Function at 0x102f521
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x5a
xor edi, edi
push 4
mov dword [ebp - 0x418], edi
call fcn.010328f3
cmp dword [ebp + 8], edi
mov dword [ebp - 0x424], eax
mov esi, 0x104
jne 0x102f595
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102f909
push 0x1006324
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
lea eax, [ebp - 0x414]
push eax
call fcn.010326f3
test eax, eax
jne 0x102f909
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 0x41c], edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x420], 3
mov eax, dword [ebp - 0x41c]
sub eax, 0
je 0x102f611
dec eax
je 0x102f5f9
dec eax
je 0x102f5ed
dec eax
je 0x102f5e1
dec eax
jne 0x102f645
push 0x1004e00
push 0x103
lea eax, [ebp - 0x414]
push eax
call fcn.01028a67
jmp 0x102f645
push esi
lea eax, [ebp - 0x414]
push eax
push 0x79
jmp 0x102f603
push esi
lea eax, [ebp - 0x414]
push eax
push 0x75
jmp 0x102f603
push esi
lea eax, [ebp - 0x414]
push eax
push 0x74
push dword [0x1047500]
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x102f645
push esi
lea eax, [ebp - 0x414]
push eax
push 0xc
push dword [0x1047500]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push 0x10062fc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x102f645
inc dword [ebp - 0x420]
push 0x10062ec
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x418], 0x208
call fcn.01031190
test eax, eax
je 0x102f6dc
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102f6dc
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
jne 0x102f6dc
cmp dword [ebp - 0x424], 0
jne 0x102f6dc
push 0
lea eax, [ebp - 0x20c]
push eax
push 5
push 0x1000
call ebx
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x418], 0x208
call fcn.010312f0
test eax, eax
je 0x102f761
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102f761
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
jne 0x102f761
cmp dword [ebp - 0x424], 0
jne 0x102f761
push 0
lea eax, [ebp - 0x20c]
push eax
push 5
push 0x1000
call ebx
push 1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x418], 0x208
call fcn.01031190
test eax, eax
je 0x102f7e6
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102f7e6
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
jne 0x102f7e6
cmp dword [ebp - 0x424], 0
jne 0x102f7e6
push 0
lea eax, [ebp - 0x20c]
push eax
push 5
push 0x1000
call ebx
push 1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x418], 0x208
call fcn.010312f0
test eax, eax
je 0x102f86b
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102f86b
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
jne 0x102f86b
cmp dword [ebp - 0x424], 0
jne 0x102f86b
push 0
lea eax, [ebp - 0x20c]
push eax
push 5
push 0x1000
call ebx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
mov dword [ebp - 0x418], 0x208
call fcn.010310cc
test eax, eax
je 0x102f8f0
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x102f8f0
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x41c]
jne 0x102f8f0
cmp dword [ebp - 0x424], 0
jne 0x102f8f0
push 0
lea eax, [ebp - 0x20c]
push eax
push 5
push 0x1000
call ebx
inc dword [ebp - 0x41c]
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x420]
jle 0x102f5b2
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 4