Function at 0x100065b0
Capabilities:
Check if file exists
Delete file
Delete registry key
Get file attributes
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1003b9ef
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x10047330]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10047330]
xor eax, esp
push eax
lea eax, [esp + 0x320]
mov dword fs:[0], eax
push 0xb
xor ebx, ebx
mov esi, 0xf
push str.auditConfig
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.10001b00
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x32c], ebx
call fcn.10004500
add esp, 4
mov edi, 0x10
mov byte [esp + 0x328], 2
cmp dword [esp + 0x60], edi
jb 0x10006649
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.100236cc
add esp, 4
push 0xe
push str.localCacheDays
lea ecx, [esp + 0x30]
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.10001b00
push 7
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0x334], 3
call fcn.10004180
add esp, 0xc
mov ebp, eax
mov byte [esp + 0x328], 2
mov dword [esp + 0x44], ebp
cmp dword [esp + 0x40], edi
jb 0x100066b1
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.100236cc
add esp, 4
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp ebp, 7
je 0x100066d0
push ebp
push str.local_audit_cache_days:__d
call fcn.10020dc1
add esp, 8
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x44]
imul eax, eax, 0xfffeae80
push ebx
cdq
push 0x989680
push edx
push eax
call fcn.10030920
add dword [esp + 0x18], eax
lea eax, [esp + 0x18]
adc dword [esp + 0x1c], edx
lea edx, [esp + 0x6c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [esp + 0x72]
movzx edx, word [esp + 0x6e]
movzx eax, word [esp + 0x6c]
push ecx
push edx
push eax
push str._04d__02d__02d
lea esi, [esp + 0x108]
call fcn.1001f2f3
add esp, 0x10
lea ebx, [esp + 0xbc]
mov byte [esp + 0x328], 4
call fcn.100034b0
mov byte [esp + 0x328], 5
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0xbc]
mov ecx, dword [eax]
mov esi, edx
mov ebp, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
xor edi, edi
cmp esi, edi
je 0x1000678d
cmp esi, dword [esp + 0x20]
je 0x10006792
call fcn.10023692
cmp ebp, dword [esp + 0x24]
je 0x1000688f
cmp esi, edi
jne 0x10006806
call fcn.10023692
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x100067b1
call fcn.10023692
cmp dword [esp + 0x110], 8
mov eax, dword [esp + 0xfc]
lea ebx, [ebp + 0xc]
jae 0x100067cc
lea eax, [esp + 0xfc]
mov edi, dword [esp + 0x10c]
push eax
mov eax, dword [ebx + 0x14]
mov ecx, ebx
call fcn.1000add0
test eax, eax
jge 0x10006879
test esi, esi
jne 0x1000680a
call fcn.10023692
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x100067fb
call fcn.10023692
cmp dword [ebx + 0x18], 8
jb 0x1000680e
mov eax, dword [ebx + 4]
jmp 0x10006811
mov eax, dword [esi]
jmp 0x100067a7
mov eax, dword [esi]
jmp 0x100067f1
lea eax, [ebx + 4]
push eax
push 0x1003ed0c
call fcn.10020f1f
add esp, 8
test esi, esi
jne 0x10006853
call fcn.10023692
cmp ebp, dword [esi + 0x18]
jne 0x10006832
call fcn.10023692
push ebx
push str.Softwareprojonepodlp_rptcache_rptstore_
lea edi, [esp + 0x50]
call fcn.1000ac40
mov esi, 8
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x10006857
mov eax, dword [eax + 4]
jmp 0x1000685a
mov esi, dword [esi]
jmp 0x10006828
add eax, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x60], esi
jb 0x10006879
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.100236cc
add esp, 4
lea esi, [esp + 0x18]
call fcn.10002640
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x10006781
push 0x206
lea eax, [esp + 0x11a]
xor edx, edx
push edi
push eax
mov word [esp + 0x120], dx
call fcn.100258c0
add esp, 0xc
lea ecx, [esp + 0x114]
call fcn.10021ab6
test eax, eax
je 0x10006bd7
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.1001e665
add esp, 8
mov byte [esp + 0x328], 6
mov esi, dword [esp + 0x34]
cmp esi, dword [esp + 0x38]
jbe 0x100068ef
call fcn.10023692
mov ebp, dword [esp + 0x28]
lea ebx, [esi + 4]
mov esi, dword [esp + 0x38]
cmp dword [esp + 0x34], esi
jbe 0x10006905
call fcn.10023692
cmp ebp, edi
je 0x1000690f
cmp ebp, dword [esp + 0x28]
je 0x10006914
call fcn.10023692
lea eax, [ebx - 4]
cmp eax, esi
je 0x10006b70
xor eax, eax
mov word [esp + 0x7c], ax
mov dword [esp + 0x7e], eax
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov word [esp + 0x8a], ax
cmp ebp, edi
jne 0x10006962
call fcn.10023692
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
jb 0x10006958
call fcn.10023692
cmp dword [ebx + 0x14], 8
jb 0x10006967
mov ecx, dword [ebx]
jmp 0x10006969
mov eax, dword [ebp]
jmp 0x1000694b
mov ecx, ebx
xor eax, eax
lea edx, [esp + 0x48]
push edx
push edi
push ecx
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10006b49
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0xb4]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x10006b49
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xa8], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x98], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x78]
push edx
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0xa8], ecx
call esi
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0xa8]
push edx
call esi
mov eax, dword [esp + 0x44]
imul eax, eax, 0x36ee80
push 0
cdq
push 0x18
push edx
push eax
call fcn.10030920
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x8c]
push 0
sbb ecx, dword [esp + 0x94]
push 0x2710
push ecx
push eax
mov esi, edx
call fcn.10038660
cmp edx, esi
jl 0x10006b49
jg 0x10006aba
cmp eax, edi
jbe 0x10006b49
test ebp, ebp
jne 0x10006ae0
call fcn.10023692
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
jb 0x10006ad2
call fcn.10023692
mov esi, 8
cmp dword [ebx + 0x14], esi
jb 0x10006ae5
mov eax, dword [ebx]
jmp 0x10006ae7
mov eax, dword [ebp]
jmp 0x10006ac5
mov eax, ebx
push eax
push str.cacheable_attachment_expired__delete_it:__s
call fcn.10020dc1
add esp, 8
test ebp, ebp
jne 0x10006b16
call fcn.10023692
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
jb 0x10006b0d
call fcn.10023692
cmp dword [ebx + 0x14], esi
jb 0x10006b1b
mov esi, dword [ebx]
jmp 0x10006b1d
mov eax, dword [ebp]
jmp 0x10006b00
mov esi, ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10006b33
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10006b49
test al, 1
je 0x10006b42
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
jne 0x10006b6b
call fcn.10023692
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
jb 0x10006b61
call fcn.10023692
add ebx, 0x1c
xor edi, edi
jmp 0x100068f6
mov eax, dword [ebp]
jmp 0x10006b54
mov esi, dword [esp + 0x34]
cmp esi, edi
je 0x10006bbe
mov edi, dword [esp + 0x38]
cmp esi, edi
je 0x10006baf
add esi, 0x18
xor ebx, ebx
cmp dword [esi], 8
jb 0x10006b96
mov eax, dword [esi - 0x14]
push eax
call fcn.100236cc
add esp, 4
xor edx, edx
mov dword [esi], 7
mov dword [esi - 4], ebx
mov word [esi - 0x14], dx
add esi, 0x1c
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x10006b85
mov ecx, dword [esp + 0x34]
push ecx
call fcn.100236cc
add esp, 4
xor edi, edi
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call fcn.100236cc
add esp, 4
mov ebx, 7
lea esi, [esp + 0xbc]
mov byte [esp + 0x328], bl
call fcn.10007ee0
mov eax, dword [esp + 0xbc]
push eax
call fcn.100236cc
add esp, 4
cmp dword [esp + 0x110], 8
jb 0x10006c19
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.100236cc
add esp, 4
xor edx, edx
lea esi, [esp + 0xdc]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x10c], edi
mov word [esp + 0xfc], dx
mov dword [esp + 0x328], 0xffffffff
call fcn.10014ae3
mov ecx, dword [esp + 0x320]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.1002333a
add esp, 0x318
ret