Function at 0x10002bc9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
add ecx, 0xfffffefe
xor eax, eax
or edi, 0xffffffff
xor edx, edx
mov dword [ebp - 4], ebx
cmp ecx, 0x2c
ja case.0x10002bf2.275
jmp dword [ecx*4 + 0x100030fd]
push dword [ebp + 0x14]
push esi
call fcn.1000249a
jmp 0x10003070
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push 0x8c
lea eax, [ebp - 0xa0]
push ebx
push eax
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0xa8]
call fcn.100073bb
mov edi, eax
cmp edi, ebx
jne 0x100030d9
lea eax, [ebp - 0xa8]
push eax
push 0x10
push dword [ebp + 8]
mov esi, 0x94
call fcn.1000bb8f
test eax, eax
je 0x10002c74
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000bbe8
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100030d9
push dword [ebp + 0x10]
push esi
call fcn.10002a24
jmp 0x1000307a
push ebx
jmp 0x10002c98
push 1
push dword [ebp + 0x10]
push esi
call fcn.1000164c
jmp 0x1000307a
push 0x1002d140
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jg 0x10002ccd
push ebx
push ebx
push 0x117
push esi
call fcn.1000209e
mov edi, eax
cmp edi, ebx
je 0x100030d9
push 0x1002d140
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x100030d9
mov dword [ebp - 4], 1
push dword [ebp - 4]
mov eax, esi
push dword [ebp + 0x10]
call fcn.100019f9
jmp 0x1000307a
call fcn.1000154c
jmp 0x1000307a
call fcn.10001585
jmp 0x1000307a
push dword [ebp + 0x14]
push ebx
push 0x100011b3
jmp 0x1000306b
push dword [ebp + 0x14]
push ebx
push 0x10001df9
jmp 0x1000306b
push dword [ebp + 0x14]
push ebx
push fcn.10001e12
jmp 0x1000306b
push dword [ebp + 0x14]
push ebx
push fcn.100050c3
jmp 0x1000306b
push dword [ebp + 0x14]
push ebx
push 0x10001f15
jmp 0x1000306b
mov eax, dword [0x1002d2c8]
cmp eax, ebx
jne 0x10002d6b
call fcn.100041fe
mov dword [0x1002d2c8], eax
cmp eax, ebx
je case.0x10002bf2.275
cmp dword [ebp + 8], ebx
je 0x100030f3
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [0x1002d2c8]
mov esi, eax
push 0x10
push dword [ebp + 8]
inc esi
call fcn.1000bb8f
test eax, eax
je 0x100030f3
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000bbe8
jmp 0x100030f3
push dword [ebp + 0x10]
push esi
call fcn.1000b979
jmp case.0x10002bf2.275
lea eax, [ebp + 0xc]
push eax
call fcn.1000ba2e
cmp eax, ebx
je 0x10002df9
cmp dword [ebp + 8], ebx
je 0x10002de4
push dword [ebp + 0xc]
mov esi, eax
push 0x10
push dword [ebp + 8]
call fcn.1000bb8f
test eax, eax
je 0x10002de4
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000bbe8
push dword [ebp + 0xc]
push ebx
push dword [0x1002d128]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x10002bf2.275
push 0x12
pop edi
jmp 0x100030ea
cmp dword [0x1002d130], ebx
jne case.0x10002bf2.275
cmp dword [ebp + 0x10], 0x10
jne 0x10002e1e
push esi
call fcn.10001e7d
jmp 0x1000307a
push 0x57
pop edi
jmp 0x100030d9
call fcn.10001ef3
jmp 0x1000307a
xor eax, eax
inc eax
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 8]
push eax
call fcn.10002604
jmp 0x10003070
cmp esi, ebx
jne 0x10002e58
push ebx
push ebx
push ebx
push 0x1002e1c1
call fcn.10003d65
mov dword [0x1002d330], ebx
mov dword [0x1002d37c], ebx
push ebx
mov dword [0x1002d348], ebx
call fcn.10002604
mov edi, esi
call fcn.10018b83
push 4
xor eax, eax
pop edx
inc eax
mov dword [0x1002d330], eax
mov dword [0x1002d37c], eax
mov dword [0x1002d348], eax
mov eax, dword [0x1002c4f0]
and eax, 0xfffb
or eax, edx
push eax
mov eax, dword [0x1002c4ec]
push ebx
call fcn.1000403a
mov edi, eax
cmp esi, ebx
je 0x1000307c
mov eax, dword [ebp + 0x10]
push ebx
push dword [0x1002d240]
mov edx, esi
call fcn.10014147
push 3
push dword [ebp + 0x10]
push esi
push 0x1002e1c1
call fcn.10003d65
jmp 0x1000307c
push dword [ebp + 0x14]
push 1
push 0x1000229b
jmp 0x1000306b
push dword [ebp + 0x14]
push ebx
push 0x10001790
jmp 0x1000306b
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x14], ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], 4
jne case.0x10002bf2.275
push dword [esi]
push dword [ebp + 0x14]
call fcn.1000146b
jmp case.0x10002bf2.275
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [0x1002d174]
call fcn.10010070
mov edi, eax
cmp edi, ebx
jne 0x100030d9
push dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 0x10
push dword [ebp + 8]
call fcn.1000bb8f
test eax, eax
je 0x10002f57
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000bbe8
push dword [ebp + 0xc]
push ebx
push dword [0x1002d128]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100030d9
push dword [0x1002d174]
xor edi, edi
call fcn.1000ff71
mov esi, eax
cmp esi, ebx
je 0x100030d9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002f96
push esi
call fcn.1001239c
mov edi, eax
push esi
call fcn.100012ff
jmp 0x100030d9
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push 1
jmp 0x10002ff3
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push 7
jmp 0x10002ff3
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push 3
jmp 0x10002ff3
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push 0xd
push dword [ebp + 0x10]
push esi
call fcn.100025c1
jmp 0x10003070
push dword [ebp + 0x14]
push ebx
push 0x1000250f
jmp 0x1000306b
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], ebx
je case.0x10002bf2.275
push ebx
push dword [ebp + 0x10]
mov edi, esi
call fcn.100158c6
test eax, eax
je 0x1000303b
push 3
push dword [ebp + 0x10]
push esi
push 0x1002e1bd
call fcn.10003d65
jmp 0x10003040
mov eax, 0xbf
mov edi, eax
cmp eax, ebx
jmp 0x1000307e
mov eax, dword [0x1002d13c]
test eax, eax
jne case.0x10002bf2.275
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], 4
jne case.0x10002bf2.275
push dword [ebp + 0x14]
push dword [esi]
push 0x10001f58
call fcn.100023f9
mov edi, eax
jmp 0x100030d9
push esi
call fcn.10002725
mov edi, eax
cmp edi, ebx
jne 0x100030d9
push ebx
push dword [ebp + 0x14]
call fcn.1000146b
jmp 0x100030d9
xor eax, eax
inc eax
cmp esi, ebx
je case.0x10002bf2.275
cmp dword [ebp + 0x10], 1
jbe case.0x10002bf2.275
mov ecx, dword [ebp + 0x10]
mov byte [esi + ecx - 1], bl
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.1000285b
mov edi, eax
cmp edi, ebx
jne 0x100030d9
lea eax, [ebp - 0x10]
push eax
push 0x10
push dword [ebp + 8]
push 8
pop esi
call fcn.1000bb8f
test eax, eax
je 0x100030d9
push ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.1000bbe8
cmp edi, 0xffffffff
jne 0x100030e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
je 0x100030f3
push edi
push dword [ebp + 0x14]
call fcn.1000146b
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10