Function at 0x10023810
Capabilities:
Delete file
Enumerate pe sections
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10048657
mov eax, dword fs:[0]
push eax
sub esp, 0x590
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x588], eax
push ebx
push esi
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x5a0]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x20]
push ecx
lea edx, [esp + 0x100]
xor esi, esi
push edx
mov ecx, ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], esi
call eax
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
push ebx
lea edx, [esp + 0x2c]
mov dword [ecx + 0xc], eax
call fcn.10023600
test eax, eax
je 0x100240ef
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x38]
mov dword [esp + 0x5a8], esi
mov edx, dword [ebx]
mov edx, dword [edx + 0x3c]
push eax
push ecx
mov ecx, ebx
call edx
lea eax, [esp + 0x38]
push eax
mov eax, edi
call fcn.10029f80
add esp, 4
test al, al
je 0x100238f8
mov eax, dword [esp + 0x3c]
cmp eax, esi
je 0x100238ee
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
jmp 0x100240f1
mov eax, dword [esp + 0x18]
mov esi, str.Files
call fcn.100392e0
mov edi, eax
test edi, edi
je 0x10023933
lea esp, [esp]
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
test eax, eax
jne 0x10023a6d
mov esi, str.Files
mov eax, edi
call fcn.10039330
mov edi, eax
test edi, edi
jne 0x10023910
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x18]
mov esi, str.Folders
call fcn.100392e0
mov edi, eax
test edi, edi
je 0x10023973
nop
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
test eax, eax
jne 0x10023a7f
mov esi, str.Folders
mov eax, edi
call fcn.10039330
mov edi, eax
test edi, edi
jne 0x10023950
mov dword [esp + 0x28], 0
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x34]
test edi, edi
je 0x10023997
mov eax, edi
call fcn.1000da30
test eax, eax
je 0x10023997
call fcn.10039130
test esi, esi
je 0x100239ad
mov eax, esi
call fcn.1000da30
test eax, eax
je 0x100239ad
mov edi, esi
call fcn.10039130
push 0x1ff
mov eax, 1
lea ecx, [esp + 0x111]
push 0
push ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov byte [esp + 0x118], 0
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x1c], 0
call fcn.10009bc0
test eax, eax
jbe 0x10023eea
mov dword [esp + 0x14], 0
lea ebx, [ebx]
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
mov ebx, dword [esp + 0x1c]
xor esi, esi
cmp eax, esi
je 0x10023a2b
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x10023a31
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x14]
cmp word [eax + edx], si
push 0x50
je 0x10023dd8
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, esi
mov byte [esp + 0x5a8], 1
je 0x10023a93
push eax
mov ecx, str.Folder
call fcn.10039400
mov dword [esp + 0x20], eax
jmp 0x10023a99
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov dword [esp + 0x34], eax
jmp 0x1002393b
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov esi, eax
mov dword [esp + 0x28], esi
jmp 0x1002397f
mov dword [esp + 0x20], esi
mov eax, esi
cmp eax, esi
mov byte [esp + 0x5a8], 0
je 0x100240d6
lea esi, [eax + 0x2c]
push 0x1004c3c4
mov eax, esi
mov dword [esp + 0x1c], esi
call fcn.1003a930
test eax, eax
je 0x10023acc
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, eax
call fcn.1003a140
mov eax, dword [edi + 4]
test eax, eax
je 0x10023aed
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x10023af3
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 8]
push ecx
mov edi, 0x200
lea ebx, [esp + 0x110]
call fcn.1000d740
add esp, 4
push str.Path
mov eax, esi
call fcn.1003a930
test eax, eax
je 0x10023b44
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10023b28
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x10c]
call fcn.1003cb60
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
test eax, eax
je 0x10023b6b
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x1c], eax
jb 0x10023b71
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x808]
push ecx
mov edi, 0x200
lea ebx, [esp + 0x110]
call fcn.1000d740
mov eax, dword [esp + 0x1c]
add esp, 4
push str.FileInc
call fcn.1003a930
test eax, eax
je 0x10023bd0
mov ecx, ebx
lea esi, [ecx + 1]
jmp 0x10023bb0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10023bb0
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x10c]
call fcn.1003cb60
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
test eax, eax
je 0x10023bf3
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x1c], eax
jb 0x10023bf9
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0xa10]
push ecx
mov edi, 0x200
lea ebx, [esp + 0x110]
call fcn.1000d740
mov eax, dword [esp + 0x1c]
add esp, 4
push str.FileExc
call fcn.1003a930
test eax, eax
je 0x10023c53
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10023c33
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x10c]
call fcn.1003cb60
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
test eax, eax
je 0x10023c76
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x1c], eax
jb 0x10023c7c
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0xc18]
push ecx
mov edi, 0x200
lea ebx, [esp + 0x110]
call fcn.1000d740
mov eax, dword [esp + 0x1c]
add esp, 4
push str.FolderExc
call fcn.1003a930
test eax, eax
je 0x10023cd6
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10023cb6
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x10c]
call fcn.1003cb60
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
test eax, eax
mov edi, dword [esp + 0x1c]
je 0x10023cfb
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10023d01
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
movzx ebx, word [edx + eax + 2]
mov eax, dword [esp + 0x18]
push str.NotBackupSub
call fcn.1003a930
test eax, eax
je 0x10023d27
push ebx
mov ecx, eax
call fcn.1003a140
mov eax, dword [esi + 4]
test eax, eax
je 0x10023d48
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10023d4e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
movzx ebx, word [ecx + edx + 6]
push str.NotbackupSystem
call fcn.1003a930
test eax, eax
je 0x10023d74
push ebx
mov ecx, eax
call fcn.1003a140
mov eax, dword [esi + 4]
test eax, eax
je 0x10023d95
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10023d9b
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
movzx ebx, word [eax + ecx + 4]
mov eax, dword [esp + 0x18]
push str.NotBackupHideFile
call fcn.1003a930
test eax, eax
je 0x10023dc1
push ebx
mov ecx, eax
call fcn.1003a140
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
call fcn.10039160
add dword [esp + 0x30], 1
jmp 0x10023ec8
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, esi
mov byte [esp + 0x5a8], 2
je 0x10023e01
push eax
mov ecx, str.File
call fcn.10039400
mov dword [esp + 0x20], eax
jmp 0x10023e07
mov dword [esp + 0x20], esi
mov eax, esi
cmp eax, esi
mov byte [esp + 0x5a8], 0
je 0x100240d6
lea esi, [eax + 0x2c]
push 0x1004c3c4
mov eax, esi
call fcn.1003a930
test eax, eax
je 0x10023e36
mov edx, dword [esp + 0x2c]
push edx
mov ecx, eax
call fcn.1003a140
mov eax, dword [edi + 4]
test eax, eax
je 0x10023e57
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x10023e5d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ecx + 8]
push edx
mov edi, 0x200
lea ebx, [esp + 0x110]
call fcn.1000d740
add esp, 4
push str.Path
mov eax, esi
call fcn.1003a930
test eax, eax
je 0x10023eae
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10023e92
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x10c]
call fcn.1003cb60
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
call fcn.10039160
add dword [esp + 0x2c], 1
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
add dword [esp + 0x14], 0xe20
add edi, 1
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.10009bc0
cmp edi, eax
jb 0x10023a00
mov ebx, dword [esp + 0x48]
push 0x7e
lea eax, [esp + 0x312]
push 0
push eax
mov word [esp + 0x318], 0
call sub.MSVCR80.dll_memset
mov edi, dword [ebp + 8]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
add esp, 0xc
push edi
lea eax, [esp + 0x50]
push eax
mov ecx, ebx
call edx
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x20]
push edi
lea ecx, [esp + 0x80]
push ecx
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xf]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xe4]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xe]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xa8]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xd]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xfc]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xd0]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xb]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0x74]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 0xa]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0x88]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 9]
mov edx, dword [ebx]
push eax
push edi
mov edx, dword [edx + 0x20]
lea eax, [esp + 0xac]
push eax
mov ecx, ebx
call edx
movzx eax, byte [eax + 8]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xd0]
push eax
mov ecx, ebx
call edx
movzx eax, word [eax + 6]
mov edx, dword [ebx]
mov edx, dword [edx + 0x20]
push eax
push edi
lea eax, [esp + 0xf4]
push eax
mov ecx, ebx
call edx
movzx eax, word [eax + 4]
mov ecx, dword [esi]
push eax
push ecx
lea edx, [esp + 0x338]
push 0x1004b2f0
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
push 0x206
lea eax, [esp + 0x392]
push 0
push eax
mov word [esp + 0x398], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x38c]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.AomeiBR
lea edx, [esp + 0x390]
push edx
call esi
lea eax, [esp + 0x30c]
push eax
lea ecx, [esp + 0x390]
push ecx
call esi
push str..meta
lea edx, [esp + 0x390]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx + 0x24]
mov eax, dword [edi + 0x20]
add eax, 8
call fcn.10039d90
test al, al
je 0x100240de
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
mov ecx, ebx
call eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100238ee
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
jmp 0x100240f1
mov eax, dword [esp + 0x3c]
cmp eax, esi
jmp 0x100240e4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100240ef
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x5a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x588]
xor ecx, esp
call fcn.10045f6c
mov esp, ebp
pop ebp
ret 8