Function at 0x100066ea
Capabilities:
Delete file
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x28
mov eax, 0x1005f98e
call fcn.100429b9
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x20c]
mov ecx, dword [ebp + 0x210]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ecx
jne 0x10006730
xor al, al
jmp 0x100069b7
push 0x1ff
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.10042a90
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp], bl
je 0x10006729
lea edi, [ebp]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000675c
push 7
pop ecx
mov esi, str.hardpolMyIEDataRecord.dat
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [ebp]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000677d
mov esi, 0x100643c0
movsw word es:[edi], word [esi]
mov edi, 0x10080424
push 0xffffffffffffffff
mov ecx, edi
call fcn.10019a53
lea eax, [ebp]
push 0x10063f1c
push eax
mov esi, 0x20000
call fcn.100435d9
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
jne 0x100067c2
mov ecx, edi
call fcn.10019a72
jmp 0x10006729
push esi
mov dword [ebp - 4], ebx
call fcn.1001e0bd
pop ecx
push esi
mov ebx, eax
push 0
push ebx
call fcn.10042a90
push esi
call fcn.1001e0bd
add esp, 0x10
push esi
mov edi, eax
push 0
push edi
call fcn.10042a90
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
push esi
push 1
push ebx
mov dword [ebp - 0x18], edi
call fcn.10043294
add esp, 0x1c
test eax, eax
jbe 0x1000682c
xor esi, esi
mov eax, 0x20000
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp esi, eax
jge 0x1000682c
mov ecx, dword [ebp - 0x24]
push str.1k2e8yw8o4r2d_5
lea eax, [ebx + esi*8]
push eax
call fcn.100064fc
inc esi
jmp 0x10006806
push dword [ebp - 0x14]
call fcn.1004338d
push 0
call fcn.10043e25
and dword [ebp - 0x14], 0
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov eax, 0x20000
lea edx, [ecx + eax]
cmp ebx, edx
jae 0x100068a1
lea ecx, [ebx + 4]
cmp ecx, edx
jbe 0x10006866
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100068a7
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x30], ebx
je 0x100068a1
lea eax, [ecx + 4]
cmp eax, edx
ja 0x1000685a
mov esi, dword [ecx]
test esi, esi
je 0x100068a1
lea ecx, [eax + 1]
cmp ecx, edx
ja 0x1000685a
mov al, byte [eax]
lea ebx, [esi + ecx]
cmp ebx, edx
mov dword [ebp - 0x2c], ebx
jbe 0x100069dc
and dword [ebp - 0x14], 0
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x14], 0
jg 0x100068c3
push dword [ebp - 0x20]
call fcn.1001e0b8
push dword [ebp - 0x18]
call fcn.1001e0b8
pop ecx
pop ecx
mov ecx, 0x10080424
jmp 0x100067b8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, dword [ebp - 0x1c]
push eax
call fcn.100435ec
pop ecx
call fcn.100435f9
cdq
idiv dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x1c], edx
cmp ecx, edx
jge 0x100068f9
mov eax, esi
add esi, 4
mov edi, dword [esi]
lea esi, [esi + edi + 5]
inc ecx
jmp 0x100068e7
mov edi, dword [esi]
add esi, 4
mov dword [eax], edi
mov ebx, dword [esi]
add esi, 4
mov byte [esi], 1
push ebx
inc esi
push esi
push dword [ebp - 0x34]
call fcn.10043ac0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add esi, ebx
dec eax
cmp dword [ebp - 0x1c], eax
jge 0x10006936
mov esi, dword [esi]
test esi, esi
je 0x10006936
test edi, edi
je 0x10006936
mov eax, esi
sub eax, edi
cmp eax, 0x708
jbe 0x10006938
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
xor esi, esi
mov edi, 0x20000
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp esi, eax
jge 0x1000696a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
push str.1k2e8yw8o4r2d_5
lea eax, [eax + esi*8]
push eax
call fcn.10006476
inc esi
jmp 0x1000693f
lea eax, [ebp]
push 0x100643b4
push eax
call fcn.100435d9
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10006995
push esi
push edi
push 1
push dword [ebp - 0x18]
call fcn.10043fb5
push esi
call fcn.1004338d
add esp, 0x14
push dword [ebp - 0x20]
call fcn.1001e0b8
push dword [ebp - 0x18]
call fcn.1001e0b8
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, 0x10080424
call fcn.10019a72
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.10042977
add ebp, 0x204
leave
ret 8
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
sub ebx, edx
cmp ebx, 0x2a300
jae 0x10006a0d
test al, al
jne 0x10006a0d
mov dword [edi], edx
add edi, 4
mov dword [edi], esi
add edi, 4
push esi
mov byte [edi], al
push ecx
inc edi
push edi
call fcn.10043ac0
add esp, 0xc
add edi, esi
inc dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
jmp 0x10006844