Function at 0x10030c80
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10165e34
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x1c], eax
add eax, 0xc
push eax
lea ecx, [esp + 0x1c]
call fcn.10017430
xor ebx, ebx
push ebx
mov edi, 0x10414568
lea eax, [esp + 0x18]
mov dword [esp + 0x104], ebx
call fcn.100164f0
mov byte [esp + 0x100], 1
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 4]
movzx eax, word [eax + ecx*2 - 2]
cmp eax, 0x5c
je 0x10030d0a
cmp eax, 0x2f
je 0x10030d0a
lea eax, [esp + 0x18]
push eax
mov eax, 0x10197e18
call fcn.10016730
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
mov eax, esi
call fcn.10016730
mov byte [esp + 0x100], 0
cmp esi, ebx
je 0x10030d3f
lea edx, [esi - 0xc]
test edx, edx
je 0x10030d3f
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x10030d3f
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov edi, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x24]
call fcn.100164f0
mov dword [esp + 0x24], 0xffffffff
mov byte [esp + 0x2c], 0
push ebx
push ebx
push 3
push ebx
push 1
mov byte [esp + 0x114], 2
mov esi, dword [esp + 0x34]
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10030de8
call fcn.10023ad0
cmp eax, ebx
jle 0x10030d91
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp esi, ebx
je 0x10030db0
lea eax, [esi - 0xc]
test eax, eax
je 0x10030db0
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x10030db0
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10030dd0
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10030dd0
add eax, 0xfffffff4
dec dword [eax]
jne 0x10030dd0
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x4c]
push edx
lea esi, [esp + 0x24]
mov dword [esp + 0x28], eax
mov byte [esp + 0x30], 0
mov dword [esp + 0x2c], ebx
call fcn.10023400
mov edi, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov esi, edi
test edi, edi
jle 0x10030e50
mov eax, edi
and eax, 0x800003ff
jns 0x10030e2b
dec eax
or eax, 0xfffffc00
inc eax
test eax, eax
jle 0x10030e37
sub esi, eax
add esi, 0x400
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov byte [esp + 0x38], 1
mov ebx, eax
mov byte [esp + 0x100], 3
mov esi, dword [esp + 0x24]
mov dword [esp + 0x44], 0
cmp esi, 0xffffffff
jne 0x10030ec8
mov dword [esp + 0x28], 6
mov esi, 0x80070006
cmp byte [esp + 0x38], 0
je 0x10030e87
push ebx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10030eb0
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10030eb0
add eax, 0xfffffff4
dec dword [eax]
jne 0x10030eb0
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x48]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10030ee7
mov esi, 0xfffffffe
mov dword [esp + 0x28], esi
jmp 0x10030e76
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x2c], 0
mov dword [esp + 0x24], 0xffffffff
je 0x10030f10
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
cmp dword [esp + 0x44], edi
jne 0x10030f1e
cmp ecx, dword [esp + 0x50]
je 0x10030f72
cmp byte [esp + 0x38], cl
je 0x10030f2e
push ebx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10030f57
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10030f57
add eax, 0xfffffff4
dec dword [eax]
jne 0x10030f57
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push str._gdb
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
mov dword [esp + 0x48], esi
mov edi, dword [esp + 0x1c]
mov byte [esp + 0x100], 4
add edi, 0x1e0
cmp byte [edi + 0x31], 0
mov dword [esp + 0x40], edi
mov dword [esp + 0x10], 0
je 0x10031037
lea edx, [esp + 0x10]
push edx
push edi
mov ecx, esi
call fcn.10024840
test eax, eax
jne 0x10031013
push 0x74
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x100], 5
test eax, eax
je 0x10030ff4
movzx edx, byte [edi + 0x30]
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi + 0xc]
push edx
mov edx, dword [edi + 8]
push edx
push ecx
push esi
push edi
push eax
call fcn.1002e8b0
jmp 0x10030ff6
xor eax, eax
mov ebx, eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x104], 4
push edi
mov ecx, esi
mov dword [esp + 0x18], ebx
call fcn.10024780
jmp 0x10031017
mov ebx, dword [esp + 0x10]
push ebx
lea ecx, [ebx + 0x10]
push ecx
call fcn.1002e630
test eax, eax
jns 0x10031031
push eax
push 4
mov ecx, ebx
call fcn.1002f630
jmp 0x10031033
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
mov byte [esp + 0x100], 3
setl bl
test esi, esi
je 0x10031052
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test bl, bl
je 0x100310ae
cmp byte [esp + 0x38], 0
je 0x1003106b
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10031094
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10031094
add eax, 0xfffffff4
dec dword [eax]
jne 0x10031094
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
cmp eax, 5
jle 0x10031150
mov edx, str._gdb
lea esi, [esp + 0x10]
call fcn.10017360
mov byte [esp + 0x100], 6
cmp byte [edi + 0x31], 0
mov eax, dword [eax]
je 0x100310ff
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, eax
mov dword [esp + 0x1c], 0
call fcn.10024840
test eax, eax
je 0x100310ff
mov esi, dword [esp + 0x14]
push 1
call fcn.1002ebd0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1003110e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x38], 0
je 0x10031123
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
mov eax, 0x80004005
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x1c]
mov dword [edx + 0x28], eax
cmp eax, 4
jge 0x1003119e
cmp byte [esp + 0x38], 0
je 0x10031171
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
mov eax, 0x8004021b
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x50], 0
jl 0x100311c0
jg 0x100311ae
cmp dword [esp + 0x4c], 8
jb 0x100311c0
mov eax, dword [ecx + 4]
cmp eax, dword [0x10448c48]
jne 0x100311c0
mov byte [edx + 0x228], 1
mov ecx, edx
lea eax, [ecx + 0xc]
push eax
add ecx, 0x44
call fcn.10035190
mov esi, eax
test esi, esi
jns 0x10031213
cmp byte [esp + 0x38], 0
je 0x100311e9
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
mov eax, esi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
mov dword [esp + 0x48], ebx
jne 0x10031301
push 0
push 0
push 0
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.100163a0
mov byte [esp + 0x100], 7
cmp dword [edi + 0x28], 1
push 1
mov edx, esi
push 0x61
jle 0x1003125a
push str._c_08x.gdbtable
jmp 0x1003125f
push str._c_07x.gdbtable
call fcn.10016c90
add esp, 0xc
push 0
mov edi, str.GDB_SystemCatalog
lea eax, [esp + 0x18]
call fcn.100164f0
mov eax, dword [esp + 0x1c]
push ebx
push 0
push eax
lea ecx, [esp + 0x1c]
lea edi, [esp + 0x20]
mov byte [esp + 0x10c], 8
call fcn.10049d90
mov esi, eax
add esp, 0xc
mov eax, edi
mov byte [esp + 0x100], 7
call fcn.100164d0
lea eax, [esp + 0x10]
test esi, esi
jns 0x100312f4
call fcn.100164d0
cmp byte [esp + 0x38], 0
je 0x100312ca
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
mov eax, esi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esp + 0x100], 3
call fcn.100164d0
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
xor esi, esi
push esi
call eax
mov edi, eax
cmp edi, esi
jge 0x100313ab
mov edx, str._gdb
lea esi, [esp + 0x10]
call fcn.10017360
mov byte [esp + 0x100], 9
mov ecx, dword [esp + 0x40]
cmp byte [ecx + 0x31], 0
mov eax, dword [eax]
je 0x1003135d
lea edx, [esp + 0x14]
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x1c], 0
call fcn.10024840
test eax, eax
je 0x1003135d
mov esi, dword [esp + 0x14]
push 1
call fcn.1002ebd0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1003136c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 0x38], 0
je 0x10031381
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
mov eax, edi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, esi
je 0x100313c8
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], 1
mov esi, eax
mov ecx, dword [ebx]
mov dword [esi], ecx
mov dword [esi + 8], 1
mov edi, dword [0x1044ebf8]
push 0
lea eax, [esp + 0x18]
call fcn.100164f0
lea eax, [esp + 0x14]
mov byte [esp + 0x100], 0xa
call fcn.10016cb0
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edx
lea eax, [esi + 0x2c]
push eax
call fcn.10036580
cmp dword [esi + 0x14], 0
jne 0x1003147d
mov dword [esp + 0x10], 0
lea esi, [esp + 0x10]
mov byte [esp + 0x100], 0xb
call fcn.10009f80
mov ecx, dword [ebx]
push ecx
mov ecx, eax
call fcn.1004ae40
push 0xc
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x40], eax
mov byte [esp + 0x100], 0xc
test eax, eax
je 0x1003145f
mov ebx, dword [esp + 0x10]
push 0
mov esi, eax
call fcn.10034a00
mov ebx, dword [esp + 0x48]
jmp 0x10031461
xor eax, eax
mov edx, dword [esp + 0x1c]
lea esi, [esp + 0x10]
mov dword [edx + 0x14], eax
mov byte [esp + 0x100], 0xa
call fcn.1000a090
mov esi, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x58]
push eax
call fcn.10012150
mov byte [esp + 0x100], 0xd
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 4]
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x94]
push eax
lea eax, [esp + 0x58]
push eax
call edx
mov eax, dword [esi + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [eax + 8]
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x9c]
push edi
push eax
lea eax, [esp + 0x5c]
push eax
call edx
test eax, eax
jne 0x10031538
lea esp, [esp]
mov eax, dword [0x1044ed14]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + 8]
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
push eax
mov eax, dword [edx + 0x20]
push eax
call edi
add esp, 8
test eax, eax
je 0x1003152b
mov ecx, dword [0x1044ec4c]
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 8]
push ecx
mov ecx, dword [eax + 0x20]
push ecx
call edi
add esp, 8
test eax, eax
je 0x1003152f
mov eax, dword [esi + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [eax + 8]
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x9c]
push edi
push eax
lea eax, [esp + 0x5c]
push eax
call edx
test eax, eax
je 0x100314d0
jmp 0x10031538
push 1
jmp 0x10031531
push 0
mov eax, esi
call fcn.100315a0
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x104], 0xa
call fcn.10011f10
lea eax, [esp + 0x14]
call fcn.100164d0
cmp byte [esp + 0x38], 0
je 0x10031571
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea eax, [esp + 0x20]
call fcn.10023300
lea eax, [esp + 0x18]
call fcn.100164d0
xor eax, eax
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret