Function at 0x48ccd0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fee8
mov eax, dword fs:[0]
push eax
sub esp, 0xe3c
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xc3e]
push ecx
mov dword [ebp - 4], 0
mov word [ebp - 0xc40], ax
call fcn.005336c0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 0
push 2
lea edx, [ebp - 0xc40]
push edx
push 0
call esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.005336c0
add esp, 0xc
xor eax, eax
jmp 0x48cd60
movzx ecx, word [ebp + eax - 0xc40]
mov word [ebp + eax - 0x218], cx
add eax, 2
test cx, cx
jne 0x48cd60
push 0x592324
lea edx, [ebp - 0x218]
push 0xffffffffffffffff
push edx
call fcn.00534500
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push 0xffffffffffffffff
push ecx
call fcn.00534500
push 1
lea edx, [ebp - 0x218]
push 1
push edx
call fcn.00470610
add esp, 0x24
xor eax, eax
jmp 0x48cdc0
movzx ecx, word [ebp + eax - 0xc40]
mov word [ebp + eax - 0x218], cx
add eax, 2
test cx, cx
jne 0x48cdc0
push 0x5a0d0c
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push eax
call fcn.00534500
push 1
lea ecx, [ebp - 0x218]
push 1
push ecx
call fcn.00470610
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x41e]
push eax
mov word [ebp - 0x420], dx
call fcn.005336c0
add esp, 0x24
push 0
push 0x10
lea ecx, [ebp - 0x420]
push ecx
push 0
call esi
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x626]
push eax
mov word [ebp - 0x628], dx
call fcn.005336c0
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x82e]
push edx
mov word [ebp - 0x830], cx
call fcn.005336c0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xa36]
push ecx
mov word [ebp - 0xa38], ax
call fcn.005336c0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0xe46]
push eax
mov word [ebp - 0xe48], dx
call fcn.005336c0
add esp, 0x30
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0x420]
mov word [ebp + eax - 0x628], cx
add eax, 2
test cx, cx
jne 0x48cea0
push str.WPS
lea ecx, [ebp - 0x628]
push 0xffffffffffffffff
push ecx
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x420]
mov word [ebp + eax - 0x830], cx
add eax, 2
test cx, cx
jne 0x48ced0
push 0x5a0cdc
lea edx, [ebp - 0x830]
push 0xffffffffffffffff
push edx
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x420]
mov word [ebp + eax - 0xa38], cx
add eax, 2
test cx, cx
jne 0x48cf00
push 0x5a0cc4
lea eax, [ebp - 0xa38]
push 0xffffffffffffffff
push eax
call fcn.00534500
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x420]
mov word [ebp + eax - 0xe48], cx
add eax, 2
test cx, cx
jne 0x48cf30
push 0x5a5ba0
lea ecx, [ebp - 0xe48]
push 0xffffffffffffffff
push ecx
call fcn.00534500
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea edx, [ebp - 0x628]
push edx
call esi
lea eax, [ebp - 0x830]
push eax
call esi
lea ecx, [ebp - 0xa38]
push ecx
call esi
lea edx, [ebp - 0xe48]
push edx
call esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cfae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret