Function at 0x1002c240
Capabilities:
Delete file
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c04]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1002c262
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
mov ecx, dword [esi + 0x45d6]
cmp ecx, 0xffffffff
jne 0x1002c290
cmp word [esi + 0x45de], bp
je 0x1002c290
mov edx, dword [esi + 0x45e2]
mov eax, dword [esi + 0x45e6]
mov dword [esi + 0x4550], edx
mov dword [esi + 0x4554], eax
jmp 0x1002c29c
mov dword [esi + 0x4550], ecx
mov dword [esi + 0x4554], ebp
mov eax, dword [esi + 0x45d2]
cmp eax, 0xffffffff
jne 0x1002c2e8
cmp word [esi + 0x45de], bp
je 0x1002c2e8
cmp ecx, eax
je 0x1002c2ce
mov ecx, dword [esi + 0x45e2]
mov edx, dword [esi + 0x45e6]
mov dword [esi + 0x4548], ecx
mov dword [esi + 0x454c], edx
jmp 0x1002c2f4
mov eax, dword [esi + 0x45ea]
mov ecx, dword [esi + 0x45ee]
mov dword [esi + 0x4548], eax
mov dword [esi + 0x454c], ecx
jmp 0x1002c2f4
mov dword [esi + 0x4548], eax
mov dword [esi + 0x454c], ebp
cmp dword [esi + 0x4c], ebp
jne 0x1002c3ff
mov al, byte [esi + 0x45c6]
mov bl, 8
test bl, al
je 0x1002c3b7
mov ecx, dword [esi + 0x4e8c]
mov edx, dword [esi + 0x4e84]
cmp ecx, 0xffffffff
mov dword [esi + 0x45ce], edx
jne 0x1002c347
cmp word [esi + 0x45de], bp
je 0x1002c347
mov eax, dword [esi + 0x4ea6]
mov edx, dword [esi + 0x4eaa]
mov dword [esi + 0x4550], eax
mov dword [esi + 0x4554], edx
jmp 0x1002c359
mov dword [esi + 0x4550], ecx
mov dword [esi + 0x45d6], ecx
mov dword [esi + 0x4554], ebp
mov eax, dword [esi + 0x4e88]
cmp eax, 0xffffffff
jne 0x1002c3a5
cmp word [esi + 0x45de], bp
je 0x1002c3a5
cmp ecx, eax
je 0x1002c38b
mov eax, dword [esi + 0x4ea6]
mov ecx, dword [esi + 0x4eaa]
mov dword [esi + 0x4548], eax
mov dword [esi + 0x454c], ecx
jmp 0x1002c3b7
mov edx, dword [esi + 0x4eae]
mov eax, dword [esi + 0x4eb2]
mov dword [esi + 0x4548], edx
mov dword [esi + 0x454c], eax
jmp 0x1002c3b7
mov dword [esi + 0x4548], eax
mov dword [esi + 0x45d2], eax
mov dword [esi + 0x454c], ebp
push esi
call fcn.10031f30
xor ecx, ecx
xor edi, edi
mov cx, word [esi + 0x45dc]
mov di, word [esi + 0x45da]
push ebp
lea ecx, [ecx + edi + 0x1e]
xor edi, edi
add ecx, eax
adc edi, edx
mov edx, dword [esi + 0x14f60]
push edi
push ecx
push edx
call fcn.100348d0
mov al, byte [esi + 0x4e9a]
add esp, 0x14
test bl, al
je 0x1002c3ff
pop edi
pop esi
pop ebp
mov eax, 0x2e
pop ebx
ret
mov eax, dword [esi + 0x4ee0]
mov dword [esi + 0x14f50], ebp
cmp eax, ebp
je 0x1002c418
call fcn.1002c1c0
cmp eax, ebp
jne 0x1002c483
mov eax, dword [esi + 0x3d28]
mov ebx, dword [esp + 0x14]
cmp eax, ebp
jne 0x1002c488
cmp dword [esi + 0x44], ebp
jne 0x1002c488
cmp dword [esi + 0x4c], ebp
jne 0x1002c488
push ebx
call fcn.10033730
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x1002c44e
call fcn.10034990
mov edi, eax
cmp edi, ebp
jne 0x1002c44e
cmp dword [esi], ebp
je 0x1002c481
mov eax, dword [esi + 0x167c0]
cmp eax, 0xffffffff
je 0x1002c460
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x3d28], ebp
jne 0x1002c481
cmp dword [esi + 0x44], ebp
jne 0x1002c481
cmp dword [esi + 0x4c], ebp
jne 0x1002c481
cmp dword [esi + 0x3d2c], ebp
jne 0x1002c481
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x167c0], 0xffffffff
jmp 0x1002c43f