Function at 0x477f90
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124c
call fcn.00536300
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xc32]
push ecx
mov word [ebp - 0xc34], ax
call fcn.005336c0
add esp, 0xc
push 0
push 0x23
lea edx, [ebp - 0xc34]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.005336c0
add esp, 0xc
xor eax, eax
jmp 0x478000
movzx ecx, word [ebp + eax - 0xc34]
mov word [ebp + eax - 0x414], cx
add eax, 2
test cx, cx
jne 0x478000
push str.kingsoftwps
lea edx, [ebp - 0x414]
push 0xffffffffffffffff
push edx
call fcn.00534500
push 0
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.00470610
push 1
lea ecx, [ebp - 0x414]
push 0
push ecx
call fcn.00470930
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x1042]
push eax
mov word [ebp - 0x1044], dx
call fcn.005336c0
add esp, 0x30
xor eax, eax
jmp 0x478070
movzx ecx, word [ebp + eax - 0xc34]
mov word [ebp + eax - 0x1044], cx
add eax, 2
test cx, cx
jne 0x478070
push str.kingsoft
lea ecx, [ebp - 0x1044]
push 0xffffffffffffffff
push ecx
call fcn.00534500
push 1
lea edx, [ebp - 0x1044]
push 0
push edx
call fcn.00470930
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.005336c0
add esp, 0x24
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ShellNew
lea eax, [ebp - 0x20c]
push 0xffffffffffffffff
push eax
call fcn.00534500
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.005336c0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x822]
push ecx
mov word [ebp - 0x824], ax
call fcn.005336c0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0xa2a]
push eax
mov word [ebp - 0xa2c], dx
call fcn.005336c0
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0xe3a]
push edx
mov word [ebp - 0xe3c], cx
call fcn.005336c0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x124a]
push ecx
mov word [ebp - 0x124c], ax
call fcn.005336c0
add esp, 0x48
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x61c], cx
add eax, 2
test cx, cx
jne 0x478180
push str._newfile.wps
lea edx, [ebp - 0x61c]
push 0xffffffffffffffff
push edx
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x824], cx
add eax, 2
test cx, cx
jne 0x4781b0
push str._newfile.et
lea eax, [ebp - 0x824]
push 0xffffffffffffffff
push eax
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0xa2c], cx
add eax, 2
test cx, cx
jne 0x4781e0
push str._newfile.dps
lea ecx, [ebp - 0xa2c]
push 0xffffffffffffffff
push ecx
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0xe3c], cx
add eax, 2
test cx, cx
jne 0x478210
push str._newfile.xlsx
lea edx, [ebp - 0xe3c]
push 0xffffffffffffffff
push edx
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x124c], cx
add eax, 2
test cx, cx
jne 0x478240
push esi
push 0x5a09a4
lea eax, [ebp - 0x124c]
push 0xffffffffffffffff
push eax
call fcn.00534500
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
call esi
lea edx, [ebp - 0x824]
push edx
call esi
lea eax, [ebp - 0xa2c]
push eax
call esi
lea ecx, [ebp - 0xe3c]
push ecx
call esi
lea edx, [ebp - 0x124c]
push edx
call esi
push 1
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00470930
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.005332ca
mov esp, ebp
pop ebp
ret