Function at 0x66e0ab60
Capabilities:
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x66f77428
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x2cc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x78]
push edx
xor bl, bl
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x2d8], 0
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [0x66fe20c4]
mov byte [esp + 0x2d4], 1
cmp eax, 1
jne 0x66e0ada8
lea ecx, [esp + 0xb4]
call fcn.66e0c6c0
push 0x104
lea eax, [esp + 0x1c8]
mov byte [esp + 0x2d8], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x1c4]
push 0x5c
push eax
call fcn.66e0e680
add esp, 8
test al, al
jne 0x66e0ac33
lea edi, [esp + 0x1c4]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x66e0ac20
mov ax, word [0x66f8af3c]
mov word [edi], ax
lea ecx, [esp + 0x1c4]
dec ecx
jmp 0x66e0ac40
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x66e0ac40
mov eax, dword [str.WININIT.INI]
mov dword [ecx], eax
mov eax, dword [0x66f8bcb8]
mov dword [ecx + 4], eax
mov eax, dword [0x66f8bcbc]
mov dword [ecx + 8], eax
lea eax, [esp + 0x1c4]
push eax
lea ecx, [esp + 0xb8]
call fcn.66e0cd30
push str.rename
lea ecx, [esp + 0xb8]
call fcn.66e0ccd0
mov ebp, eax
test ebp, ebp
je 0x66e0ad8f
mov ecx, dword [ebp + 8]
xor bl, bl
mov esi, dword [ecx]
cmp esi, ecx
je 0x66e0ad8f
mov bh, byte [esp + 0x2dc]
jmp 0x66e0acb0
mov edi, dword [esi + 8]
test edi, edi
je 0x66e0ad6e
mov edi, dword [edi + 8]
lea ecx, [esp + 0x78]
call fcn.66e13a40
push eax
push edi
call fcn.66f2ae8e
add esp, 8
test eax, eax
je 0x66e0ad64
mov eax, dword [esi + 8]
lea ecx, [esp + 0x50]
mov edi, dword [eax + 8]
call fcn.66e13a40
push eax
push edi
call fcn.66f2ae8e
add esp, 8
test eax, eax
je 0x66e0ad64
mov eax, dword [esi + 8]
lea ecx, [esp + 0x78]
mov edi, dword [eax + 4]
call fcn.66e13a40
push eax
push edi
call fcn.66f2ae8e
add esp, 8
test eax, eax
je 0x66e0ad30
mov eax, dword [esi + 8]
lea ecx, [esp + 0x50]
mov edi, dword [eax + 4]
call fcn.66e13a40
push eax
push edi
call fcn.66f2ae8e
add esp, 8
test eax, eax
jne 0x66e0ad6e
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 8]
test edx, edx
je 0x66e0ad6e
lea edi, [edx + 1]
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x66e0ad40
sub edx, edi
je 0x66e0ad6e
mov bl, 1
call fcn.66e0cbc0
test bh, bh
jne 0x66e0ad6e
mov eax, dword [esi + 8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x66e0ad6e
mov ecx, dword [esi + 8]
call fcn.66e0cbc0
mov bl, 1
mov esi, dword [esi]
cmp esi, dword [ebp + 8]
jne 0x66e0acb0
test bl, bl
je 0x66e0ad8f
test bh, bh
jne 0x66e0ad8f
push 0
lea ecx, [esp + 0xb8]
call fcn.66e0cea0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x2d4], 1
call fcn.66e0c7d0
jmp 0x66e0b117
cmp eax, 2
jne 0x66e0b104
push reloc.OLEAUT32.dll_SysReAllocString
push 1
push str.SystemCurrentControlSetControlSession_Manager
lea ecx, [esp + 0x98]
call fcn.66e11e60
lea eax, [esp + 0x78]
mov byte [esp + 0x2d4], 3
push eax
lea ecx, [esp + 0xa4]
call fcn.66e13340
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d4], 4
call fcn.66e13a20
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x68]
call fcn.66e13340
lea ecx, [esp + 0x64]
mov byte [esp + 0x2d4], 5
call fcn.66e13a20
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push str.PendingFileRenameOperations
lea ecx, [esp + 0x98]
call fcn.66e12050
test al, al
je 0x66e0b0c9
mov eax, dword [esp + 0x18]
test eax, eax
je 0x66e0b0c9
mov ecx, dword [esp + 0x1c]
cmp ecx, 1
jbe 0x66e0b0c0
push ecx
call fcn.66e13cb5
push dword [esp + 0x20]
mov esi, dword [esp + 0x20]
xor bl, bl
push 0
push eax
mov dword [esp + 0x30], eax
mov ebp, eax
mov byte [esp + 0x27], bl
call fcn.66f2b130
mov eax, dword [esp + 0x2c]
add esp, 0x10
dec eax
je 0x66e0b0b1
mov ecx, esi
mov ebx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x66e0ae98
sub ecx, edx
push ecx
push esi
call fcn.66f2b8cf
add esp, 8
lea edi, [eax + 1]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x66e0aeb3
sub ecx, edx
push ecx
push edi
call fcn.66f2b8cf
add esp, 8
lea ecx, [esp + 0x28]
inc eax
mov dword [esp + 0x24], eax
push ebx
call fcn.66e13410
push edi
lea ecx, [esp + 0x40]
mov byte [esp + 0x2d8], 6
call fcn.66e13410
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 7
call fcn.66e13a20
lea ecx, [esp + 0x3c]
call fcn.66e13a20
lea ecx, [esp + 0x28]
call fcn.66e13a90
test eax, eax
je 0x66e0af60
lea ecx, [esp + 0xa0]
call fcn.66e13a40
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.66e13a40
push esi
push eax
call fcn.66f2b907
add esp, 8
test eax, eax
jne 0x66e0af55
lea ecx, [esp + 0x64]
call fcn.66e13a40
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.66e13a40
push esi
push eax
call fcn.66f2b907
add esp, 8
test eax, eax
je 0x66e0af60
mov bl, 1
mov byte [esp + 0x17], bl
jmp 0x66e0b03c
lea ecx, [esp + 0x3c]
call fcn.66e13a90
test eax, eax
je 0x66e0afd9
lea ecx, [esp + 0xa0]
call fcn.66e13a40
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.66e13a40
push esi
push eax
call fcn.66f2b907
add esp, 8
test eax, eax
jne 0x66e0afb4
lea ecx, [esp + 0x64]
call fcn.66e13a40
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.66e13a40
push esi
push eax
call fcn.66f2b907
add esp, 8
test eax, eax
je 0x66e0afd9
mov bl, 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x17], bl
call fcn.66e13a90
test eax, eax
je 0x66e0b03c
lea ecx, [esp + 0x28]
call fcn.66e13a40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x66e0b03c
mov ecx, ebp
sub ecx, ebx
lea ecx, [ecx]
mov al, byte [ebx]
mov byte [ecx + ebx], al
inc ebx
test al, al
jne 0x66e0afe0
mov ecx, ebp
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x66e0aff0
sub ecx, edx
push ecx
push ebp
call fcn.66f2b8cf
add esp, 8
lea esi, [eax + 1]
mov edx, esi
sub edx, edi
lea ebx, [ebx]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edx + edi - 1], cl
test cl, cl
jne 0x66e0b010
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x66e0b022
sub ecx, edx
push ecx
push esi
call fcn.66f2b8cf
mov bl, byte [esp + 0x1f]
add esp, 8
lea ebp, [eax + 1]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x3c]
sub esi, dword [esp + 0x18]
mov byte [esp + 0x2d4], 6
call fcn.66e134c0
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d4], 5
call fcn.66e134c0
mov eax, dword [esp + 0x1c]
dec eax
cmp esi, eax
mov esi, dword [esp + 0x24]
jb 0x66e0ae91
mov esi, dword [esp + 0x20]
test bl, bl
je 0x66e0b0b3
cmp byte [esp + 0x2dc], 0
jne 0x66e0b0b3
lea ecx, [esp + 0x8c]
sub ebp, esi
je 0x66e0b0a5
lea eax, [ebp + 1]
push eax
push esi
push str.PendingFileRenameOperations
call fcn.66e12540
jmp 0x66e0b0b3
push str.PendingFileRenameOperations
call fcn.66e11ff0
jmp 0x66e0b0b3
mov esi, ebp
push esi
call fcn.66e13cbe
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call fcn.66e13cbe
add esp, 4
lea ecx, [esp + 0x64]
mov byte [esp + 0x2d4], 4
call fcn.66e134c0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x2d4], 3
call fcn.66e134c0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x2d4], 1
call fcn.66e11ea0
jmp 0x66e0b117
push 0
push 0x34effff
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
lea ecx, [esp + 0x50]
mov byte [esp + 0x2d4], 0
call fcn.66e134c0
lea ecx, [esp + 0x78]
mov dword [esp + 0x2d4], 0xffffffff
call fcn.66e134c0
mov al, bl
mov ecx, dword [esp + 0x2cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.66f2a29c
add esp, 0x2c4
ret 4