Function at 0x10003ae2
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x10009de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x430], ecx
mov byte [ebp - 0x415], bl
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x41c], ebx
cmp eax, ebx
jne 0x10003b24
xor al, al
jmp 0x10003f80
cmp byte [eax], 0x2a
jne 0x10003b1d
push esi
push edi
push eax
call sub.msvcrt.dll_strlen
mov esi, eax
lea edi, [esi + esi + 2]
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.10001d2d
add esp, 0x10
cmp dword [ebp - 0x41c], ebx
je 0x10003bb7
push 1
call fcn.10001d3c
push edi
push ebx
push dword [ebp - 0x41c]
call sub.msvcrt.dll_memset
add esp, 0x10
cmp dword [ebp - 0x41c], ebx
je 0x10003bb7
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x42c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10003bbe
cmp dword [ebp - 0x41c], ebx
je 0x10003bb7
push ebx
call fcn.10001d3c
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
xor al, al
jmp 0x10003f7e
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
push 0xd
push dword [ebp - 0x41c]
call esi
pop ecx
pop ecx
cmp eax, ebx
je 0x10003bd9
xor ecx, ecx
mov word [eax], cx
push 0xa
push dword [ebp - 0x41c]
call esi
pop ecx
pop ecx
cmp eax, ebx
je 0x10003bee
xor ecx, ecx
mov word [eax], cx
mov cx, word [0x1000955c]
mov edx, 0x1000955c
cmp cx, bx
jge 0x10003c0c
mov eax, edx
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10003c01
mov cx, word [0x10009578]
mov edi, 0x10009578
cmp cx, bx
jge 0x10003c2a
mov eax, edi
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10003c1f
mov cx, word [0x10009588]
mov esi, 0x10009588
cmp cx, bx
jge 0x10003c48
mov eax, esi
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10003c3d
lea eax, [ebp - 0x424]
push eax
push ebx
push ebx
push ebx
push edx
push dword [ebp - 0x41c]
call fcn.10007050
add esp, 0x18
test al, al
je 0x10003d3a
cmp dword [ebp - 0x424], 3
mov byte [ebp - 0x415], 1
jne 0x10003f4a
xor eax, eax
mov esi, 0xfe
push esi
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
call sub.msvcrt.dll_memset
mov cx, word [0x1000956c]
add esp, 0xc
mov edx, 0x1000956c
cmp cx, bx
jge 0x10003cba
mov eax, edx
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10003caf
push ebx
push 0x7f
lea eax, [ebp - 0x204]
push eax
xor edi, edi
inc edi
push edi
push edx
push dword [ebp - 0x41c]
call fcn.10007050
add esp, 0x18
test al, al
je 0x10003f4a
xor eax, eax
push esi
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push 0x1000b744
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10003f4a
mov dword [ebp - 0x428], edi
jmp 0x10003f4a
lea eax, [ebp - 0x424]
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x41c]
call fcn.10007050
add esp, 0x18
test al, al
je 0x10003d7a
cmp dword [ebp - 0x424], 1
mov byte [ebp - 0x415], 1
jne 0x10003f4a
mov dword [ebp - 0x428], 2
jmp 0x10003f4a
lea eax, [ebp - 0x424]
push eax
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x41c]
call fcn.10007050
add esp, 0x18
test al, al
je 0x10003f5c
cmp dword [ebp - 0x424], 3
mov byte [ebp - 0x415], 1
jne 0x10003f4a
cmp dword [0x1000c564], 0x41c
jb 0x10003f4a
mov dx, word [0x10009598]
mov ecx, 0x10009598
cmp dx, bx
jge 0x10003ddd
mov eax, ecx
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10003dd2
push ebx
push ebx
push 1
push ecx
push dword [ebp - 0x41c]
call fcn.10007133
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x434], edi
cmp edi, ebx
je 0x10003f4a
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
push esi
mov dword [ebp - 0x420], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.10001d2d
add esp, 0x10
cmp dword [ebp - 0x420], ebx
je 0x10003f36
push 1
call fcn.10001d3c
push esi
push ebx
push dword [ebp - 0x420]
call sub.msvcrt.dll_memset
add esp, 0x10
cmp dword [ebp - 0x420], ebx
je 0x10003f36
push dword [ebp - 0x420]
push edi
call fcn.10002430
mov edi, eax
pop ecx
pop ecx
cmp edi, 0xffffffff
je 0x10003f14
xor eax, eax
push 0x20e
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, 0x1000c56c
push esi
push str._s.tmp
lea eax, [ebp - 0x414]
push 0x107
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
push ebx
push edi
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
call fcn.10006aa0
add esp, 0x2c
test al, al
je 0x10003f14
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push 0x1000c774
push esi
call edi
test eax, eax
je 0x10003f14
push 1
push esi
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x10003efd
mov dword [ebp - 0x428], 3
jmp 0x10003f14
push 1
push esi
push 0x1000c774
call edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x420], ebx
je 0x10003f30
push ebx
call fcn.10001d3c
push dword [ebp - 0x420]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov dword [ebp - 0x420], ebx
push ebx
call fcn.10001d3c
push dword [ebp - 0x434]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov eax, dword [ebp - 0x430]
cmp eax, ebx
je 0x10003f5c
mov ecx, dword [ebp - 0x428]
mov dword [eax], ecx
cmp dword [ebp - 0x41c], ebx
je 0x10003f78
push ebx
call fcn.10001d3c
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov al, byte [ebp - 0x415]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10007260
leave
ret