Function at 0x10008695
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [eax], edi
nop
mov esi, dword [ebp + 8]
push 3
push esi
lea ecx, [ebx + 0xdfc]
call fcn.10006744
push eax
call fcn.10003827
add esp, 0xc
test eax, eax
jge 0x100086d7
mov eax, dword [esi + 0x464]
cmp eax, dword [esi + 0x460]
jl 0x100086df
push 1
pop eax
jmp 0x100088e1
cmp dword [esi + 0x468], edi
jne 0x10008701
push dword [esi + 0x470]
push dword [esi + 0x46c]
call fcn.10003bd3
pop ecx
mov dword [esi + 0x468], eax
pop ecx
nop
push edi
call fcn.1000b086
cmp eax, dword [esi + 0x468]
pop ecx
jge 0x10008717
xor eax, eax
jmp 0x100088e1
mov al, byte [0x1001c1a0]
push 0x40
mov byte [ebp - 0x208], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
nop
mov al, byte [0x1001c1a0]
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
nop
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esi + 0x20]
push 1
lea eax, [ebp - 0x208]
push edi
push eax
lea eax, [ebp - 0x104]
push 0x1001abc0
push eax
call fcn.10003abf
add esp, 0x14
lea eax, [esi + 0x420]
lea ecx, [ebx + 0xdf8]
push 1
push eax
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.10002607
test eax, eax
mov dword [ebp + 8], eax
jne 0x10008892
push eax
lea eax, [ebp - 0x208]
push eax
mov ecx, ebx
call fcn.10008297
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x208]
push eax
call esi
mov dl, byte [0x1001c1a0]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x40f]
mov byte [ebp - 0x410], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
nop
lea eax, [ebp - 0x104]
push eax
call fcn.1000a990
pop ecx
mov cl, byte [ebp + eax - 0x105]
cmp cl, 0x5c
je 0x10008828
cmp cl, 0x2f
je 0x10008828
mov byte [ebp + eax - 0x104], 0x5c
and byte [ebp + eax - 0x103], 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.1000abd0
nop
lea eax, [ebp - 0x30c]
push str.dosss11.dll
push eax
call fcn.1000abe0
nop
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.1000abd0
nop
lea eax, [ebp - 0x410]
push str.ecpidesk.sys
push eax
call fcn.1000abe0
add esp, 0x20
nop
lea eax, [ebp - 0x30c]
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call esi
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100088d9
mov eax, dword [esi + 0x464]
cmp eax, 4
jbe 0x100088a0
push 4
pop eax
mov edi, dword [eax*4 + 0x1001ab90]
push 0
call fcn.1000b086
add eax, edi
inc dword [esi + 0x464]
pop ecx
mov dword [esi + 0x468], eax
nop
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
push 1
pop eax
cmp dword [ebp + 8], eax
jne 0x100088d9
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
cmp dword [ebp + 8], eax
sete al
pop edi
pop esi
pop ebx
leave
ret 8