Function at 0x100dc923
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], 3
push esi
mov dword [ebp - 0x10], ebx
jne 0x100dcba9
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x100dcba9
cmp dword [esi + 0x10], 0
je 0x100dcba9
mov eax, dword [ebp + 8]
dec eax
push edi
sub eax, ebx
jne 0x100dca7b
cmp dword [esi], 4
jae 0x100dca7b
mov ecx, esi
xor edi, edi
call fcn.10112fbe
mov ecx, dword [esi + 0x10]
mov edx, eax
call fcn.1010b4d0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100dcae7
push edi
mov ecx, eax
call fcn.1010b537
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x100dcae5
mov ecx, dword [edi + 0x2c]
lea eax, [ecx + edi]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x100dcae7
mov eax, dword [ecx + 0x134]
test eax, eax
je 0x100dc9cb
mov edi, dword [ecx + 0x138]
add edi, eax
jmp 0x100dc9cd
xor edi, edi
test edi, edi
je 0x100dca59
push 0x2e
push edi
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov dword [ebp - 0x14], eax
pop ecx
pop ecx
test eax, eax
je 0x100dca59
mov ecx, dword [esi + 0x10]
and dword [ebp - 0xc], 0
call fcn.1010d8e3
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100dca38
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push eax
mov edx, edi
call fcn.1010c9ae
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x100dca3b
mov edx, dword [ebp - 0x14]
mov ecx, edi
push 0x10024f08
call fcn.100dc84c
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100dca40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100dca40
mov edi, dword [ebp - 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100dca4e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x100dca59
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 8]
test edi, edi
je 0x100dca67
mov ecx, edi
call fcn.1010b565
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100dca73
call fcn.1010b509
test ebx, ebx
je 0x100dcb5a
mov edx, dword [esi + 0x14]
push esi
call fcn.10110158
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x100dcb50
push 1
mov edx, ebx
xor ecx, ecx
call fcn.101105a7
test eax, eax
je 0x100dcb46
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x14]
test eax, eax
je 0x100dcb3a
mov ebx, dword [ebp - 0x10]
dec eax
cmp dword [edi + 0x10], 0
mov dword [ebp - 8], eax
je 0x100dcb2d
cmp dword [edi + 0x24], 0
je 0x100dcaf1
push dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov ecx, edi
push esi
push 3
call fcn.100d8a93
cmp eax, 0x80004001
je 0x100dcb2a
xor ebx, ebx
test eax, eax
setns bl
jmp 0x100dcb2a
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
jmp 0x100dca5c
test byte [edi + 0x3d], 0x20
je 0x100dcafc
mov ecx, dword [edi + 0x74]
jmp 0x100dcb0b
push 0xd
pop edx
mov ecx, edi
call fcn.10110711
mov ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x100dcb2d
push dword [ebp + 0x14]
push esi
push 3
push dword [ebp + 8]
call dword [0x101a77c4]
call dword [ebp - 0xc]
neg eax
sbb eax, eax
and ebx, eax
mov eax, dword [ebp - 8]
add edi, 0x78
test eax, eax
jne 0x100dcab5
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x18]
xor edx, edx
mov ecx, ebx
inc edx
call fcn.1011056a
jmp 0x100dcb54
xor edx, edx
mov ecx, ebx
inc edx
call fcn.1011056a
and dword [ebp - 0x10], 0
cmp dword [ebp + 8], 2
jne 0x100dcba3
cmp dword [esi], 4
jae 0x100dcba3
mov eax, dword [0x100079d0]
mov ebx, 0x100079d0
jmp 0x100dcb9f
push dword [ebx + 4]
mov ecx, dword [esi + 0x10]
mov edx, eax
call fcn.100dc84c
mov edi, eax
test edi, edi
je 0x100dcb9a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100dcb93
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 8
mov eax, dword [ebx]
test eax, eax
jne 0x100dcb6b
mov eax, dword [ebp - 0x10]
pop edi
jmp 0x100dcbab
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10166ce0
mov esp, ebp
pop ebp
ret 0x10