Function at 0x10022af0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f960
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x10083500]
mov esi, dword [ebp + 8]
test ecx, ecx
jne 0x10022b77
push 0x10080004
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10083500], 0
jne 0x10022b66
push 0x14
call fcn.1002bba2
add esp, 4
test eax, eax
je 0x10022b58
mov ecx, eax
call fcn.10019e60
mov ecx, eax
jmp 0x10022b5a
xor ecx, ecx
xchg dword [ebp - 0x8ac], eax
mov dword [0x10083500], ecx
push 0x10080004
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x10083500]
call fcn.1001a1b0
test eax, eax
je 0x10022fe6
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x8a4], 0
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x888], eax
mov dword [ebp - method.CTaskbarProcess.virtual_0], vtable.CTaskbarProcess.0
mov dword [ebp - method.LdsCommon::CCommandLine.virtual_0], vtable.LdsCommon::CCommandLine.0
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], 0
call fcn.10022330
mov dword [ebp - 0x87c], eax
lea ecx, [ebp - 0x800]
xor eax, eax
mov dword [ebp - 0x854], 0
mov word [ebp - 0x864], ax
xorps xmm0, xmm0
mov dword [ebp - 0x83c], eax
mov word [ebp - 0x84c], ax
mov dword [ebp - 0x824], eax
mov word [ebp - 0x834], ax
mov dword [ebp - 0x80c], eax
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x708]
push eax
movups xmmword [ebp - 0x874], xmm0
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x838], 7
mov dword [ebp - 0x820], 7
mov dword [ebp - 0x808], 7
call fcn.1001ed00
lea ecx, [ebp - 0x708]
call fcn.10007890
push 0x78
call fcn.1002bba2
add esp, 4
test eax, eax
je 0x10022c90
mov ecx, eax
call fcn.1001b1a0
jmp 0x10022c92
xor eax, eax
push dword [ebp - 0x8ac]
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
mov dword [ebp - 0x62c], 0
call fcn.100073f0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
lea ecx, [ebp - 0x8a8]
call fcn.10021830
test eax, eax
jne 0x10022cdf
push str.parse_params_failed.
call fcn.100133d0
jmp 0x10022e33
push esi
lea ecx, [ebp - 0x8a8]
call fcn.10021b70
test eax, eax
je 0x10022e36
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xorps xmm0, xmm0
mov dword [ebp - 0x8f0], 0x1006732c
mov ebx, 1
movups xmmword [ebp - 0x8ec], xmm0
mov dword [ebp - 0x8dc], 0
xor esi, esi
mov dword [ebp - 0x8d8], 0
test ebx, ebx
je 0x10022d5c
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8d4]
push eax
call edi
test eax, eax
jne 0x10022d5c
mov eax, dword [ebp - 0x8f0]
lea ecx, [ebp - 0x8f0]
push esi
call dword [eax + 4]
inc esi
test eax, eax
jne 0x10022d30
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x10022d28
test eax, eax
je 0x10022df2
lea eax, [ebp - 0x8d4]
push eax
mov eax, dword [ebp - 0x8f0]
lea ecx, [ebp - 0x8f0]
call dword [eax]
test eax, eax
jne 0x10022dab
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x8d0]
cmp eax, 0x118
ja 0x10022dc6
je 0x10022de2
cmp eax, 0xf
je 0x10022de2
cmp eax, 0xa0
jmp 0x10022dcb
cmp eax, 0x200
je 0x10022de2
mov ecx, 1
xor eax, eax
test ecx, ecx
mov ebx, ecx
cmove eax, esi
mov esi, eax
jmp 0x10022d28
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmove eax, esi
mov esi, eax
jmp 0x10022d28
mov eax, dword [ebp - 0x8e0]
test eax, eax
je 0x10022e0f
push eax
call fcn.1003cb4a
add esp, 4
mov dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8dc], 0
mov dword [ebp - 0x8d8], 0
test eax, eax
je 0x10022e36
push eax
call fcn.1003cb4a
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10037300
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push str.RunDll.exe
push esi
call fcn.10044517
add esp, 8
test eax, eax
je 0x10022fdb
push str.32.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x10022fdb
push 0x10063ec0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x10022ed4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebp - 0x8b4], eax
call esi
mov dword [ebp - 0x8b0], eax
jmp 0x10022eda
mov eax, dword [ebp - 0x8b0]
mov ecx, dword [ebp - 0x8b4]
test ecx, ecx
je 0x10022ef1
test eax, eax
je 0x10022ef1
lea eax, [ebp - 0x8b8]
push eax
call ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
cmp dword [ebp - 0x8b4], 0
mov dword [ebp - 4], 0
je 0x10022f22
mov ecx, dword [ebp - 0x8b0]
test ecx, ecx
je 0x10022f22
push dword [ebp - 0x8b8]
call ecx
test esi, esi
je 0x10022fdb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10022fdb
push 0x208
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.10037300
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10037300
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.1004468c
add esi, eax
lea eax, [ebp - 0x628]
push esi
push eax
push str._slds__u.tmp
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.10012a00
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x420]
add esp, 0x14
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call esi
push 4
test eax, eax
lea eax, [ebp - 0x420]
push 0
jne 0x10022fd8
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x8a8]
call fcn.10021190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 4