Function at 0x10005830
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d8
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x2d4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, 1
test edi, edi
je 0x10005942
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xc2]
push ecx
mov word [esp + 0xc4], ax
call fcn.1001a970
add esp, 0xc
push edi
lea edx, [esp + 0xbc]
push str.http:__dl.360safe.com_gf_KitTip_skin_skin__d.cab
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor edi, edi
jmp 0x100058a0
mov edx, 0x10038ca0
lea ecx, [esp + 0xb8]
call fcn.10009800
test eax, eax
jne 0x100058d0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jb 0x100058a0
push esi
push 0
push 0xe7
jmp 0x1000592e
push 0x10038ea8
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x10038ea8
push 0x100057a0
push 0
push 0x10038ca0
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
push 0x10038ca0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x100390b0
call edi
test eax, eax
je 0x10005926
push 0x100392b8
call edi
test eax, eax
je 0x10005926
push 0x100394c0
call edi
test eax, eax
jne 0x10005944
push esi
push 0
push 0xe8
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
xor ebx, ebx
mov edi, dword [0x100396d8]
imul edi, edi, 0xea60
test ebx, ebx
je 0x100059b0
cmp dword [ebp + 8], 0
je 0x100059b0
push esi
push 0
push 0xe3
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
push 0x100394c0
push 0x100392b8
push 0x100390b0
push edi
lea edi, [esp + 0x20]
call fcn.10008570
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.10009340
mov edi, eax
lea eax, [esp + 0x10]
call fcn.10008770
push esi
push 0
push 0xe4
jmp 0x100059fb
push esi
push 0
push 0xe5
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
push 0
push 0
push 0
push edi
lea edi, [esp + 0x20]
call fcn.10008570
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.10009340
mov edi, eax
lea eax, [esp + 0x10]
call fcn.10008770
push esi
push 0
push 0xe6
push 0x2dcf5a
push str.v_ds_dr_dd_d
xor ecx, ecx
call fcn.10004540
add esp, 0x14
xor ecx, ecx
push esi
push ecx
cmp edi, 1
jne 0x10005ab3
push edi
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
mov eax, 0x100396e0
add esp, 0x14
or word [esp + 0x2d4], 4
mov dword [esp + 0xbc], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005a47
sub eax, edx
sar eax, 1
je 0x10005a87
or word [esp + 0x2d4], 2
xor eax, eax
jmp 0x10005a70
movzx ecx, word [eax + 0x100396e0]
mov word [esp + eax + 0xcc], cx
add eax, 2
test cx, cx
jne 0x10005a70
call fcn.1000a250
test eax, eax
je 0x10005a9a
lea ecx, [esp + 0xb8]
push ecx
call eax
mov eax, 1
pop edi
pop ebx
mov ecx, dword [esp + 0x2d4]
xor ecx, esp
call fcn.10019069
mov esp, ebp
pop ebp
ret
cmp edi, 0x102
jne 0x10005abf
push 3
jmp 0x10005ac1
push 2
push 0x2dcf5a
push str.v_ds_dr_dd_d
call fcn.10004540
mov ecx, dword [esp + 0x2f0]
add esp, 0x14
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10019069
mov esp, ebp
pop ebp
ret