Function at 0x1032bfb
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
call fcn.01031307
mov esi, eax
cmp esi, ebx
jge 0x1032c34
push esi
push 0xcf
jmp 0x1033027
mov eax, dword [ebp - 8]
cmp dword [eax + 0x84], ebx
je 0x103303b
cmp dword [ebp + 8], ebx
je 0x1032c7f
mov eax, dword [0x104e188]
mov eax, dword [eax + 0xa4]
cmp eax, ebx
je 0x103303b
cmp eax, 0x1d
je 0x103303b
cmp eax, 0x1f
je 0x103303b
cmp eax, 0x20
je 0x103303b
cmp eax, 0x17
je 0x103303b
call fcn.010326e0
mov esi, eax
cmp esi, ebx
jge 0x1032c95
push esi
push 0xe8
jmp 0x1033027
cmp esi, 1
jne 0x1032cbf
mov ecx, dword [0x104e188]
xor esi, esi
call fcn.010320aa
test eax, eax
je 0x103303b
mov esi, 0x80004005
push esi
push 0xf2
jmp 0x1033027
mov edi, 0x208
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1032cee
mov esi, 0x8007000e
push esi
push 0xfb
jmp 0x1033027
xor eax, eax
push edi
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
xor edi, edi
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x1032d17
mov esi, 0x8007000e
push esi
push 0xfe
jmp 0x1033027
mov eax, dword [0x104e188]
cmp dword [eax + 0x20], edi
je 0x1032d2a
mov dword [ebp + 8], 1
jmp 0x1032d33
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov dword [ebp + 8], eax
push dword [0x104e198]
push 0x104
push ebx
call fcn.0100d999
mov esi, eax
cmp esi, edi
jge 0x1032d55
push esi
push 0x105
jmp 0x1033027
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1032d5a
sub eax, edx
sar eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], edi
jbe 0x1032f6c
cmp dword [ebp - 0xc], 0
je 0x1032d87
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x80], edi
mov eax, dword [eax + 0x78]
mov ebx, edi
shl ebx, 2
mov eax, dword [eax + ebx]
mov esi, dword [eax + 0x10]
test esi, esi
je 0x1032f5f
mov eax, dword [ebp - 8]
mov dword [eax + 0x80], edi
mov eax, dword [eax + 0x78]
mov ecx, dword [ebx + eax]
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x1032f5f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
lea eax, [eax + ecx*2]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x58]
mov esi, eax
test esi, esi
jl 0x1032f96
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0102fab2
mov esi, eax
test esi, esi
jl 0x1032fa1
mov eax, dword [ebp - 8]
mov dword [eax + 0x80], edi
mov eax, dword [eax + 0x78]
mov ecx, dword [ebx + eax]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1032e13
sub eax, ecx
sar eax, 1
cmp eax, 0x20
mov eax, dword [ebp - 8]
mov dword [eax + 0x80], edi
mov eax, dword [eax + 0x78]
mov ecx, dword [ebx + eax]
jbe 0x1032e88
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ecx]
call dword [eax + 4]
push eax
call fcn.01013fc3
mov esi, eax
test esi, esi
jl 0x1032fa9
mov eax, dword [0x104e188]
push dword [eax + 0xb4]
push dword [ebp - 0x18]
push dword [0x104e198]
push 0x1008dcc
push 0x104
push dword [ebp - 0x10]
call fcn.0100dd8e
mov esi, eax
add esp, 0x18
test esi, esi
jge 0x1032ebe
push esi
push 0x12c
jmp 0x1033027
mov eax, dword [0x104e188]
push dword [eax + 0xb4]
mov eax, dword [ecx]
call dword [eax + 4]
push eax
push dword [0x104e198]
push 0x1008d9c
push 0x104
push dword [ebp - 0x10]
call fcn.0100dd8e
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x1032fb1
mov ecx, dword [ebp - 0x1c]
push 0x1008d7c
push 0x104
push dword [ebp - 4]
xor eax, eax
mov word [ecx], ax
call fcn.01014151
mov esi, eax
test esi, esi
jl 0x1032fb9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1032f19
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1032f0f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x1032fc1
mov ecx, dword [ebp - 0x1c]
push 0x10059d8
push 0x104
push dword [ebp - 4]
xor eax, eax
mov word [ecx], ax
call fcn.01014151
mov esi, eax
test esi, esi
jl 0x1032fc9
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov dword [eax + 0x80], edi
mov eax, dword [eax + 0x78]
mov ebx, dword [ebx + eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0103516f
mov esi, eax
test esi, esi
jl 0x1032fd1
inc edi
cmp edi, dword [ebp + 8]
jb 0x1032d74
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
push 0x10059d8
push 0x104
xor eax, eax
push ebx
mov word [ebx + ecx*2], ax
call fcn.01014151
mov esi, eax
test esi, esi
jge 0x1032fd9
push esi
push 0x157
jmp 0x1033027
push esi
push 0x115
jmp 0x1033027
push esi
push 0x11b
jmp 0x1033027
push esi
push 0x123
jmp 0x1033027
push esi
push 0x135
jmp 0x1033027
push esi
push 0x13b
jmp 0x1033027
push esi
push 0x140
jmp 0x1033027
push esi
push 0x148
jmp 0x1033027
push esi
push 0x151
jmp 0x1033027
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x14]
call fcn.01035266
mov esi, eax
test esi, esi
jge 0x1032ff3
push esi
push 0x15a
jmp 0x1033027
mov ecx, dword [0x104e188]
push ebx
call fcn.0101c317
and dword [ebp - 4], 0
call fcn.010329fe
mov esi, eax
test esi, esi
jge 0x1033016
push esi
push 0x163
jmp 0x1033027
call fcn.010320cf
mov esi, eax
test esi, esi
jge 0x103303b
push esi
push 0x169
push 0x1008d64
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x103304d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xc], ebx
je 0x103305e
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0xc], ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], ebx
je 0x1033076
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [ebp - 4], ebx
je 0x1033088
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8