Function at 0x401b7e
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x934
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x41f]
mov byte [ebp - 0x420], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x31b]
mov byte [ebp - 0x31c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x523]
mov byte [ebp - 0x524], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push esi
push eax
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x524]
push eax
call edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 0x10
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x420]
push 0x405358
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x31c]
push eax
call edi
lea eax, [ebp - 0x114]
push esi
push eax
push reloc.KERNEL32.dll_GetFileAttributesA
push dword [0x405768]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401c82
lea eax, [ebp - 0x114]
push str.WebEx_Player
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x31c]
push eax
call edi
lea eax, [ebp - 0x31c]
push str..LNK
push eax
call edi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x4041c0
push 1
push ebx
push 0x4041b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x401e54
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x4041d0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edx, eax
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x932]
mov word [ebp - 0x934], bx
cmp edx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jl 0x401e4b
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x934]
push 0x208
push eax
lea eax, [ebp - 0x31c]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call edi
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x934]
push ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push 6
push ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push esi
push edx
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x10], ebx
jne 0x401d70
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401d70
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push esi
push eax
push GetFileAttributesA
push dword [0x405768]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401db3
lea eax, [ebp - 0x114]
push str.WebEx_Recorder
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x31c]
push str..LNK
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x934]
push 0x208
push eax
lea eax, [ebp - 0x31c]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call edi
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x934]
push ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov edi, eax
mov eax, dword [ebp - 4]
push 6
push ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push esi
push edx
push eax
call dword [ecx + 0xc]
cmp edi, ebx
jne 0x401e42
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401e42
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret