Function at 0x10003510
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x10032466
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x1003d300]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d300]
xor eax, esp
push eax
lea eax, [esp + 0x14c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x15c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
and dword [esp + 0x2c], 0xfffffe00
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov ebp, 1
push eax
lea esi, [esp + 0x5c]
mov dword [esp + 0x158], ebp
call fcn.100016e0
add esp, 4
mov esi, eax
lea edx, [esp + 0x90]
mov byte [esp + 0x154], 2
push edx
mov dword [esp + 0x20], ebp
call fcn.10009395
mov ecx, 3
mov dword [esp + 0x154], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x24]
push ecx
push esi
push eax
call fcn.10009404
test al, al
je 0x100035cf
cmp byte [esp + 0x2c], 7
mov byte [esp + 0x1b], bl
je 0x100035d4
mov byte [esp + 0x1b], 1
lea edi, [esp + 0x90]
call fcn.10003960
mov dword [esp + 0x154], ebp
mov ebp, 0x10
cmp dword [esp + 0x70], ebp
jb 0x100035ff
mov edx, dword [esp + 0x5c]
push edx
call fcn.1001aa0a
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x10003627
mov eax, dword [esp + 0x20]
mov byte [eax], 1
lea esi, [esp + 0x24]
mov dword [esp + 0x154], 0xffffffff
call fcn.1000cb2c
xor eax, eax
jmp 0x10003930
push 0x10035a42
mov edx, str.attachment
lea ecx, [esp + 0x28]
call fcn.1000d92d
cmp eax, ebx
je 0x100037d6
push str.attachment
lea ecx, [esp + 0x28]
push ecx
mov ecx, 0x10035a42
call fcn.1000d7f2
cmp byte [eax + 8], 4
jne 0x100037d6
push str.attachment
lea edx, [esp + 0x28]
push edx
mov ecx, 0x10035a42
call fcn.1000d7f2
push eax
lea ecx, [esp + 0x40]
call fcn.1000cd1a
push eax
lea ecx, [esp + 0x128]
mov byte [esp + 0x158], 4
call fcn.10001660
add esp, 4
mov byte [esp + 0x154], 6
cmp dword [esp + 0x54], ebp
jb 0x100036b1
mov eax, dword [esp + 0x40]
push eax
call fcn.1001aa0a
add esp, 4
mov eax, dword [esp + 0x128]
mov esi, 8
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x13c], esi
jae 0x100036dd
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100037be
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x78]
call fcn.1000de9c
mov byte [esp + 0x154], 7
cmp dword [eax + 0x18], ebp
jb 0x1000370c
mov eax, dword [eax + 4]
jmp 0x1000370f
add eax, 4
push eax
lea ecx, [esp + 0x5c]
call fcn.10005750
mov byte [esp + 0x154], 8
mov eax, dword [esp + 0x128]
cmp dword [esp + 0x13c], esi
jae 0x10003738
lea eax, [esp + 0x128]
push eax
lea edx, [esp + 0x5c]
push edx
call fcn.10003360
add esp, 8
lea ecx, [esp + 0x58]
mov edi, eax
call fcn.10001240
lea ecx, [esp + 0x74]
mov byte [esp + 0x154], 6
call fcn.10001240
cmp edi, ebx
je 0x10003797
lea eax, [esp + 0x24]
push eax
mov edx, str.i_notremove
call fcn.1000dabc
test al, al
jne 0x10003797
mov eax, dword [esp + 0x128]
cmp dword [esp + 0x13c], esi
jae 0x10003790
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esp + 0x124]
call fcn.10005860
lea esi, [esp + 0x24]
mov dword [esp + 0x154], 0xffffffff
call fcn.1000cb2c
mov eax, edi
jmp 0x10003930
mov ecx, dword [esp + 0x20]
lea esi, [esp + 0x124]
mov byte [ecx], 1
call fcn.10005860
jmp 0x1000360c
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x20], ebx
call fcn.1000de9c
mov byte [esp + 0x154], 9
cmp dword [eax + 0x18], ebp
jb 0x100037fa
mov eax, dword [eax + 4]
jmp 0x100037fd
add eax, 4
push eax
call fcn.100025f0
mov edi, eax
cmp dword [esp + 0x70], ebp
jb 0x10003818
mov eax, dword [esp + 0x5c]
push eax
call fcn.1001aa0a
add esp, 4
mov esi, 0xf
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp edi, ebx
je 0x10003918
and dword [esp + 0x12c], 0xfffffe00
mov dword [esp + 0x20], 1
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push edi
mov byte [esp + 0x164], 0xc
call fcn.10016d70
add esp, 0x10
cmp dword [esp + 0x54], ebp
jb 0x1000389b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.1001aa0a
add esp, 4
mov dword [esp + 0x54], esi
lea esi, [esp + 0x124]
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
mov byte [esp + 0x154], 1
call fcn.1000cb2c
mov eax, dword [0x1003ff58]
cmp eax, ebx
jne 0x10003907
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.pobus32.dll
call esi
cmp eax, ebx
jne 0x100038f2
push str.pobus64.dll
call esi
cmp eax, ebx
jne 0x100038f2
push str.poda32.dll
call esi
cmp eax, ebx
jne 0x100038f2
push str.poda64.dll
call esi
push str.FB7C34E6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003ff58], eax
cmp eax, ebx
je 0x1000390a
push edi
call eax
cmp dword [esp + 0x20], ebx
jne 0x10003918
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x24]
mov dword [esp + 0x154], 0xffffffff
call fcn.1000cb2c
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.1001a9d1
add esp, 0x144
ret