Function at 0x100063f0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x620], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10053edc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10053974]
cmp eax, dword [ecx + 4]
jg 0x1000668e
mov eax, dword [0x10053970]
push ebx
push esi
push edi
test eax, eax
je 0x10006445
mov eax, dword [eax]
test eax, eax
je 0x10006445
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x10006640
lea eax, [esp + 0x21c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x10006640
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1000649c
lea eax, [esp + 0x21c]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x100066c4
jmp 0x1000649e
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x100066c4
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x100064d6
push str.jawshtml.html
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.10031690
mov dword [esi], eax
jmp 0x100064d8
xor esi, esi
mov dword [esp + 0xc], esi
test esi, esi
je 0x100066c4
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x10006534
mov eax, dword [esi]
test eax, eax
je 0x10006512
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10006529
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10006540
mov eax, dword [esi]
jmp 0x10006542
xor eax, eax
push 0x1003ff2c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov edi, eax
push edi
push 0x1003ff30
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
add esp, 0x14
mov word [esp + 0x14], ax
mov word [esp + 0x424], ax
test esi, esi
je 0x1000657d
mov eax, dword [esi]
jmp 0x1000657f
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x428]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x100065ee
lea ecx, [esp + 0x14]
xor edx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100065a1
mov ax, word [esp + 0x14]
sub ecx, edi
sar ecx, 1
test ax, ax
je 0x100065d3
movzx edi, ax
nop dword [eax]
cmp di, 0x20
jne 0x100065d3
movzx eax, word [esp + edx*2 + 0x16]
inc edx
mov edi, eax
test ax, ax
jne 0x100065c0
cmp ecx, edx
jle 0x100065ee
lea eax, [esp + ecx*2 + 0x12]
nop dword [eax + eax]
cmp word [eax], 0x20
jne 0x1000665d
dec ecx
sub eax, 2
cmp ecx, edx
jg 0x100065e0
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
add esp, 4
test esi, esi
je 0x10006640
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10006640
mov eax, dword [esi]
test eax, eax
je 0x1000661e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10006635
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov ecx, dword [esp + 0x62c]
mov eax, 0x10053970
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x624
ret
cmp ecx, edx
jle 0x100065ee
add ecx, ecx
cmp ecx, 0x208
jae 0x10006689
xor eax, eax
mov word [esp + ecx + 0x14], ax
lea eax, [esp + 0x14]
lea eax, [eax + edx*2]
mov ecx, 0x10053970
push eax
call fcn.10006100
jmp 0x100065ee
call fcn.10031690
push 0x10053974
call fcn.10031690
add esp, 4
cmp dword [0x10053974], 0xffffffff
jne 0x10006424
push 0x1003d240
call fcn.10031690
push 0x10053974
call fcn.10031690
add esp, 8
jmp 0x10006424
push 0x8007000e
call fcn.10031690
int3