Function at 0x10003c20
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1003280a
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x1003d300]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003d300]
xor eax, esp
push eax
lea eax, [esp + 0x16c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x17c]
mov edi, ecx
xor ebx, ebx
push eax
lea esi, [esp + 0x130]
mov dword [esp + 0x20], edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], ebx
call fcn.100016e0
add esp, 4
mov dword [esp + 0x174], 1
cmp dword [esp + 0x144], 0x10
mov ecx, dword [esp + 0x130]
mov dword [esp + 0x20], ebx
jae 0x10003ca9
lea ecx, [esp + 0x130]
lea edx, [esp + 0x20]
call fcn.10002c40
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp dword [esp + 0x20], ebx
je 0x10003d60
cmp esi, ebx
je 0x10003cfb
push esi
push str.dropCachedData
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10003cfb
push esi
call fcn.100162ce
mov eax, 0x100358fc
mov ecx, edi
call fcn.100057f0
lea ecx, [esp + 0x12c]
call fcn.10001240
jmp 0x100042a5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003d00
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x134]
call fcn.10006850
mov eax, dword [0x1003ff58]
cmp eax, ebx
jne 0x10003d5d
push str.pobus32.dll
call ebp
cmp eax, ebx
jne 0x10003d48
push str.pobus64.dll
call ebp
cmp eax, ebx
jne 0x10003d48
push str.poda32.dll
call ebp
cmp eax, ebx
jne 0x10003d48
push str.poda64.dll
call ebp
push str.FB7C34E6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003ff58], eax
cmp eax, ebx
je 0x10003d60
push esi
call eax
and dword [esp + 0x2c], 0xfffffe00
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x178], 3
call fcn.10009395
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x130]
push edx
mov byte [esp + 0x17c], 4
push eax
mov dword [esp + 0x20], 2
call fcn.10009404
test al, al
je 0x10003e0a
push 0xb
push str.i_dt:
lea ecx, [esp + 0xfc]
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
call fcn.10006850
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x178], 5
push ecx
mov dword [esp + 0x1c], 6
call fcn.100021b0
add esp, 8
mov byte [esp + 0x1b], 1
test al, al
jne 0x10003e0e
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 4
je 0x10003e4d
and dword [esp + 0x14], 0xfffffffb
cmp dword [esp + 0x10c], 0x10
jb 0x10003e34
mov edx, dword [esp + 0xf8]
push edx
call fcn.1001aa0a
add esp, 4
mov dword [esp + 0x10c], 0xf
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
mov dword [esp + 0x174], 3
test byte [esp + 0x14], 2
je 0x10003e71
and dword [esp + 0x14], 0xfffffffd
lea edi, [esp + 0x60]
call fcn.10003960
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x1b], bl
je 0x10004257
push str.i_dt
lea eax, [esp + 0x28]
push eax
mov ecx, 0x10035990
call fcn.1000d7f2
push eax
lea ecx, [esp + 0xf8]
call fcn.1000cd1a
mov byte [esp + 0x174], 6
cmp dword [esp + 0x10c], 0x10
mov eax, dword [esp + 0xf8]
jae 0x10003ebc
lea eax, [esp + 0xf8]
push eax
push str.cacheableDataFilter__s
lea esi, [esp + 0x4c]
call fcn.10018801
add esp, 8
mov byte [esp + 0x174], 7
cmp dword [esp + 0x144], 0x10
mov edi, dword [esp + 0x130]
jae 0x10003eee
lea edi, [esp + 0x130]
cmp dword [eax + 0x18], 0x10
jb 0x10003ef9
mov esi, dword [eax + 4]
jmp 0x10003efc
lea esi, [eax + 4]
mov eax, dword [0x1003ff5c]
cmp eax, ebx
jne 0x10003f46
push str.pobus32.dll
call ebp
cmp eax, ebx
jne 0x10003f2d
push str.pobus64.dll
call ebp
cmp eax, ebx
jne 0x10003f2d
push str.poda32.dll
call ebp
cmp eax, ebx
jne 0x10003f2d
push str.poda64.dll
call ebp
push str.E1034A78
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003ff5c], eax
cmp eax, ebx
jne 0x10003f46
xor esi, esi
jmp 0x10003f4c
push edi
push esi
call eax
mov esi, eax
mov byte [esp + 0x174], 6
cmp dword [esp + 0x5c], 0x10
jb 0x10003f68
mov ecx, dword [esp + 0x48]
push ecx
call fcn.1001aa0a
add esp, 4
mov edi, 0xf
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
cmp esi, ebx
je 0x10004231
push esi
push str.dropCachedData
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100040a0
push esi
call fcn.100162ce
lea edx, [esp + 0x24]
push edx
mov edx, str.attachment
call fcn.1000da67
cmp byte [eax + 8], 4
jne 0x1000405d
lea eax, [esp + 0x24]
push eax
mov edx, str.i_notremove
call fcn.1000dabc
test al, al
jne 0x1000405d
lea ecx, [esp + 0x24]
push ecx
mov edx, str.attachment
call fcn.1000da67
push eax
lea ecx, [esp + 0x48]
call fcn.1000cd1a
mov ebx, 8
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0x178], bl
call fcn.10001660
add esp, 4
lea ecx, [esp + 0x44]
mov byte [esp + 0x174], 6
call fcn.10001240
mov eax, dword [esp + 0x114]
cmp dword [esp + 0x128], ebx
jae 0x10004028
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004051
mov eax, dword [esp + 0x114]
cmp dword [esp + 0x128], ebx
jae 0x1000404a
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esp + 0x110]
call fcn.10005860
mov edi, dword [esp + 0x1c]
mov eax, 0x100358fc
mov ecx, edi
call fcn.100057f0
or dword [esp + 0x14], 1
lea ecx, [esp + 0xf4]
call fcn.10001240
lea esi, [esp + 0x24]
mov byte [esp + 0x174], 1
call fcn.1000cb2c
lea ecx, [esp + 0x12c]
call fcn.10001240
jmp 0x100042a5
mov eax, esi
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100040c0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x118]
call fcn.10006850
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x178], 9
call fcn.10001660
add esp, 4
mov byte [esp + 0x174], 0xb
cmp dword [esp + 0x128], 0x10
jb 0x10004118
mov eax, dword [esp + 0x114]
push eax
call fcn.1001aa0a
add esp, 4
mov eax, dword [0x1003ff58]
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
cmp eax, ebx
jne 0x10004173
push str.pobus32.dll
call ebp
cmp eax, ebx
jne 0x1000415e
push str.pobus64.dll
call ebp
cmp eax, ebx
jne 0x1000415e
push str.poda32.dll
call ebp
cmp eax, ebx
jne 0x1000415e
push str.poda64.dll
call ebp
push str.FB7C34E6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003ff58], eax
cmp eax, ebx
je 0x10004176
push esi
call eax
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
mov esi, 7
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
push 0xffffffffffffffff
mov word [ebp + 4], cx
push ebx
lea eax, [esp + 0x150]
mov ecx, ebp
call fcn.10005f50
or dword [esp + 0x14], 1
cmp dword [esp + 0x160], 8
jb 0x100041bb
mov edx, dword [esp + 0x14c]
push edx
call fcn.1001aa0a
add esp, 4
xor eax, eax
cmp dword [esp + 0x10c], 0x10
mov dword [esp + 0x160], esi
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], ax
jb 0x100041ed
mov ecx, dword [esp + 0xf8]
push ecx
call fcn.1001aa0a
add esp, 4
lea esi, [esp + 0x24]
mov dword [esp + 0x10c], edi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
mov byte [esp + 0x174], 1
call fcn.1000cb2c
cmp dword [esp + 0x144], 0x10
jb 0x1000422d
mov edx, dword [esp + 0x130]
push edx
call fcn.1001aa0a
add esp, 4
mov eax, ebp
jmp 0x100042a7
mov byte [esp + 0x174], 3
cmp dword [esp + 0x10c], 0x10
jb 0x10004253
mov eax, dword [esp + 0xf8]
push eax
call fcn.1001aa0a
add esp, 4
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0xffffffffffffffff
mov word [edi + 4], cx
push ebx
mov ecx, edi
call fcn.10005f50
or dword [esp + 0x14], 1
lea esi, [esp + 0x24]
mov byte [esp + 0x174], 1
call fcn.1000cb2c
cmp dword [esp + 0x144], 0x10
jb 0x100042a5
mov edx, dword [esp + 0x130]
push edx
call fcn.1001aa0a
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x16c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.1001a9d1
add esp, 0x164
ret