Function at 0x10007400
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041402
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x10008156
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2d0], 0xf
mov dword [ebp - 0x2cc], 0x400042
mov dword [ebp - 0x2c8], 0x420057
mov dword [ebp - 0x2c4], 0x46006e
mov dword [ebp - 0x2c0], 0x510044
mov dword [ebp - 0x2bc], 0x430057
mov dword [ebp - 0x2b8], 0x17005d
mov dword [ebp - 0x2b4], 0x550053
mov dword [ebp - 0x2b0], 0x3d0055
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x2cc], ax
inc ecx
mov eax, dword [ebp - 0x2d0]
cmp ecx, eax
jb 0x100074b2
xor ecx, ecx
push ecx
mov edi, esp
mov word [ebp + eax*2 - 0x2cc], cx
mov dword [ebp - 0x25c], esp
mov dword [ebp - 0x260], edi
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x10008160
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x2cc]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x10007518
movzx eax, ax
mov ecx, edi
push eax
call fcn.1000da30
jmp 0x1000753f
lea ecx, [ebp - 0x2cc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007521
sub ecx, edx
lea eax, [ebp - 0x2cc]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000dcb0
lea eax, [ebp - 0x364]
mov byte [ebp - 4], 3
push eax
call fcn.100081c0
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x1000756e
nop dword [eax]
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x10007560
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x260], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x1000816a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 4
test edi, edi
je 0x100075d1
test edi, 0xffff0000
jne 0x100075b3
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
jmp 0x100075dc
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100075c0
sub ecx, edx
sar ecx, 1
jmp 0x100075d3
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.10012390
add esp, 8
test al, al
je 0x10007a8d
mov dword [ebp - 0x284], 0xf
xor ecx, ecx
mov dword [ebp - 0x280], 0x400042
mov dword [ebp - 0x27c], 0x420057
mov dword [ebp - 0x278], 0x46006e
mov dword [ebp - 0x274], 0x510044
mov dword [ebp - 0x270], 0x430057
mov dword [ebp - 0x26c], 0x17005d
mov dword [ebp - 0x268], 0x550053
mov dword [ebp - 0x264], 0x3d0055
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x280], ax
inc ecx
mov eax, dword [ebp - 0x284]
cmp ecx, eax
jb 0x10007650
xor ecx, ecx
mov word [ebp + eax*2 - 0x280], cx
lea eax, [ebp - 0x280]
push 0x1004ebf4
push eax
call fcn.100288f3
mov edi, eax
add esp, 8
test edi, edi
je 0x10007a8d
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100289d7
lea eax, [ebp - 0x218]
push eax
push 0x1004ebf8
call fcn.10011ee0
push edi
call fcn.10028b07
mov eax, 0x12
mov dword [ebp - 0x288], 0x5c000b
add esp, 0x18
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x284], 0x62006c
xor ecx, ecx
mov dword [ebp - 0x280], 0x5c0046
mov dword [ebp - 0x27c], 0x59005b
mov dword [ebp - 0x278], 0x7b006a
mov dword [ebp - 0x274], 0x5e005d
mov dword [ebp - 0x270], 0x4f0053
mov dword [ebp - 0x26c], 0x4d0012
mov dword [ebp - 0x268], 0x54005f
mov dword [ebp - 0x264], 0x40
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x288], ax
inc ecx
mov eax, dword [ebp - 0x28c]
cmp ecx, eax
jb 0x10007730
xor ecx, ecx
mov word [ebp + eax*2 - 0x288], cx
lea eax, [ebp - 0x288]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000dfc0
mov esi, dword [ebp - 0x21c]
push 0
push esi
call fcn.10027378
add esp, 0x14
test eax, eax
je 0x1000784c
push ecx
mov edi, esp
mov dword [ebp - 0x260], esp
lea ecx, [esi - 0x10]
mov dword [ebp - 0x25c], edi
call fcn.1000dbd0
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 5
push eax
call fcn.100082f0
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x100077c6
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x100077b8
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x25c], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x10008174
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 6
test edi, edi
je 0x10007838
test edi, 0xffff0000
jne 0x10007812
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
mov byte [ebp - 4], 5
jmp 0x100079f0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007817
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 5
jmp 0x100079f0
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 5
jmp 0x100079f0
lea ecx, [esi - 0x10]
call fcn.1000dbd0
lea edi, [eax + 0x10]
lea eax, [ebp - 0x24c]
push eax
push edi
call fcn.10028832
mov edx, dword [ebp - 0x238]
add esp, 8
mov dword [ebp - 0x25c], edx
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10007891
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x25c]
movaps xmm0, xmmword [0x1004eda0]
xor ecx, ecx
mov dword [ebp - 0x274], 0xf
movups xmmword [ebp - 0x270], xmm0
nop dword [eax + eax]
mov al, cl
add al, 0x2e
xor byte [ebp + ecx - 0x270], al
inc ecx
mov eax, dword [ebp - 0x274]
cmp ecx, eax
jb 0x100078b0
mov byte [ebp + eax - 0x270], 0
lea eax, [ebp - 0x270]
push edx
push eax
call fcn.10011f60
lea ecx, [esi - 0x10]
call fcn.1000dbd0
lea edi, [eax + 0x10]
lea eax, [ebp - 0x24c]
push eax
push edi
call fcn.10028832
mov eax, dword [ebp - 0x238]
add esp, 0x10
mov dword [ebp - 0x25c], eax
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1000791a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call fcn.10029409
add esp, 4
cmp dword [ebp - 0x25c], eax
je 0x100079fc
push ecx
mov edi, esp
mov dword [ebp - 0x260], esp
lea ecx, [esi - 0x10]
mov dword [ebp - 0x25c], edi
call fcn.1000dbd0
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 7
push eax
call fcn.100082f0
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x1000797e
nop
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x10007970
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x25c], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x1000817e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 8
test edi, edi
je 0x100079e1
test edi, 0xffff0000
jne 0x100079c3
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
jmp 0x100079ec
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100079d0
sub ecx, edx
sar ecx, 1
jmp 0x100079e3
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 7
mov byte [ebp - 4], 1
call fcn.10012390
add esp, 8
mov dword [ebp - 0x284], 0xf
xor ecx, ecx
mov dword [ebp - 0x280], 0x400042
mov dword [ebp - 0x27c], 0x420057
mov dword [ebp - 0x278], 0x46006e
mov dword [ebp - 0x274], 0x510044
mov dword [ebp - 0x270], 0x430057
mov dword [ebp - 0x26c], 0x17005d
mov dword [ebp - 0x268], 0x550053
mov dword [ebp - 0x264], 0x3d0055
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x280], ax
inc ecx
mov eax, dword [ebp - 0x284]
cmp ecx, eax
jb 0x10007a60
xor ecx, ecx
mov word [ebp + eax*2 - 0x280], cx
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x2ac], 0xd
xor ecx, ecx
mov dword [ebp - 0x2a8], 0x400042
mov dword [ebp - 0x2a4], 0x420057
mov dword [ebp - 0x2a0], 0x50006e
mov dword [ebp - 0x29c], 0x560057
mov dword [ebp - 0x298], 0x190055
mov dword [ebp - 0x294], 0x570051
mov dword [ebp - 0x290], 0x3b0053
nop
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x2a8], ax
inc ecx
mov eax, dword [ebp - 0x2ac]
cmp ecx, eax
jb 0x10007ae0
xor ecx, ecx
push ecx
mov edi, esp
mov word [ebp + eax*2 - 0x2a8], cx
mov dword [ebp - 0x260], esp
mov dword [ebp - 0x25c], edi
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x10008188
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 9
test eax, 0xffff0000
jne 0x10007b46
movzx eax, ax
mov ecx, edi
push eax
call fcn.1000da30
jmp 0x10007b6e
lea ecx, [ebp - 0x2a8]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007b50
sub ecx, edx
lea eax, [ebp - 0x2a8]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000dcb0
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 0xa
push eax
call fcn.10008400
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x10007b9e
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x10007b90
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x25c], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x10008192
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0xb
test edi, edi
je 0x10007c01
test edi, 0xffff0000
jne 0x10007be3
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
jmp 0x10007c0c
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007bf0
sub ecx, edx
sar ecx, 1
jmp 0x10007c03
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 1
call fcn.10012390
add esp, 8
test al, al
je 0x100080fd
mov dword [ebp - 0x280], 0xd
xor ecx, ecx
mov dword [ebp - 0x27c], 0x400042
mov dword [ebp - 0x278], 0x420057
mov dword [ebp - 0x274], 0x50006e
mov dword [ebp - 0x270], 0x560057
mov dword [ebp - 0x26c], 0x190055
mov dword [ebp - 0x268], 0x570051
mov dword [ebp - 0x264], 0x3b0053
nop word [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x27c], ax
inc ecx
mov eax, dword [ebp - 0x280]
cmp ecx, eax
jb 0x10007c80
xor ecx, ecx
mov word [ebp + eax*2 - 0x27c], cx
lea eax, [ebp - 0x27c]
push 0x1004ebf4
push eax
call fcn.100288f3
mov edi, eax
add esp, 8
test edi, edi
je 0x100080fd
push edi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100289d7
lea eax, [ebp - 0x218]
push eax
push 0x1004ebf8
call fcn.10011ee0
push edi
call fcn.10028b07
add esp, 0x18
mov dword [ebp - 0x258], 0x1b
mov dword [ebp - 0x254], 0x5c000b
xor ecx, ecx
mov dword [ebp - 0x250], 0x50006c
mov dword [ebp - 0x24c], 0x430042
mov dword [ebp - 0x248], 0x540057
mov dword [ebp - 0x244], 0x5f0055
mov dword [ebp - 0x240], 0x65005d
mov dword [ebp - 0x23c], 0x5a004a
mov dword [ebp - 0x238], 0x56005f
mov dword [ebp - 0x234], 0x58005f
mov dword [ebp - 0x230], 0x280025
mov dword [ebp - 0x22c], 0x25002c
mov dword [ebp - 0x228], 0x6b002b
mov dword [ebp - 0x224], 0x230030
mov dword [ebp - 0x220], 0x49002e
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x254], ax
inc ecx
mov eax, dword [ebp - 0x258]
cmp ecx, eax
jb 0x10007d82
xor ecx, ecx
mov word [ebp + eax*2 - 0x254], cx
lea eax, [ebp - 0x254]
push dword [0x10056178]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000dfc0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10027378
add esp, 0x14
test eax, eax
je 0x10007ea7
push ecx
mov edi, esp
mov dword [ebp - 0x260], esp
mov dword [ebp - 0x25c], edi
mov esi, dword [ebp - 0x21c]
lea ecx, [esi - 0x10]
call fcn.1000dbd0
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 0xc
push eax
call fcn.10008520
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x10007e21
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x10007e13
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x25c], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x1000819c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0xd
test edi, edi
je 0x10007e93
test edi, 0xffff0000
jne 0x10007e6d
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
mov byte [ebp - 4], 0xc
jmp 0x10008060
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007e72
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 0xc
jmp 0x10008060
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 0xc
jmp 0x10008060
mov esi, dword [ebp - 0x21c]
lea ecx, [esi - 0x10]
call fcn.1000dbd0
lea edi, [eax + 0x10]
lea eax, [ebp - 0x24c]
push eax
push edi
call fcn.10028832
mov edx, dword [ebp - 0x238]
add esp, 8
mov dword [ebp - 0x25c], edx
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10007ef2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x25c]
movaps xmm0, xmmword [0x1004eda0]
xor ecx, ecx
mov dword [ebp - 0x274], 0xf
movups xmmword [ebp - 0x270], xmm0
nop dword [eax]
mov al, cl
add al, 0x2e
xor byte [ebp + ecx - 0x270], al
inc ecx
mov eax, dword [ebp - 0x274]
cmp ecx, eax
jb 0x10007f10
mov byte [ebp + eax - 0x270], 0
lea eax, [ebp - 0x270]
push edx
push eax
call fcn.10011f60
lea ecx, [esi - 0x10]
call fcn.1000dbd0
lea edi, [eax + 0x10]
lea eax, [ebp - 0x24c]
push eax
push edi
call fcn.10028832
mov eax, dword [ebp - 0x238]
add esp, 0x10
mov dword [ebp - 0x25c], eax
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10007f7a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call fcn.10029409
add esp, 4
cmp dword [ebp - 0x25c], eax
je 0x1000806c
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov edi, esp
mov dword [ebp - 0x260], esp
lea ecx, [esi - 0x10]
mov dword [ebp - 0x25c], edi
call fcn.1000dbd0
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 0xe
push eax
call fcn.10008520
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx]
lea edi, [ebx + 4]
test edx, edx
je 0x10007fef
lea eax, [ecx + 0x2e]
xor word [edi + ecx*2], ax
inc ecx
mov edx, dword [ebx]
cmp ecx, edx
jb 0x10007fe1
push ecx
xor eax, eax
mov ebx, esp
mov word [edi + edx*2], ax
mov dword [ebp - 0x25c], ebx
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100081a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0xf
test edi, edi
je 0x10008051
test edi, 0xffff0000
jne 0x10008034
movzx eax, di
mov ecx, ebx
push eax
call fcn.1000da30
jmp 0x1000805c
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008040
sub ecx, edx
sar ecx, 1
jmp 0x10008053
xor ecx, ecx
push ecx
push edi
mov ecx, ebx
call fcn.1000dcb0
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 1
call fcn.10012390
add esp, 8
push 1
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x280], 0xd
xor ecx, ecx
mov dword [ebp - 0x27c], 0x400042
mov dword [ebp - 0x278], 0x420057
mov dword [ebp - 0x274], 0x50006e
mov dword [ebp - 0x270], 0x560057
mov dword [ebp - 0x26c], 0x190055
mov dword [ebp - 0x268], 0x570051
mov dword [ebp - 0x264], 0x3b0053
nop dword [eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0x27c], ax
inc ecx
mov eax, dword [ebp - 0x280]
cmp ecx, eax
jb 0x100080d0
xor ecx, ecx
mov word [ebp + eax*2 - 0x27c], cx
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1000811b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1000813a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100154d9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
int3