Function at 0x1009f3e
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x29b4
call fcn.010120a0
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x28c], ax
xor esi, esi
lea eax, [ebp - 0x28a]
push esi
push eax
mov dword [ebp - 0x29b0], ecx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x1a7e
mov word [ebp - 0x2994], ax
lea eax, [ebp - 0x2992]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x1fe
mov word [ebp - 0x48c], ax
lea eax, [ebp - 0x48a]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x7fe
mov word [ebp - 0xf14], ax
lea eax, [ebp - 0xf12]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push esi
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0x2998], 0xffffffff
xor eax, eax
mov word [ebp - 0x29a8], ax
lea edi, [ebp - 0x29a6]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x3c
push esi
mov dword [ebp - 0x29ac], esi
stosw word es:[edi], ax
mov dword [ebp - 0x29b4], 0xfeff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
cmp ebx, esi
jne 0x100a061
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100a035
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa2
jmp 0x100a534
push esi
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x1002810
call fcn.01014d1d
mov esi, eax
test esi, esi
jge 0x100a0a4
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa3
jmp 0x100a534
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, [ebp - 0x48c]
push eax
push 0x6a
push ebx
call edi
test eax, eax
jne 0x100a0ef
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002040
push 0xa4
jmp 0x100a1bc
mov eax, dword [ebp + 8]
dec eax
je 0x100a126
mov esi, 0x80070057
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push dword [ebp + 8]
push 0x1002040
push 0xaa
jmp 0x100a534
push 0x10027e4
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x100a17c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100a150
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa5
jmp 0x100a534
push 0x400
lea eax, [ebp - 0xf14]
push eax
push 0x69
push ebx
call edi
test eax, eax
jne 0x100a1d1
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002040
push 0xa6
mov eax, dword [0x1035014]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x100a53f
lea eax, [ebp - 0x29a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
add word [ebp - 0x299e], 5
cmp word [ebp - 0x299e], 0x3b
jbe 0x100a203
inc word [ebp - 0x29a0]
mov eax, 0xffc4
add word [ebp - 0x299e], ax
cmp word [ebp - 0x29a0], 0x17
jbe 0x100a220
inc word [ebp - 0x29a2]
mov eax, 0xffe8
add word [ebp - 0x29a0], ax
movzx eax, word [ebp - 0x299c]
push eax
movzx eax, word [ebp - 0x299e]
push eax
movzx eax, word [ebp - 0x29a0]
push eax
movzx eax, word [ebp - 0x29a2]
push eax
movzx eax, word [ebp - 0x29a6]
push eax
movzx eax, word [ebp - 0x29a8]
push eax
push 0x10027a8
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.01006a35
mov esi, eax
xor edi, edi
add esp, 0x24
cmp esi, edi
jge 0x100a298
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa7
jmp 0x100a534
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xf14]
push eax
lea eax, [ebp - 0x48c]
push eax
push dword [0x1035010]
lea eax, [ebp - 0x2994]
push 0xd40
push eax
call fcn.01006a35
mov esi, eax
add esp, 0x18
cmp esi, edi
jge 0x100a2f7
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa8
jmp 0x100a534
lea eax, [ebp - 0x28c]
push eax
push 0x10026f0
lea eax, [ebp - 0x714]
push 0x144
push eax
call fcn.01006a35
mov esi, eax
add esp, 0x10
cmp esi, edi
jge 0x100a347
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xa9
jmp 0x100a534
push edi
push 0x80
push 2
pop ebx
push ebx
push edi
call fcn.01014c87
push eax
push 1
push 0x40000000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2998], eax
cmp eax, 0xffffffff
jne 0x100a3c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100a38b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
lea ecx, [ebp - 0x28c]
push ecx
push 0x1002040
push 0xab
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004f4d
jmp 0x100a53f
push 0x2080
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x100a405
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a405
test byte [eax + 0x1c], bl
je 0x100a405
push 0x1002040
push 0xac
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 0x29ac]
push eax
push ebx
lea eax, [ebp - 0x29b4]
push eax
push dword [ebp - 0x2998]
call esi
test eax, eax
je 0x100a501
cmp dword [ebp - 0x29ac], edi
je 0x100a501
lea eax, [ebp - 0x2994]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x100a440
sub eax, edx
push edi
sar eax, 1
lea ecx, [ebp - 0x29ac]
push ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2994]
push eax
push dword [ebp - 0x2998]
call esi
test eax, eax
je 0x100a4cc
cmp dword [ebp - 0x29ac], edi
je 0x100a4cc
push dword [ebp - 0x2998]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x29b0]
or dword [ebp - 0x2998], 0xffffffff
lea eax, [ebp - 0x714]
push eax
call fcn.01009c73
mov esi, eax
cmp esi, edi
jge 0x100a4c8
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xaf
jmp 0x100a534
xor esi, esi
jmp 0x100a53f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100a4e0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xae
jmp 0x100a534
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100a515
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100a53f
test byte [eax + 0x1c], 1
je 0x100a53f
push esi
push 0x1002040
push 0xad
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
cmp word [ebp - 0x28c], 0
je 0x100a556
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x2998], 0xffffffff
je 0x100a56b
push dword [ebp - 0x2998]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01011f27
leave
ret 4