Function at 0x1006d290
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x274
push ebx
push esi
push edi
push 0x1004
push 1
mov dword [ebp - 0x24], edx
mov ebx, ecx
call fcn.10089fce
mov esi, eax
add esp, 8
test esi, esi
je 0x1006d316
lea edx, [ebp - 0x27c]
mov ecx, ebx
call fcn.1004d830
mov dword [esi + 0x1000], eax
cmp eax, 0xffffffff
jne 0x1006d2ee
push esi
call fcn.10086818
add esp, 4
jmp 0x1006d316
push ebx
push 0x800
push esi
call fcn.10086dbb
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x27c]
mov ecx, ebx
call fcn.10065470
cmp esi, 0xffffffff
jne 0x1006d32e
lea edx, [ebp - 0x27c]
mov ecx, ebx
call fcn.10065560
mov esi, eax
cmp esi, 0xffffffff
je 0x1006d3b4
lea ecx, [ebp - 0x270]
call fcn.1004c7a0
lea ecx, [ebp - 0x278]
call fcn.1004c7a0
lea ecx, [ebp - 0x268]
call fcn.1004c7a0
test esi, esi
je 0x1006d36e
mov eax, dword [esi + 0x1000]
cmp eax, 0xffffffff
je 0x1006d365
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.10086818
add esp, 4
push 0x104
push ebx
lea ecx, [ebp - 0x1c]
call fcn.1004d280
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1006d385
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1006d3a5
push ecx
call fcn.10086818
add esp, 4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1006d533
push 0x104
push ebx
lea ecx, [ebp - 0x1c]
call fcn.1004d280
cmp byte [ebp - 0x12], 0
mov esi, dword [ebp - 0x18]
je 0x1006d3dc
test esi, esi
je 0x1006d3e2
push esi
call fcn.10086818
add esp, 4
xor esi, esi
jmp 0x1006d3e2
mov edi, esi
test esi, esi
jne 0x1006d3e5
mov edi, dword [ebp - 0x1c]
push 0x104
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call fcn.1004d280
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1006d3fe
mov ecx, dword [eax]
push 9
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1006d428
push ecx
call fcn.10086818
add esp, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
test esi, esi
je 0x1006d43c
push esi
call fcn.10086818
add esp, 4
mov dword [ebp - 4], 0xffffffff
test edi, edi
jne 0x1006d5d2
push 0x104
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call fcn.1004d280
mov esi, dword [ebp - 0x18]
mov eax, esi
test esi, esi
jne 0x1006d467
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 3
test esi, esi
je 0x1006d49c
push esi
call fcn.10086818
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
jne 0x1006d4be
mov eax, 0xa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push ebx
lea ecx, [ebp - 0x1c]
call fcn.1004d280
cmp byte [ebp - 0x12], 0
mov esi, dword [ebp - 0x18]
je 0x1006d4e6
test esi, esi
je 0x1006d4ec
push esi
call fcn.10086818
add esp, 4
xor esi, esi
jmp 0x1006d4ec
mov eax, esi
test esi, esi
jne 0x1006d4ef
mov eax, dword [ebp - 0x1c]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call edi
mov edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 4
test esi, esi
je 0x1006d51d
push esi
call fcn.10086818
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xffffffff
jne 0x1006d549
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 3
mov ecx, 0x18c
call fcn.1006e460
mov ecx, dword [ebp + 8]
mov esi, eax
add ecx, 0x5418
mov edx, 0x800
sub esi, ecx
lea ebx, [ebx]
lea eax, [edx + 0x7ffff7fe]
test eax, eax
je 0x1006d597
movzx eax, word [esi + ecx]
test ax, ax
je 0x1006d590
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1006d570
jmp 0x1006d594
test edx, edx
jne 0x1006d597
sub ecx, 2
push dword [ebp + 8]
mov esi, dword [ebp - 0x20]
xor eax, eax
mov word [ecx], ax
mov edx, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.1006d620
add esp, 0xc
mov edi, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
test eax, eax
je 0x1006d5e5
test edi, edi
jne 0x1006d5e5
mov ecx, dword [ebp - 0x24]
call fcn.1004dae0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.1004dae0
test edi, edi
je 0x1006d5f5
cmp edi, 0xa
jne 0x1006d5fa
mov edi, 0xe
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret