Function at 0x1c680
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x1c689
mov eax, dword [ebp - 4]
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x202c], ebx
mov dword [ebp - 0x2028], ebx
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x2020], ebx
mov dword [ebp - 0x2024], ebx
mov dword [ebp - 0x2018], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1c9a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, ebx
call fcn.00013d6c
lea eax, [ebp - 0x2014]
xor ecx, ecx
mov edx, 0x1000
call fcn.00012c70
lea eax, [ebp - 0x1014]
xor ecx, ecx
mov edx, 0x1000
call fcn.00012c70
lea eax, [ebp - 4]
call fcn.000143f0
lea eax, [ebp - 0x14]
call fcn.000143f0
lea eax, [ebp - 0xc]
call fcn.000143f0
lea eax, [ebp - 0x10]
call fcn.00013d18
mov eax, ebx
mov edx, dword [0x16a30c]
call fcn.000140b8
je 0x1c751
mov eax, ebx
mov edx, dword [0x16a308]
call fcn.000140b8
jne 0x1c8e7
mov eax, esi
mov edx, dword [0x16a304]
call fcn.00013d6c
lea edx, [ebp - 4]
mov eax, edi
call fcn.0001bc8c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0001bc38
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00013f70
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0001c62c
mov eax, dword [ebp - 0x14]
call fcn.0001bce4
push 0
push 0x80
push 2
push 0
push 1
push 0x10000000
mov eax, dword [ebp - 4]
call fcn.00014620
mov edi, eax
push edi
call sub.kernel32.dll_CreateFileW
push eax
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x2018]
mov edx, dword [ebp - 0x10]
call fcn.000145ac
mov eax, dword [ebp - 0x2018]
mov edx, dword [ebp - 0xc]
call fcn.00014748
jne 0x1c86b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2014]
push eax
push 0x7fe
mov eax, dword [ebp - 0x14]
call fcn.00014620
push eax
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jbe 0x1c8c4
push 0x7fe
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x2014]
push eax
call sub.kernel32.dll_GetShortPathNameW
test eax, eax
jbe 0x1c8c4
lea eax, [ebp - 0x2024]
lea edx, [ebp - 0x1014]
mov ecx, 0x800
call fcn.00014590
mov edx, dword [ebp - 0x2024]
lea eax, [ebp - 0x2020]
call fcn.00013f70
mov eax, dword [ebp - 0x2020]
lea edx, [ebp - 0x201c]
call fcn.00027578
mov edx, dword [ebp - 0x201c]
mov eax, esi
mov ecx, dword [ebp - 0x10]
call fcn.00013ff4
jmp 0x1c8c4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2014]
push eax
push 0x7fe
push edi
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jbe 0x1c8c4
push 0x7fe
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x2014]
push eax
call sub.kernel32.dll_GetShortPathNameW
test eax, eax
jbe 0x1c8c4
lea eax, [ebp - 0x2028]
lea edx, [ebp - 0x1014]
mov ecx, 0x800
call fcn.00014590
mov edx, dword [ebp - 0x2028]
mov eax, esi
call fcn.00013f70
mov eax, ebx
mov edx, dword [0x16a308]
call fcn.000140b8
jne 0x1c947
mov eax, dword [ebp - 4]
call fcn.0001ba04
test al, al
je 0x1c947
push edi
call sub.kernel32.dll_DeleteFileW
jmp 0x1c947
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2014]
push eax
push 0x7fe
mov eax, edi
call fcn.00014620
push eax
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jbe 0x1c947
push 0x7fe
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x2014]
push eax
call sub.kernel32.dll_GetShortPathNameW
test eax, eax
jbe 0x1c947
lea eax, [ebp - 0x202c]
lea edx, [ebp - 0x1014]
mov ecx, 0x800
call fcn.00014590
mov edx, dword [ebp - 0x202c]
mov eax, esi
call fcn.00013f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c9a7
lea eax, [ebp - 0x202c]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0x2020]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x2018]
call fcn.000143f0
lea eax, [ebp - 0x14]
call fcn.000143f0
lea eax, [ebp - 0x10]
call fcn.00013d18
lea eax, [ebp - 0xc]
call fcn.000143f0
lea eax, [ebp - 4]
call fcn.000143f0
ret