], edi
je 0x1002a87
push dword [ebp - 0xc6c]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_191]
pop ecx
pop ecx
cmp dword [ebp - 0xc5c], edi
je 0x1002a9b
push dword [ebp - 0xc5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc60], edi
je 0x1002ab0
push dword [ebp - 0xc60]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
pop ecx
cmp dword [ebp - 0xc80], edi
je 0x1002ac3
push dword [ebp - 0xc80]
call fcn.0100c41a
mov eax, dword [0x100efe0]
cmp eax, edi
je 0x1002ad2
push eax
call fcn.0100c41a
mov eax, dword [0x100efe4]
cmp eax, edi
je 0x1002ae1
push eax
call fcn.0100c41a
mov ecx, dword [ebp - 0xc58]
cmp ecx, edi
je 0x1002b15
mov eax, dword [ecx]
cmp eax, edi
je 0x1002b09
xor esi, esi
push eax
call fcn.0100c41a
add esi, 4
mov ecx, dword [ebp - 0xc58]
mov eax, dword [esi + ecx]
cmp eax, edi
jne 0x1002af3
push ecx
call fcn.0100c41a
mov dword [ebp - 0xc58], edi
cmp word [0x100edd0], di
je 0x1002b30
push 0x100edd0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov word [0x100edd0], di
call fcn.01007c05
mov eax, dword [ebp - 0xc50]
mov ecx, dword [ebp - 0x1c]
call fcn.01005e07
call fcn.010060cf
ret 8
mov dword [ebp - 0xc78], esi
cmp dword [ebp - 0xc74], esi
je 0x1002c87
push esi
push 0x8000080
push 2
push esi
push esi
push 0x40000000
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc5c], eax
cmp eax, 0xffffffff
jne 0x1002bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc50], eax
push 0xa
lea eax, [ebp - 0xc4c]
push eax
push dword [ebp - 0xc50]
call dword [sym.imp.msvcrt.dll__itow]
push 0x36
push 7
call fcn.01004a3e
lea eax, [ebp - 0xc4c]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp dword [ebp - 0xc50], esi
jne 0x1002a59
xor esi, esi
cmp byte [0x10121bc], 0
je 0x1002c48
mov dword [ebp - 0xca0], 0xfeff
push esi
push 0x100edc8
push 2
lea eax, [ebp - 0xca0]
push eax
push dword [ebp - 0xc5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc50], eax
push 0xa
lea eax, [ebp - 0xa44]
push eax
push dword [ebp - 0xc50]
call dword [sym.imp.msvcrt.dll__itow]
push 0x55
push 7
call fcn.01004a3e
lea eax, [ebp - 0xa44]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp dword [ebp - 0xc50], esi
jne 0x1002a59
xor esi, esi
movzx eax, byte [ebx + 0x36]
push eax
push eax
movzx eax, byte [ebx + 0x31]
push eax
push dword [ebp - 0xc5c]
push dword [ebp - 0xc54]
call fcn.01002057
push 0x2d
push 3
call fcn.01004a3e
push 0x100133c
push 0xa
call fcn.01004c0f
add esp, 0x10
call fcn.01004618
mov dword [ebp - 0xc74], esi
push dword [ebp - 0xc60]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
mov edi, eax
cmp edi, esi
jmp 0x1002cfa
and dword [ebp - 0xc70], 0
lea eax, [ebp - 0xc70]
push eax
push dword [ebp - 0xc78]
lea eax, [ebp - 0xc58]
push eax
push dword [ebp - 0xc5c]
push edi
push dword [ebp - 0xc54]
push ebx
call fcn.01002176
mov dword [ebp - 0xc50], eax
test eax, eax
jne 0x1002a59
cmp dword [ebp - 0xc70], eax
je 0x1002ce9
inc dword [ebp - 0xc68]
push edi
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_27]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1002c9f
jmp 0x10030db
cmp eax, esi
jne 0x1002d0a
mov eax, dword [ebx + 0x24]
push esi
push 0x4e20
push esi
push esi
lea ecx, [ebp - 0xcac]
push ecx
push esi
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x58]
push dword [ebx + 0x1c]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_206]
add esp, 0x2c
mov dword [ebp - 0xc6c], eax
mov dword [ebp - 0xc64], esi
mov ecx, dword [ebp - 0xc58]
cmp ecx, esi
je 0x1002d7f
mov eax, dword [ecx]
cmp eax, esi
je 0x1002d67
xor edi, edi
push eax
call fcn.0100c41a
add edi, 4
mov ecx, dword [ebp - 0xc58]
mov eax, dword [edi + ecx]
cmp eax, esi
jne 0x1002d51
push ecx
call fcn.0100c41a
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc78], 1
jmp 0x1002d85
mov dword [ebp - 0xc78], esi
cmp dword [ebp - 0xc6c], esi
jne 0x1002dca
call dword [sym.imp.WLDAP32.dll_Ordinal_16]
mov dword [ebp - 0xc64], eax
push 0x2c
push 7
call fcn.01004a3e
pop ecx
pop ecx
push dword [ebp - 0xc54]
call fcn.010044ca
push dword [ebp - 0xc64]
call fcn.01004138
mov dword [ebp - 0xc50], eax
cmp eax, esi
jne 0x1002a59
xor esi, esi
cmp dword [ebp - 0xc74], esi
je 0x1002edd
push esi
push 0x8000080
push 2
push esi
push esi
push 0x40000000
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc5c], eax
cmp eax, 0xffffffff
jne 0x1002e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc50], eax
push 0xa
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0xc50]
call dword [sym.imp.msvcrt.dll__itow]
push 0x36
push 7
call fcn.01004a3e
lea eax, [ebp - 0x42c]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp dword [ebp - 0xc50], esi
jne 0x1002a59
xor esi, esi
cmp byte [0x10121bc], 0
je 0x1002ec1
mov dword [ebp - 0xc9c], 0xfeff
push esi
push 0x100edc8
push 2
lea eax, [ebp - 0xc9c]
push eax
push dword [ebp - 0xc5c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002ec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc50], eax
push 0xa
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0xc50]
call dword [sym.imp.msvcrt.dll__itow]
push 0x55
push 7
call fcn.01004a3e
lea eax, [ebp - 0x224]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp dword [ebp - 0xc50], esi
jne 0x1002a59
xor esi, esi
movzx eax, byte [ebx + 0x36]
push eax
push eax
movzx eax, byte [ebx + 0x31]
push eax
push dword [ebp - 0xc5c]
push dword [ebp - 0xc54]
call fcn.01002057
cmp dword [ebp - 0xc64], esi
jne 0x100309a
xor esi, esi
cmp dword [ebp - 0xc6c], esi
je 0x100309a
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0xcd8]
push eax
push 0x100
push dword [0x1012268]
push dword [ebp - 0xc6c]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_135]
add esp, 0x18
mov dword [ebp - 0xc64], eax
cmp dword [ebp - 0xc74], esi
je 0x1002f58
push 0x2d
push 3
call fcn.01004a3e
push 0x100133c
push 0xa
call fcn.01004c0f
add esp, 0x10
mov dword [ebp - 0xc74], esi
mov byte [0x1011c4c], 1
cmp dword [ebp - 0xc60], esi
je 0x100307b
mov dword [ebp - 0xc88], esi
mov dword [ebp - 0xc8c], esi
mov dword [ebp - 0xc84], esi
push esi
push esi
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0xc8c]
push eax
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0xcd4]
push eax
push dword [ebp - 0xc60]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_179]
add esp, 0x20
mov dword [ebp - 0xc64], eax
mov edi, dword [ebp - 0xc84]
cmp edi, esi
je 0x1002fdf
jmp 0x1002fcc
push eax
push 0x1001334
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
add edi, 4
mov eax, dword [edi]
cmp eax, esi
jne 0x1002fbb
push dword [ebp - 0xc84]
call dword [sym.imp.WLDAP32.dll_Ordinal_224]
pop ecx
cmp dword [ebp - 0xc8c], esi
je 0x1002ff4
push dword [ebp - 0xc8c]
call dword [sym.imp.WLDAP32.dll_Ordinal_147]
pop ecx
cmp dword [ebp - 0xc88], esi
je 0x1003009
push dword [ebp - 0xc88]
call dword [sym.imp.WLDAP32.dll_Ordinal_147]
pop ecx
push dword [ebp - 0xc60]
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
jmp 0x1003073
mov dword [ebp - 0xc70], esi
lea eax, [ebp - 0xc70]
push eax
push dword [ebp - 0xc78]
lea eax, [ebp - 0xc58]
push eax
push dword [ebp - 0xc5c]
push edi
push dword [ebp - 0xc54]
push ebx
call fcn.01002176
mov dword [ebp - 0xc50], eax
cmp eax, esi
jne 0x1002a59
cmp dword [ebp - 0xc70], esi
je 0x1003066
inc dword [ebp - 0xc68]
push edi
push dword [ebp - 0xc54]
call dword [sym.imp.WLDAP32.dll_Ordinal_27]
pop ecx
mov edi, eax
pop ecx
cmp edi, esi
jne 0x100301d
push dword [ebp - 0xc60]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
pop ecx
mov dword [ebp - 0xc60], esi
cmp dword [ebp - 0xc64], esi
je 0x1002eeb
cmp dword [ebp - 0xc64], 0
je 0x10030db
cmp dword [ebp - 0xc64], 0x5e
je 0x10030db
push 0x2c
push 7
call fcn.01004a3e
pop ecx
pop ecx
push dword [ebp - 0xc54]
call fcn.010044ca
push dword [ebp - 0xc64]
call fcn.01004138
mov dword [ebp - 0xc50], eax
test eax, eax
jne 0x1002a59
cmp dword [ebp - 0xc58], 0
jne 0x1002961
mov eax, dword [0x100efdc]
xor edi, edi
cmp eax, edi
je 0x10031bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
push 0x100edd0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100efdc], eax
cmp eax, 0xffffffff
jne 0x100316b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc50], eax
push 0xa
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0xc50]
call dword [sym.imp.msvcrt.dll__itow]
push 0x2b
push 7
call fcn.01004a3e
lea eax, [ebp - 0x634]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp dword [ebp - 0xc50], edi
jne 0x1002a5b
push dword [ebp - 0xc5c]
push dword [0x100efdc]
call fcn.01003ecb
mov esi, eax
mov dword [ebp - 0xc50], esi
cmp esi, edi
je 0x10031bc
push 0xa
lea eax, [ebp - 0x83c]
push eax
push esi
call dword [sym.imp.msvcrt.dll__itow]
push 0x32
push 7
call fcn.01004a3e
lea eax, [ebp - 0x83c]
push eax
push 0x73
push 7
call fcn.01004a3e
add esp, 0x20
cmp esi, edi
jne 0x1002a5b
cmp dword [ebp - 0xc68], edi
jne 0x10031d4
push 0x46
push 7
call fcn.01004a3e
pop ecx
pop ecx
jmp 0x1002a5b
push dword [ebp - 0xc68]
push 0x31
push 3
call fcn.01004a3e
add esp, 0xc
jmp 0x1002a5b