Function at 0x10075050
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10173026
mov eax, dword fs:[0]
push eax
sub esp, 0x890
mov eax, dword [0x101bd92c]
xor eax, esp
mov dword [esp + 0x888], eax
push ebx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, esp
push eax
lea eax, [esp + 0x8a0]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
push 0x206
push eax
mov word [esp + 0x48c], ax
lea eax, [esp + 0x48e]
push eax
mov dword [ebx + 0x14], 0
call fcn.10098090
add esp, 0xc
xor eax, eax
xorps xmm0, xmm0
push 0xb
push str.1.0.3.10151
lea ecx, [esp + 0x24]
mov word [esp + 0x54], ax
movq qword [esp + 0x56], xmm0
movq qword [esp + 0x5e], xmm0
movq qword [esp + 0x66], xmm0
movq qword [esp + 0x6e], xmm0
mov dword [esp + 0x76], eax
mov word [esp + 0x7a], ax
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], eax
mov byte [esp + 0x24], al
call fcn.10004550
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x8b0], 0
call fcn.1000e340
add esp, 8
mov byte [esp + 0x8a8], 2
cmp dword [esp + 0x30], 0x10
jb 0x1007513c
push dword [esp + 0x1c]
call fcn.10091747
add esp, 4
cmp dword [esp + 0x48], 8
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x50]
push 0x10192050
push eax
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.10091da4
add esp, 0xc
xor ecx, ecx
jmp 0x10075180
movzx eax, word [ecx + str.__smartcloud__]
mov word [esp + ecx + 0x484], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10075180
lea edx, [esp + 0x4c]
mov esi, edx
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100751a0
lea edi, [esp + 0x484]
sub edx, esi
add edi, 0xfffffffe
jmp 0x100751c0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100751c0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x484]
push eax
mov ecx, edx
push 1
and ecx, 3
push 0xf001f
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x100754c0
lea eax, [esp + 0x484]
push eax
push 0x5d28
xor esi, esi
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x1007548b
push 0x206
push eax
mov word [esp + 0x694], ax
lea eax, [esp + 0x696]
push eax
call fcn.10098090
xor eax, eax
push 0x206
push eax
mov word [esp + 0x290], ax
lea eax, [esp + 0x292]
push eax
call fcn.10098090
xor eax, eax
push 0x206
push eax
mov word [esp + 0x94], ax
lea eax, [esp + 0x96]
push eax
call fcn.10098090
add esp, 0x24
lea eax, [esp + 0x68c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x4c]
push eax
push 0x101917fc
push 0x101917dc
lea eax, [esp + 0x698]
push eax
lea eax, [esp + 0x28c]
push str._s_s_s_s
push eax
call fcn.10091da4
add esp, 0x18
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + str.__smartcloud__]
mov word [esp + ecx + 0x74], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100752c0
lea ecx, [esp + 0x74]
add ecx, 0xfffffffe
jmp 0x100752e0
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x100752e0
mov eax, dword [str.TEMP__]
mov dword [ecx], eax
mov eax, dword [0x1019b3e8]
mov dword [ecx + 4], eax
mov eax, dword [0x1019b3ec]
mov dword [ecx + 8], eax
mov ax, word [0x1019b3f0]
lea edx, [esp + 0x4c]
mov word [ecx + 0xc], ax
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10075313
lea edi, [esp + 0x74]
sub edx, esi
add edi, 0xfffffffe
jmp 0x10075330
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10075330
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x74]
mov ecx, edx
push eax
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0xf001f
mov dword [ebx + 0x14], 1
call esi
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x10075487
lea eax, [esp + 0x74]
push eax
push 1
push 6
call esi
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x10075487
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push 0x80
push 4
push eax
push 3
push 0x10000000
lea eax, [esp + 0x294]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x100754ee
lea eax, [esp + 0x74]
push eax
push 0x5d28
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x10075480
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x50]
push eax
push 0x101917fc
push 0x101917dc
lea eax, [esp + 0x69c]
push eax
lea eax, [esp + 0x290]
push str._s_s_s_s_d
push eax
call fcn.10091da4
add esp, 0x1c
lea eax, [esp + 0x27c]
push 0
push 0x80
push 4
push 0
push 3
push 0x10000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x100754ee
push dword [esp + 0x18]
lea eax, [esp + 0x50]
push eax
push str.__smartcloud__
lea eax, [esp + 0x80]
push str._s_s_d
push eax
call fcn.10091da4
add esp, 0x14
lea eax, [esp + 0x74]
push eax
push 0x5d28
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 5
mov dword [ebx + 0xc], eax
push 0
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x100754d7
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x100754c7
mov dword [ebx + 0x28], eax
test esi, esi
jne 0x100754b9
mov ecx, eax
call fcn.10072b20
mov esi, 1
jmp 0x100754f0
mov esi, 1
jmp 0x1007548b
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 0xc], 0
push 0x5d28
call fcn.10092352
add esp, 4
mov ecx, eax
mov dword [ebx + 0x28], eax
call fcn.10072b20
xor esi, esi
cmp dword [esp + 0x48], 8
jb 0x10075503
push dword [esp + 0x34]
call fcn.10091747
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x8a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x888]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret