Function at 0x100065f0
Capabilities:
Check if file exists
Delete file
Delete registry key
Get file attributes
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1003b94f
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x10047330]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10047330]
xor eax, esp
push eax
lea eax, [esp + 0x320]
mov dword fs:[0], eax
push 0xb
xor ebx, ebx
mov esi, 0xf
push str.auditConfig
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.10001ab0
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x32c], ebx
call fcn.10004530
add esp, 4
mov edi, 0x10
mov byte [esp + 0x328], 2
cmp dword [esp + 0x60], edi
jb 0x10006689
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.1002362f
add esp, 4
push 0xe
push str.localCacheDays
lea ecx, [esp + 0x30]
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.10001ab0
push 7
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0x334], 3
call fcn.100041b0
add esp, 0xc
mov ebp, eax
mov byte [esp + 0x328], 2
mov dword [esp + 0x44], ebp
cmp dword [esp + 0x40], edi
jb 0x100066f1
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.1002362f
add esp, 4
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp ebp, 7
je 0x10006710
push ebp
push str.local_audit_cache_days:__d
call fcn.10020e66
add esp, 8
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x44]
imul eax, eax, 0xfffeae80
push ebx
cdq
push 0x989680
push edx
push eax
call fcn.10030880
add dword [esp + 0x18], eax
lea eax, [esp + 0x18]
adc dword [esp + 0x1c], edx
lea edx, [esp + 0x6c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [esp + 0x72]
movzx edx, word [esp + 0x6e]
movzx eax, word [esp + 0x6c]
push ecx
push edx
push eax
push str._04d__02d__02d
lea esi, [esp + 0x108]
call fcn.1001f368
add esp, 0x10
lea ebx, [esp + 0xbc]
mov byte [esp + 0x328], 4
call fcn.100034e0
mov byte [esp + 0x328], 5
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0xbc]
mov ecx, dword [eax]
mov esi, edx
mov ebp, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
test esi, esi
je 0x100067cb
cmp esi, dword [esp + 0x20]
je 0x100067d0
call fcn.100235f5
cmp ebp, dword [esp + 0x24]
je 0x100068cd
test esi, esi
jne 0x10006844
call fcn.100235f5
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x100067ef
call fcn.100235f5
cmp dword [esp + 0x110], 8
mov eax, dword [esp + 0xfc]
lea ebx, [ebp + 0xc]
jae 0x1000680a
lea eax, [esp + 0xfc]
mov edi, dword [esp + 0x10c]
push eax
mov eax, dword [ebx + 0x14]
mov ecx, ebx
call fcn.1000acf0
test eax, eax
jge 0x100068b7
test esi, esi
jne 0x10006848
call fcn.100235f5
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x10006839
call fcn.100235f5
cmp dword [ebx + 0x18], 8
jb 0x1000684c
mov eax, dword [ebx + 4]
jmp 0x1000684f
mov eax, dword [esi]
jmp 0x100067e5
mov eax, dword [esi]
jmp 0x1000682f
lea eax, [ebx + 4]
push eax
push 0x1003ec9c
call fcn.10020fc4
add esp, 8
test esi, esi
jne 0x10006891
call fcn.100235f5
cmp ebp, dword [esi + 0x18]
jne 0x10006870
call fcn.100235f5
push ebx
push str.Softwareprojonepodlp_rptcache_rptstore_
lea edi, [esp + 0x50]
call fcn.1000ab60
mov esi, 8
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x10006895
mov eax, dword [eax + 4]
jmp 0x10006898
mov esi, dword [esi]
jmp 0x10006866
add eax, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x60], esi
jb 0x100068b7
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.1002362f
add esp, 4
lea esi, [esp + 0x18]
call fcn.10002670
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x100067c1
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x11e]
push eax
mov word [esp + 0x120], dx
call fcn.10025820
add esp, 0xc
lea ecx, [esp + 0x114]
call fcn.10021b5b
test eax, eax
je 0x10006bf9
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.1001e6dd
add esp, 8
mov byte [esp + 0x328], 6
mov esi, dword [esp + 0x34]
cmp esi, dword [esp + 0x38]
jbe 0x1000692d
call fcn.100235f5
mov ebp, dword [esp + 0x28]
lea ebx, [esi + 4]
mov esi, dword [esp + 0x38]
cmp dword [esp + 0x34], esi
jbe 0x10006943
call fcn.100235f5
test ebp, ebp
je 0x1000694d
cmp ebp, dword [esp + 0x28]
je 0x10006952
call fcn.100235f5
lea edi, [ebx - 4]
cmp edi, esi
je 0x10006b92
xor eax, eax
mov word [esp + 0x7c], ax
mov dword [esp + 0x7e], eax
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov word [esp + 0x8a], ax
test ebp, ebp
jne 0x1000699d
call fcn.100235f5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10006993
call fcn.100235f5
cmp dword [ebx + 0x14], 8
jb 0x100069a2
mov ecx, dword [ebx]
jmp 0x100069a4
mov eax, dword [ebp]
jmp 0x10006989
mov ecx, ebx
xor eax, eax
lea edx, [esp + 0x48]
push edx
push eax
push ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10006b70
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0xb4]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x10006b70
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xa8], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x98], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x78]
push edx
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0xa8], ecx
call esi
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0xa8]
push edx
call esi
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x90]
push 0
push 0x2710
push ecx
push eax
call fcn.100385c0
mov esi, eax
mov eax, dword [esp + 0x44]
imul eax, eax, 0x5265c00
mov ecx, edx
cdq
cmp ecx, edx
jl 0x10006b70
jg 0x10006aea
cmp esi, eax
jbe 0x10006b70
test ebp, ebp
jne 0x10006b09
call fcn.100235f5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10006aff
call fcn.100235f5
cmp dword [ebx + 0x14], 8
jb 0x10006b0e
mov eax, dword [ebx]
jmp 0x10006b10
mov eax, dword [ebp]
jmp 0x10006af5
mov eax, ebx
push eax
push str.cacheable_attachment_expired__delete_it:__s
call fcn.10020e66
add esp, 8
test ebp, ebp
jne 0x10006b3d
call fcn.100235f5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10006b33
call fcn.100235f5
cmp dword [ebx + 0x14], 8
jb 0x10006b42
mov esi, dword [ebx]
jmp 0x10006b44
mov eax, dword [ebp]
jmp 0x10006b29
mov esi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10006b5a
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10006b70
test al, 1
je 0x10006b69
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
jne 0x10006b8d
call fcn.100235f5
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x10006b85
call fcn.100235f5
add ebx, 0x1c
jmp 0x10006934
mov eax, dword [ebp]
jmp 0x10006b7b
mov esi, dword [esp + 0x34]
test esi, esi
je 0x10006bde
mov edi, dword [esp + 0x38]
cmp esi, edi
je 0x10006bd1
add esi, 0x18
xor ebx, ebx
cmp dword [esi], 8
jb 0x10006bb8
mov eax, dword [esi - 0x14]
push eax
call fcn.1002362f
add esp, 4
xor edx, edx
mov dword [esi], 7
mov dword [esi - 4], ebx
mov word [esi - 0x14], dx
add esi, 0x1c
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x10006ba7
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1002362f
add esp, 4
mov edx, dword [esp + 0x28]
xor eax, eax
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.1002362f
add esp, 4
mov ebx, 7
lea esi, [esp + 0xbc]
mov byte [esp + 0x328], bl
call fcn.10007f60
mov eax, dword [esp + 0xbc]
push eax
call fcn.1002362f
add esp, 4
cmp dword [esp + 0x110], 8
jb 0x10006c3b
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.1002362f
add esp, 4
xor edx, edx
lea esi, [esp + 0xdc]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x10c], 0
mov word [esp + 0xfc], dx
mov dword [esp + 0x328], 0xffffffff
call fcn.10014aaf
mov ecx, dword [esp + 0x320]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.100232be
add esp, 0x318
ret