Function at 0x1004363
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x7dc]
sub esp, 0x85c
mov eax, dword [0x1008134]
push ebx
xor ebx, ebx
mov dword [ebp + 0x7d8], eax
push esi
mov esi, dword [ebp + 0x7e8]
push edi
mov edx, 0x81
xor eax, eax
mov word [ebp + 0x3c8], bx
mov ecx, edx
lea edi, [ebp + 0x3ca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp byte [esi + 0x30], bl
mov word [ebp + 0x5d0], bx
mov ecx, edx
lea edi, [ebp + 0x5d2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x64], ebx
mov byte [ebp - 0x55], 1
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
jne 0x10043df
xor edi, edi
cmp byte [esi + 0x6c], bl
je 0x100440b
mov dword [0x100815c], 0x1001234
mov dword [0x1008160], 0x10015cc
mov dword [0x1008180], 0x1001274
mov byte [0x1008158], 1
jmp 0x1004429
mov dword [0x100815c], 0x10015c4
mov dword [0x1008160], 0x10015bc
mov dword [0x1008180], 0x100123c
push dword [esi + 0x14]
push 0x28
push 3
call fcn.01001e92
push 0x29
push 3
call fcn.01001e92
add esp, 0x14
call fcn.0100666b
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x10049af
cmp byte [esi + 0x31], bl
je 0x1004460
mov dword [ebp - 0x50], 2
cmp dword [esi + 0x1c], ebx
jne 0x1004469
or dword [ebp - 0x50], 1
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x50]
push dword [esi + 0x28]
push dword [ebp + 0x7e4]
call fcn.01003221
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x10049af
cmp dword [esi + 0x1c], ebx
mov eax, dword [ebp - 0x78]
jne 0x10044ad
cmp eax, ebx
jne 0x10044aa
push 0x5b
push 1
call fcn.01001e92
pop ecx
pop ecx
jmp 0x10044ad
mov dword [esi + 0x1c], eax
cmp byte [esi + 0x31], bl
je 0x10044c5
cmp dword [ebp - 0x70], ebx
jne 0x10044c5
push 0x5c
push 1
call fcn.01001e92
pop ecx
pop ecx
mov byte [esi + 0x31], bl
cmp byte [esi + 0x30], bl
je 0x10044dd
cmp dword [ebp - 0x68], ebx
jne 0x10044dd
push 0x58
push 1
call fcn.01001e92
pop ecx
pop ecx
mov byte [esi + 0x30], bl
lea eax, [ebp + 0x1c0]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1004512
lea eax, [ebp + 0x3c8]
push eax
push ebx
push 0x10015b0
lea eax, [ebp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1004527
push 0x2a
push 7
call fcn.01001e92
pop ecx
mov dword [ebp + 0x7e8], edi
jmp 0x10049ae
push dword [0x100815c]
lea eax, [ebp + 0x3c8]
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
jne 0x1004547
push 0x2b
jmp 0x100458d
cmp byte [esi + 0x31], bl
je 0x10045c4
lea eax, [ebp - 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1004570
push 0x2a
push 7
call fcn.01001e92
pop ecx
mov dword [ebp + 0x7e8], edi
jmp 0x100499f
lea eax, [ebp + 0x5d0]
push eax
push ebx
push 0x10015a4
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10045a4
push 0x2a
push 7
call fcn.01001e92
pop ecx
mov dword [ebp + 0x7e8], 0x101
jmp 0x100499f
push dword [0x100815c]
lea eax, [ebp + 0x5d0]
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x4c], eax
je 0x1004907
push 0x28
call fcn.01006d00
cmp eax, ebx
mov dword [ebp - 0x5c], eax
je 0x10045fc
push ebx
push 0x1006635
push 0x1006629
push 0x1006641
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeGenericTable]
push 0x320
call fcn.01006d00
cmp eax, ebx
mov dword [0x100816c], eax
jne 0x100460b
mov dword [ebp + 0x7e8], 0x100
jmp 0x1004991
mov dword [0x1008174], 0x64
mov dword [0x1008170], ebx
cmp byte [esi + 0x30], bl
je 0x10047e9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x58]
push dword [esi + 0x1c]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_206]
add esp, 0x2c
cmp eax, ebx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x60], ebx
jne 0x1004673
call dword [sym.imp.WLDAP32.dll_Ordinal_16]
mov edi, eax
push 0x2c
push 7
mov dword [ebp - 0x60], edi
call fcn.01001e92
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp + 0x7e8], edi
jne 0x1004991
cmp dword [ebp - 0x74], ebx
je 0x10047aa
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x100
push ebx
push dword [ebp - 0x74]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_135]
add esp, 0x18
cmp byte [ebp - 0x55], bl
mov dword [ebp - 0x60], eax
je 0x10046c6
push 0x2d
push 3
call fcn.01001e92
push 0x1001274
push 0xa
call fcn.01001ff8
add esp, 0x10
mov byte [ebp - 0x55], bl
mov byte [0x1008152], 1
cmp dword [ebp - 0x54], ebx
je 0x1004794
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x70], ebx
push dword [ebp + 0x7e4]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.WLDAP32.dll_Ordinal_179]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x6c]
add esp, 0x20
cmp eax, ebx
je 0x100471b
cmp dword [eax], ebx
mov ecx, eax
je 0x1004713
add ecx, 4
cmp dword [ecx], ebx
jne 0x100470c
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_224]
pop ecx
cmp dword [ebp - 0x68], ebx
je 0x100472a
push dword [ebp - 0x68]
call dword [sym.imp.WLDAP32.dll_Ordinal_147]
pop ecx
cmp dword [ebp - 0x70], ebx
je 0x1004739
push dword [ebp - 0x70]
call dword [sym.imp.WLDAP32.dll_Ordinal_147]
pop ecx
push dword [ebp - 0x54]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
jmp 0x100478c
push dword [ebp - 0x5c]
xor eax, eax
push dword [ebp - 0x4c]
mov al, byte [esi + 0x33]
push dword [ebp - 0x50]
push eax
xor eax, eax
mov al, byte [esi + 0x31]
push eax
push dword [esi + 0x28]
push edi
push dword [ebp + 0x7e4]
call fcn.01003f09
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x1004991
inc dword [ebp - 0x64]
push edi
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_27]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x100474a
push dword [ebp - 0x54]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
cmp dword [ebp - 0x60], ebx
pop ecx
mov dword [ebp - 0x54], ebx
je 0x1004673
cmp dword [ebp - 0x60], ebx
je 0x10048b7
cmp dword [ebp - 0x60], 0x5e
je 0x10048b7
push 0x2c
push 7
call fcn.01001e92
pop ecx
pop ecx
push dword [ebp + 0x7e4]
call fcn.01005fc5
mov eax, dword [ebp - 0x60]
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x1004991
jmp 0x10048b7
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x58]
push dword [esi + 0x1c]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_208]
mov edi, eax
add esp, 0x1c
cmp edi, ebx
je 0x1004839
push edi
call dword [sym.imp.WLDAP32.dll_Ordinal_118]
push eax
push 0x2e
push 7
call fcn.01001e92
add esp, 0x10
push dword [ebp + 0x7e4]
call fcn.01005fc5
mov dword [ebp + 0x7e8], edi
jmp 0x1004991
push 0x2d
push 3
call fcn.01001e92
push 0x1001274
push 0xa
call fcn.01001ff8
add esp, 0x10
call fcn.01001a98
push dword [ebp - 0x54]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_26]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x10048bc
push dword [ebp - 0x5c]
xor eax, eax
push dword [ebp - 0x4c]
mov al, byte [esi + 0x33]
push dword [ebp - 0x50]
push eax
xor eax, eax
mov al, byte [esi + 0x31]
push eax
push dword [esi + 0x28]
push edi
push dword [ebp + 0x7e4]
call fcn.01003f09
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x1004991
inc dword [ebp - 0x64]
push edi
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_27]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x100486d
cmp dword [ebp - 0x64], ebx
jne 0x10048d2
push 0x46
push 7
call fcn.01001e92
pop ecx
pop ecx
mov dword [ebp + 0x7e8], ebx
jmp 0x1004991
cmp dword [ebp - 0x4c], ebx
je 0x1004940
push dword [ebp - 0x4c]
call dword [sym.imp.msvcrt.dll_fclose]
cmp byte [0x1008178], bl
pop ecx
mov dword [ebp - 0x4c], ebx
je 0x1004940
lea eax, [ebp + 0x5d0]
push 0x10015cc
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x4c], eax
jne 0x100491e
push 0x2b
push 7
call fcn.01001e92
pop ecx
pop ecx
mov dword [ebp + 0x7e8], 0x101
jmp 0x1004991
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
call fcn.01005f55
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
je 0x1004940
push 0x2f
push 7
call fcn.01001e92
pop ecx
pop ecx
jmp 0x1004991
push dword [ebp - 0x50]
mov edi, dword [sym.imp.msvcrt.dll_fclose]
call edi
cmp dword [ebp - 0x4c], ebx
pop ecx
mov dword [ebp - 0x50], ebx
je 0x100495d
push dword [ebp - 0x4c]
call edi
pop ecx
mov dword [ebp - 0x4c], ebx
push 0x30
push 3
call fcn.01001e92
pop ecx
pop ecx
push esi
push dword [esi + 0x14]
lea eax, [ebp + 0x3c8]
push eax
call fcn.010037ce
cmp eax, ebx
mov dword [ebp + 0x7e8], eax
jne 0x1004991
push dword [ebp - 0x64]
push 0x31
push 3
call fcn.01001e92
add esp, 0xc
cmp dword [ebp - 0x4c], ebx
je 0x10049a0
push dword [ebp - 0x4c]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
cmp dword [ebp - 0x50], ebx
je 0x10049af
push dword [ebp - 0x50]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
cmp word [ebp + 0x3c8], bx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x10049c7
lea eax, [ebp + 0x3c8]
push eax
call esi
cmp word [ebp + 0x5d0], bx
je 0x10049d9
lea eax, [ebp + 0x5d0]
push eax
call esi
call fcn.01006381
mov ecx, dword [0x1008168]
cmp ecx, ebx
je 0x1004a21
xor edi, edi
cmp dword [0x1008164], ebx
jbe 0x1004a15
xor esi, esi
lea eax, [esi + ecx]
cmp byte [eax + 8], bl
je 0x1004a09
push dword [eax]
call fcn.01006d0f
mov ecx, dword [0x1008168]
inc edi
add esi, 0xc
cmp edi, dword [0x1008164]
jb 0x10049f4
push ecx
call fcn.01006d0f
mov dword [0x1008168], ebx
cmp dword [ebp - 0x78], ebx
je 0x1004a2e
push dword [ebp - 0x78]
call fcn.01006d0f
cmp dword [ebp - 0x74], ebx
je 0x1004a44
push dword [ebp - 0x74]
push dword [ebp + 0x7e4]
call dword [sym.imp.WLDAP32.dll_Ordinal_191]
pop ecx
pop ecx
cmp dword [ebp - 0x54], ebx
je 0x1004a56
push dword [ebp - 0x54]
call dword [sym.imp.WLDAP32.dll_Ordinal_41]
pop ecx
mov dword [ebp - 0x54], ebx
mov eax, dword [0x100817c]
cmp eax, ebx
mov esi, dword [sym.imp.ntdll.dll_RtlEnumerateGenericTable]
mov edi, dword [sym.imp.ntdll.dll_RtlDeleteElementGenericTable]
je 0x1004aa5
push 1
push eax
jmp 0x1004a8e
mov ecx, dword [eax]
push eax
push dword [0x100817c]
mov dword [ebp - 0x6c], ecx
call edi
push dword [ebp - 0x6c]
call fcn.01006d0f
push 1
push dword [0x100817c]
call esi
cmp eax, ebx
jne 0x1004a70
push dword [0x100817c]
call fcn.01006d0f
mov dword [0x100817c], ebx
cmp dword [ebp - 0x5c], ebx
je 0x1004ad2
jmp 0x1004abf
mov ecx, dword [eax]
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x6c], ecx
call edi
push dword [ebp - 0x6c]
call fcn.01006d0f
push 1
push dword [ebp - 0x5c]
call esi
cmp eax, ebx
jne 0x1004aac
push dword [ebp - 0x5c]
call fcn.01006d0f
mov eax, dword [0x100816c]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x1004ae4
push eax
call fcn.01006d0f
mov ecx, dword [ebp + 0x7d8]
mov eax, dword [ebp + 0x7e8]
call fcn.01006a01
add ebp, 0x7dc
leave
ret 8