Function at 0x101f69e
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10566d8]
and dword [ebp - 0x808], 0
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x101f6cf
push 6
pop eax
jmp 0x101f955
mov ecx, dword [eax + 8]
add ecx, dword [eax + 4]
push ebx
push esi
je 0x101f716
mov esi, 0x3c0
mov ebx, ecx
mov ecx, dword [esi + eax]
mov edx, dword [esi + eax + 4]
cmp ecx, 0xffffffff
jne 0x101f6f0
test edx, edx
je 0x101f710
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov eax, dword [0x10566d8]
or dword [esi + eax], 0xffffffff
mov eax, dword [0x10566d8]
and dword [esi + eax + 4], 0
mov eax, dword [0x10566d8]
add esi, 8
dec ebx
jne 0x101f6e0
xor esi, esi
cmp dword [edi + 0x10], esi
jbe 0x101f733
mov eax, dword [edi + 0x1c]
push dword [eax + esi*4]
call sub.tdh.dll_TdhUnloadManifest
inc esi
cmp esi, dword [edi + 0x10]
jb 0x101f71d
mov eax, dword [0x10566d8]
mov esi, 0x400
test dword [eax + 0x3b0], esi
je 0x101f74a
call fcn.010396e4
mov eax, dword [0x10566d8]
test byte [eax + 0x3b0], 8
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x101f81f
lea ecx, [eax + 0x314]
cmp dword [ecx], 0
je 0x101f81f
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101f81a
mov eax, dword [0x10566d8]
mov ebx, 0x40000
test dword [eax + 0x3b0], ebx
je 0x101f7a6
cmp dword [eax + 0x320], 0
je 0x101f7a6
push esi
lea eax, [ebp - 0x804]
push eax
call fcn.01022d0c
jmp 0x101f7be
push dword [eax + 0x314]
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0101f55e
and eax, 0xffff
mov dword [ebp - 0x808], eax
test eax, eax
jne 0x101f81a
mov eax, dword [0x10566d8]
push dword [eax + 0x3b0]
lea eax, [ebp - 0x804]
push eax
call fcn.0103ad72
mov eax, dword [0x10566d8]
test dword [eax + 0x3b0], ebx
je 0x101f81f
lea ecx, [eax + 0x320]
cmp dword [ecx], 0
je 0x101f81f
push dword [eax + 0x314]
lea eax, [ebp - 0x804]
push dword [ecx]
push eax
call fcn.0103c782
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x804]
push eax
call edi
mov eax, dword [0x10566d8]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [eax + 0x348]
cmp dword [ecx], 0
je 0x101f841
push dword [ecx]
push 0
push dword [0x10576f8]
call ebx
mov eax, dword [0x10566d8]
mov ecx, dword [0x1079aa0]
test ecx, ecx
je 0x101f85b
push ecx
push 0
push dword [0x10576f8]
call ebx
mov eax, dword [0x10566d8]
mov ecx, dword [0x1079a70]
mov esi, dword [sym.imp.msvcrt.dll_fclose]
test ecx, ecx
je 0x101f883
push ecx
call esi
and dword [0x1079a70], 0
mov dword [esp], 0x10566e8
call edi
mov eax, dword [0x10566d8]
mov ecx, dword [0x1079a74]
test ecx, ecx
je 0x101f8a5
push ecx
call esi
and dword [0x1079a74], 0
mov dword [esp], 0x1056ee8
call edi
mov eax, dword [0x10566d8]
mov edx, dword [eax + 0x3b0]
test dl, dl
jns 0x101f8f6
lea ecx, [eax + 0x39c]
cmp dword [ecx], 0
je 0x101f8e5
test edx, 0x9000000
je 0x101f8d5
push 0x1001f00
push dword [ecx]
call fcn.010243c0
mov eax, dword [0x10566d8]
pop ecx
pop ecx
push dword [eax + 0x39c]
call fcn.01023fb3
mov eax, dword [0x10566d8]
add eax, 0x68c
cmp dword [eax], 0
je 0x101f8f6
push dword [eax]
call sub.wevtapi.dll_EvtClose
call fcn.010237d6
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x1079a00
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push dword [0x10566d8]
call fcn.0102515e
mov eax, dword [0x10566d8]
lea ecx, [eax + 0x684]
xor esi, esi
cmp dword [ecx], esi
je 0x101f934
push dword [ecx]
call fcn.0103b312
mov eax, dword [0x10566d8]
cmp eax, esi
je 0x101f942
push eax
push esi
push dword [0x10576f8]
call ebx
mov dword [0x10566d8], esi
call fcn.0101f1e3
mov eax, dword [ebp - 0x808]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0101ca75
leave
ret 4