Function at 0x100523a0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x800
mov ecx, 0x100
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x1a
call fcn.100286d0
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 8
cmp eax, 1
jne 0x10052433
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x10052433
mov byte [eax + 1], 0
mov edi, str.LocalTempVisualDiscoveryr.log
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 4
push eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0x10227334
call fcn.10029940
add esp, 8
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x410]
lea edx, [esp + 0x410]
push 0x400
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10052645
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x410]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.System32VisualDiscovery.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
test eax, eax
jne 0x100524ec
push 4
lea ecx, [esp + 0x14]
push eax
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x410]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.System32VisualDiscoveryOff.ini
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
jne 0x10052574
push 4
lea ecx, [esp + 0x14]
push eax
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
mov eax, dword [esp + 0x814]
mov edi, str.:Program_FilesLenovoVisualDiscovery
or ecx, 0xffffffff
mov ebx, dword [sym.imp.MSVCRT.dll_strncmp]
lea esi, [eax + 1]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.:Program_FilesLenovoVisualDiscovery
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x100525b1
lea edx, [esp + 0x410]
mov edi, str.System32DriversVDWFP.sys
jmp 0x100525dc
mov edi, str.:Program_Files__x86_LenovoVisualDiscovery
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.:Program_Files__x86_LenovoVisualDiscovery
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x10052645
lea edx, [esp + 0x410]
mov edi, str.System32DriversVDWFP64.sys
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x410]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10052635
push 4
lea ecx, [esp + 0x414]
push eax
push ecx
call ebp
lea edx, [esp + 0x410]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x800
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x800
ret