Function at 0x10020f90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005769f
mov eax, dword fs:[0]
push eax
sub esp, 0x5e0
mov eax, dword [0x10076008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5b4], ecx
mov dword [ebp - 0x5bc], 0
push 0x400
push 0
lea eax, [ebp - 0x410]
push eax
call fcn.10033d10
add esp, 0xc
mov byte [ebp - 0x5af], 0
mov byte [ebp - 0x5ad], 0
mov byte [ebp - 0x5ae], 0
lea ecx, [ebp - 0x428]
call fcn.10005ad0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x488]
call fcn.10005ad0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a0]
call fcn.10005ad0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5a8]
call fcn.10005ad0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.10005620
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x440]
call fcn.10005620
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4b8]
call fcn.10005ad0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x590]
call fcn.10005ad0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x578]
call fcn.10005ad0
mov byte [ebp - 4], 8
push str.Windows_Imagesinstall.wim
lea ecx, [ebp - 0x470]
call fcn.10005a60
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x5b4]
mov edx, dword [ecx]
movsx eax, byte [edx + 0x69de]
push eax
push str._c:_bcdcmd.bat
lea ecx, [ebp - 0x560]
push ecx
call fcn.1002eaa0
add esp, 0xc
mov dword [ebp - 0x5dc], eax
mov edx, dword [ebp - 0x5dc]
push edx
lea ecx, [ebp - 0x458]
call fcn.100054a0
lea ecx, [ebp - 0x560]
call fcn.10005450
mov eax, dword [ebp - 0x5b4]
mov ecx, dword [eax]
movsx edx, byte [ecx + 0x69de]
push edx
push str._c:wimboot.txt
lea eax, [ebp - 0x548]
push eax
call fcn.1002eaa0
add esp, 0xc
mov dword [ebp - 0x5d8], eax
mov ecx, dword [ebp - 0x5d8]
push ecx
lea ecx, [ebp - 0x440]
call fcn.100054a0
lea ecx, [ebp - 0x548]
call fcn.10005450
push 0x1006e060
lea ecx, [ebp - 0x458]
call fcn.10005370
push eax
lea edx, [ebp - 0x5ac]
push edx
call fcn.10040ef1
add esp, 0xc
test eax, eax
jne 0x10021210
lea ecx, [ebp - 0x440]
call fcn.10005370
mov edx, eax
lea ecx, [ebp - 0x518]
call fcn.1002eca0
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5d0], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5d0]
call fcn.100057f0
push eax
mov ecx, dword [ebp - 0x5b4]
mov edx, dword [ecx]
movsx eax, byte [edx + 0x69de]
push eax
push str.dism__Get_WIMBootEntry__Path:_c:_____s_
lea ecx, [ebp - 0x530]
push ecx
call fcn.1002e950
add esp, 0x10
mov dword [ebp - 0x5cc], eax
mov edx, dword [ebp - 0x5cc]
push edx
lea ecx, [ebp - 0x4b8]
call fcn.10005950
lea ecx, [ebp - 0x530]
call fcn.10005900
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x518]
call fcn.10005900
lea ecx, [ebp - 0x4b8]
call fcn.100057f0
push eax
mov eax, dword [ebp - 0x5ac]
push eax
call fcn.10009240
add esp, 8
mov ecx, dword [ebp - 0x5ac]
push ecx
call fcn.10041000
add esp, 4
mov dword [ebp - 0x5ac], 0
jmp 0x10021229
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERR__GetWimBootEntry__Open_Batch_File_Error____GetLastError__d
call fcn.100098e0
add esp, 8
jmp 0x1002148f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5e8], esp
push 0x1006e0d4
call fcn.100055b0
mov dword [ebp - 0x5e4], eax
mov byte [ebp - 4], 0xb
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5ec], esp
lea edx, [ebp - 0x458]
push edx
call fcn.10005670
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x5b4]
call fcn.10016d00
push 0x1006e0d8
lea ecx, [ebp - 0x440]
call fcn.10005370
push eax
lea eax, [ebp - 0x5ac]
push eax
call fcn.10040ef1
add esp, 0xc
test eax, eax
je 0x100212ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERR__GetWimBootEntry__Open_Text_File_Error____GetLastError__d
call fcn.100098e0
add esp, 8
jmp 0x1002148f
push str.custom.wim
lea ecx, [ebp - 0x488]
call fcn.10005870
push str..wim
lea ecx, [ebp - 0x4a0]
call fcn.10005870
mov ecx, dword [ebp - 0x5b4]
mov byte [ecx + 0x26c], 0
mov edx, 1
test edx, edx
je 0x10021476
push 0x400
push 0
lea eax, [ebp - 0x410]
push eax
call fcn.10033d10
add esp, 0xc
mov ecx, dword [ebp - 0x5ac]
push ecx
push 0x400
lea edx, [ebp - 0x410]
push edx
call fcn.10041c75
add esp, 0xc
test eax, eax
jne 0x1002131f
jmp 0x10021476
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.10005870
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x500]
push edx
call fcn.10006a10
add esp, 8
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
push eax
lea ecx, [ebp - 0x428]
call fcn.10005950
lea ecx, [ebp - 0x500]
call fcn.10005900
push 0
lea ecx, [ebp - 0x488]
push ecx
lea ecx, [ebp - 0x428]
call fcn.100226f0
cmp eax, 0xffffffff
je 0x10021395
mov edx, dword [ebp - 0x5b4]
mov byte [edx + 0x26c], 1
jmp 0x10021471
push 0
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x428]
call fcn.100226f0
cmp eax, 0xffffffff
je 0x10021471
push 0
push 0x1006e134
lea ecx, [ebp - 0x428]
call fcn.10005770
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0
jne 0x100213eb
push 0
push 0x1006e138
lea ecx, [ebp - 0x428]
call fcn.10005770
mov dword [ebp - 0x5b8], eax
lea ecx, [ebp - 0x428]
call fcn.10005e70
push eax
mov ecx, dword [ebp - 0x5b8]
add ecx, 2
push ecx
lea edx, [ebp - 0x4d0]
push edx
lea ecx, [ebp - 0x428]
call fcn.100226a0
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c0]
push ecx
lea edx, [ebp - 0x4e8]
push edx
call fcn.10006d30
add esp, 8
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e0]
push eax
lea ecx, [ebp - 0x470]
call fcn.10005950
lea ecx, [ebp - 0x4e8]
call fcn.10005900
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4d0]
call fcn.10005900
jmp 0x100212d8
mov ecx, dword [ebp - 0x5ac]
push ecx
call fcn.10041000
add esp, 4
mov dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0
je 0x100214a7
mov edx, dword [ebp - 0x5ac]
push edx
call fcn.10041000
add esp, 4
movzx eax, byte [ebp - 0x5af]
test eax, eax
je 0x100214c4
movzx ecx, byte [ebp - 0x5ad]
test ecx, ecx
je 0x100214c4
mov byte [ebp - 0x5ae], 1
lea ecx, [ebp - 0x458]
call fcn.10005370
mov ecx, eax
call fcn.1002e480
movzx edx, al
test edx, edx
je 0x100214ef
lea ecx, [ebp - 0x458]
call fcn.10005370
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x440]
call fcn.10005370
mov ecx, eax
call fcn.1002e480
movzx eax, al
test eax, eax
je 0x1002151a
lea ecx, [ebp - 0x440]
call fcn.10005370
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x470]
call fcn.100057f0
push eax
push str._INF__GetWimBootEntry__Path___s
call fcn.100098e0
add esp, 8
lea ecx, [ebp - 0x470]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100059e0
mov edx, dword [ebp - 0x5bc]
or edx, 1
mov dword [ebp - 0x5bc], edx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x470]
call fcn.10005900
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x578]
call fcn.10005900
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x590]
call fcn.10005900
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4b8]
call fcn.10005900
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x440]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5a8]
call fcn.10005900
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a0]
call fcn.10005900
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x488]
call fcn.10005900
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10005900
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fa64
mov esp, ebp
pop ebp
ret 4