Function at 0x10076720
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0x78
mov eax, 0x1018d8ef
call fcn.10188e66
mov edi, ecx
lea ecx, [ebp - 0x78]
call fcn.100528a8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x101c33f0]
mov esi, 0x101c33f0
cmp eax, esi
je 0x10076765
test byte [eax + 0x44], 4
je 0x10076765
push dword [edi + 8]
mov edx, 0x10020390
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x40
pop ecx
call fcn.1004a093
mov ecx, 0x101d6b88
call fcn.100794b3
test al, al
jne 0x1007678f
push 0x1001f7d0
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
push 0x1001f874
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
cmp byte [edi + 0x12], bl
jne 0x100767be
mov eax, dword [0x101c33f0]
cmp eax, esi
je 0x100767b6
test byte [eax + 0x44], 4
je 0x100767b6
push dword [eax + 0x3c]
mov edx, 0x10020390
push dword [eax + 0x38]
push 0x41
pop ecx
call fcn.1004a045
cmp dword [ebp - 0x78], ebx
jmp 0x10076bba
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp dword [ebp + 8], eax
je 0x100767fd
push 0x1001f854
lea ecx, [ebp - 0x70]
call fcn.1005236c
push eax
lea ecx, [ebp - 0x28]
call fcn.1004fb83
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.10052803
jmp 0x10076881
mov dword [ebp - 0x80], 0x10001e68
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x74], ebx
push eax
push 6
push ebx
push 0x1001ff48
mov ecx, edi
call fcn.10078d91
cmp dword [ebp - 0x7c], 0
jne 0x1007685a
mov eax, dword [0x101c33f0]
cmp eax, esi
je 0x1007684d
test byte [eax + 0x44], 4
je 0x1007684d
push dword [eax + 0x3c]
mov edx, 0x10020390
push dword [eax + 0x38]
push 0x42
pop ecx
call fcn.1004a045
lea ecx, [ebp - 0x80]
call fcn.1007937a
jmp 0x10076bab
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x70]
call fcn.1005236c
push eax
lea ecx, [ebp - 0x28]
call fcn.1004fb83
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.10052803
lea ecx, [ebp - 0x80]
call fcn.1007937a
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1007689e
lea eax, [ebp - 0x28]
push eax
push 0x1001f854
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100768ca
movsx eax, byte [0x1001bfc0]
mov ecx, 0x1001bfc0
neg eax
sbb eax, eax
and eax, 0x17f
jmp 0x10076969
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100768d6
lea eax, [ebp - 0x28]
push eax
push 0x1001f8c4
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100768ff
movsx eax, byte [0x1001c140]
mov ecx, 0x1001c140
neg eax
sbb eax, eax
and eax, 0x184
jmp 0x10076969
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1007690b
lea eax, [ebp - 0x28]
push eax
push 0x1001f830
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10076934
movsx eax, byte [0x1001c2c8]
mov ecx, 0x1001c2c8
neg eax
sbb eax, eax
and eax, 0x17e
jmp 0x10076969
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10076940
lea eax, [ebp - 0x28]
push eax
push 0x1001f8a0
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10076b71
movsx eax, byte [0x1001c448]
mov ecx, 0x1001c448
neg eax
sbb eax, eax
and eax, 0xa
push eax
push ecx
lea ecx, [ebp - 0x58]
call fcn.10043d0a
push 0x10020008
lea edx, [edi + 0x14]
lea ecx, [ebp - 0x40]
call fcn.1006e1db
mov dword [ebp - 0x74], ebx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x10076996
lea eax, [ebp - 0x40]
push ebx
push 0x8100080
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x74]
call fcn.1006f4f2
cmp dword [ebp - 0x74], 0xffffffff
jne 0x10076a01
mov eax, dword [0x101c33f0]
cmp eax, esi
je 0x100769e9
test byte [eax + 0x44], 1
je 0x100769e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x101c33f0]
mov edx, 0x10020390
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x44
pop ecx
call fcn.1004a069
lea ecx, [ebp - 0x74]
call fcn.1006f562
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10052803
jmp 0x10076ba0
cmp dword [ebp - 0x44], 0x10
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x84], ebx
jae 0x10076a13
lea eax, [ebp - 0x58]
push ebx
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x48]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10076b22
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x48]
jne 0x10076b22
mov ecx, 0x101d6b88
call fcn.100794b3
test al, al
je 0x10076a5b
push 0x1001f7d0
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x18]
lea ecx, [eax*2 + 2]
mov eax, dword [ebp - 0x28]
jae 0x10076a71
lea eax, [ebp - 0x28]
push ecx
push eax
push 1
push 0x1001f7d0
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov esi, eax
test esi, esi
jle 0x10076a94
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10076bca
mov ecx, 0x101d6b88
call fcn.100794b3
test al, al
je 0x10076ab6
push 0x1001f874
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_DeletePrinterDataW]
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x30]
lea ecx, [eax*2 + 2]
mov eax, dword [ebp - 0x40]
jae 0x10076acc
lea eax, [ebp - 0x40]
push ecx
push eax
push 1
push 0x1001f874
push dword [edi + 0x2c]
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov esi, eax
test esi, esi
jle 0x10076aef
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x100769e9
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x10076bf0
test byte [eax + 0x44], 1
je 0x10076bf0
push esi
push dword [eax + 0x3c]
mov edx, 0x10020390
push dword [eax + 0x38]
push 0x47
jmp 0x10076bea
mov eax, dword [0x101c33f0]
cmp eax, esi
je 0x10076b50
test byte [eax + 0x44], 1
je 0x10076b50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x101c33f0]
mov edx, 0x10020390
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x45
pop ecx
call fcn.1004a069
push ebx
lea ecx, [ebp - 0x74]
call fcn.1006f4f2
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x10076b65
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100769e9
mov eax, dword [0x101c33f0]
cmp eax, esi
je 0x10076ba0
test byte [eax + 0x44], 4
je 0x10076ba0
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x10076b8c
lea ecx, [ebp - 0x28]
push ecx
push dword [eax + 0x3c]
mov edx, 0x10020390
push dword [eax + 0x38]
push 0x43
pop ecx
call fcn.1004a093
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.10043c5c
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10052803
cmp dword [ebp - 0x78], 0
je 0x10076bc2
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.10188e03
ret 4
mov eax, dword [0x101c33f0]
cmp eax, 0x101c33f0
je 0x10076bf0
test byte [eax + 0x44], 1
je 0x10076bf0
push esi
push dword [eax + 0x3c]
mov edx, 0x10020390
push dword [eax + 0x38]
push 0x46
pop ecx
call fcn.1004a069
push esi
lea ecx, [ebp - 0x7c]
call fcn.10044b9d
push 0x101c213c
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3