Function at 0x10022ae0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x100816f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x100834f0]
mov esi, dword [ebp + 8]
test ecx, ecx
jne 0x10022b67
push 0x10080004
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100834f0], 0
jne 0x10022b56
push 0x14
call fcn.1002bae2
add esp, 4
test eax, eax
je 0x10022b48
mov ecx, eax
call fcn.10019e40
mov ecx, eax
jmp 0x10022b4a
xor ecx, ecx
xchg dword [ebp - 0x8ac], eax
mov dword [0x100834f0], ecx
push 0x10080004
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100834f0]
call fcn.1001a190
test eax, eax
je 0x10022fd6
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x8a4], 0
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x888], eax
mov dword [ebp - method.CTaskbarProcess.virtual_0], vtable.CTaskbarProcess.0
mov dword [ebp - method.LdsCommon::CCommandLine.virtual_0], vtable.LdsCommon::CCommandLine.0
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], 0
call fcn.10022320
mov dword [ebp - 0x87c], eax
lea ecx, [ebp - 0x800]
xor eax, eax
mov dword [ebp - 0x854], 0
mov word [ebp - 0x864], ax
xorps xmm0, xmm0
mov dword [ebp - 0x83c], eax
mov word [ebp - 0x84c], ax
mov dword [ebp - 0x824], eax
mov word [ebp - 0x834], ax
mov dword [ebp - 0x80c], eax
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x708]
push eax
movups xmmword [ebp - 0x874], xmm0
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x838], 7
mov dword [ebp - 0x820], 7
mov dword [ebp - 0x808], 7
call fcn.1001ecf0
lea ecx, [ebp - 0x708]
call fcn.10007890
push 0x78
call fcn.1002bae2
add esp, 4
test eax, eax
je 0x10022c80
mov ecx, eax
call fcn.1001b190
jmp 0x10022c82
xor eax, eax
push dword [ebp - 0x8ac]
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
mov dword [ebp - 0x62c], 0
call fcn.100073f0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
lea ecx, [ebp - 0x8a8]
call fcn.10021820
test eax, eax
jne 0x10022ccf
push str.parse_params_failed.
call fcn.100133d0
jmp 0x10022e23
push esi
lea ecx, [ebp - 0x8a8]
call fcn.10021b60
test eax, eax
je 0x10022e26
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xorps xmm0, xmm0
mov dword [ebp - 0x8f0], 0x100672dc
mov ebx, 1
movups xmmword [ebp - 0x8ec], xmm0
mov dword [ebp - 0x8dc], 0
xor esi, esi
mov dword [ebp - 0x8d8], 0
test ebx, ebx
je 0x10022d4c
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8d4]
push eax
call edi
test eax, eax
jne 0x10022d4c
mov eax, dword [ebp - 0x8f0]
lea ecx, [ebp - 0x8f0]
push esi
call dword [eax + 4]
inc esi
test eax, eax
jne 0x10022d20
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x10022d18
test eax, eax
je 0x10022de2
lea eax, [ebp - 0x8d4]
push eax
mov eax, dword [ebp - 0x8f0]
lea ecx, [ebp - 0x8f0]
call dword [eax]
test eax, eax
jne 0x10022d9b
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x8d0]
cmp eax, 0x118
ja 0x10022db6
je 0x10022dd2
cmp eax, 0xf
je 0x10022dd2
cmp eax, 0xa0
jmp 0x10022dbb
cmp eax, 0x200
je 0x10022dd2
mov ecx, 1
xor eax, eax
test ecx, ecx
mov ebx, ecx
cmove eax, esi
mov esi, eax
jmp 0x10022d18
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmove eax, esi
mov esi, eax
jmp 0x10022d18
mov eax, dword [ebp - 0x8e0]
test eax, eax
je 0x10022dff
push eax
call fcn.1003ca8a
add esp, 4
mov dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8dc], 0
mov dword [ebp - 0x8d8], 0
test eax, eax
je 0x10022e26
push eax
call fcn.1003ca8a
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10037240
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push str.RunDll.exe
push esi
call fcn.10044457
add esp, 8
test eax, eax
je 0x10022fcb
push str.32.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x10022fcb
push 0x10063ea4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x10022ec4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebp - 0x8b4], eax
call esi
mov dword [ebp - 0x8b0], eax
jmp 0x10022eca
mov eax, dword [ebp - 0x8b0]
mov ecx, dword [ebp - 0x8b4]
test ecx, ecx
je 0x10022ee1
test eax, eax
je 0x10022ee1
lea eax, [ebp - 0x8b8]
push eax
call ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
cmp dword [ebp - 0x8b4], 0
mov dword [ebp - 4], 0
je 0x10022f12
mov ecx, dword [ebp - 0x8b0]
test ecx, ecx
je 0x10022f12
push dword [ebp - 0x8b8]
call ecx
test esi, esi
je 0x10022fcb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10022fcb
push 0x208
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.10037240
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10037240
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.100445cc
add esi, eax
lea eax, [ebp - 0x628]
push esi
push eax
push str._slds__u.tmp
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.10012a00
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x420]
add esp, 0x14
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call esi
push 4
test eax, eax
lea eax, [ebp - 0x420]
push 0
jne 0x10022fc8
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x8a8]
call fcn.10021180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002be91
mov esp, ebp
pop ebp
ret 4