Function at 0x6c806ee0
Capabilities:
Access peb ldr_data
Check if file exists
Delete file
Get common file path
Get file attributes
Get process heap flags
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x108
mov eax, dword [ecx]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb0], eax
test eax, eax
je 0x6c8071c6
mov esi, ebx
and si, 0x100
test byte [0x6c845750], 8
je 0x6c8070d0
mov eax, 0x6c84793b
test bx, bx
mov edx, str.OF_REOPEN
mov edi, str.OF_PARSE
mov ecx, str.OF_SHARE_COMPAT
cmovns edx, eax
test bh, 0x40
mov dword [ebp - 0xb4], edx
mov edx, str.OF_EXIST
cmove edx, eax
test bh, 0x20
mov dword [ebp - 0xb8], edx
mov edx, str.OF_PROMPT
cmove edx, eax
test bh, 0x10
mov dword [ebp - 0xbc], edx
mov edx, str.OF_CREATE
cmove edx, eax
test bh, 8
mov dword [ebp - 0xc0], edx
mov edx, str.OF_CANCEL
cmove edx, eax
test bh, 4
mov dword [ebp - 0xc4], edx
mov edx, str.OF_SEARCH
cmove edx, eax
mov dword [ebp - 0xd0], edx
mov edx, str.OF_VERIFY
cmove edx, eax
test bh, 2
mov dword [ebp - 0xc8], edx
mov edx, str.OF_DELETE
cmove edx, eax
test si, si
cmove edi, eax
mov eax, ebx
and ax, 0x70
mov dword [ebp - 0xcc], edx
je 0x6c807000
mov ecx, str.OF_SHARE_DENY_NONE
cmp ax, 0x40
je 0x6c807000
mov ecx, str.OF_SHARE_DENY_READ
cmp ax, 0x30
je 0x6c807000
mov ecx, str.OF_SHARE_DENY_WRITE
cmp ax, 0x20
je 0x6c807000
cmp ax, 0x10
mov ecx, str.OF_SHARE_EXCLUSIVE
mov eax, str.unknown
cmovne ecx, eax
lea esi, [esi]
nop
mov eax, ebx
mov edx, str.OF_READ
and ax, 3
je 0x6c807029
mov edx, str.OF_WRITE
cmp ax, 1
je 0x6c807029
cmp ax, 2
mov edx, str.unknown
mov eax, str.OF_READWRITE
cmove edx, eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0xd4], ecx
call fcn.6c805c30
mov ecx, dword [ebp - 0xb4]
mov dword [esp + 0xc], str._s__s__s__s_s_s_s_s_s_s_s_s_n
mov edx, dword [ebp - 0xd8]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [esp + 0x14], edx
mov dword [esp], 3
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp - 0xc0]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp - 0xc4]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp - 0xd0]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0xc8]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0xcc]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0xd4]
mov dword [esp + 0x18], ecx
call fcn.6c805ec0
test si, si
jne 0x6c807538
test bh, 0x10
jne 0x6c8071e0
mov eax, dword [ebp - 0xb0]
xor edx, edx
test bx, bx
mov byte [eax], 0x88
mov word [eax + 2], dx
js 0x6c8072d0
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x6c8071c6
mov edi, dword [ebp - 0xb0]
mov dword [esp + 0xc], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
add edi, 8
mov dword [ebp - 0xbc], edi
mov dword [esp + 8], edi
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x6c8071a0
mov eax, dword [ebp - 0xac]
test bh, 4
je 0x6c8076c8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov byte [ebp - 0xd4], 1
sub esp, 4
cmp eax, 0xffffffff
je 0x6c807728
test byte [0x6c845750], 8
jne 0x6c8077c0
test bh, 2
je 0x6c807570
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
test eax, eax
jne 0x6c8076e0
lea esi, [esi]
lea esi, [esi]
movzx eax, byte [0x6c845750]
and eax, 4
mov edi, dword [ebp - 0xb0]
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
mov word [edi + 2], dx
test al, al
jne 0x6c807250
mov esi, 0xffffffff
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
movzx eax, bx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_OpenFile]
sub esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x6c8071a0
test byte [0x6c845750], 8
jne 0x6c807290
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x6c807840
mov dword [esp], esi
call fcn.6c805f10
sub esp, 4
mov esi, eax
cmp eax, 0xffff
je 0x6c8071a0
and bh, 0x40
je 0x6c8071cb
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16__lclose16
sub esp, 4
jmp 0x6c8071cb
mov eax, dword [ebp - 0xac]
movzx edx, dx
mov dword [esp + 0xc], str.__s_:_return__HFILE_ERROR_error__d_n
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp + 0x10], eax
mov dword [esp], 2
call fcn.6c805ec0
jmp 0x6c8071c6
mov eax, dword [ebp - 0xac]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str.__s_:_OK__return___p_n
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.6c805ec0
jmp 0x6c807213
add eax, 8
mov dword [esp + 0xc], 0
mov dword [ebp - 0xb8], eax
mov dword [esp + 8], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x6c807618
mov eax, ebx
shr ax, 0xa
and eax, 1
mov byte [ebp - 0xd4], al
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0x98], 0
call sym.krnl386.exe16_GetCurrentTask
test ax, ax
jne 0x6c807670
lea eax, [ebp - 0x98]
mov dword [ebp - 0xc4], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.6c806e40
mov edi, dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
sub esp, 8
mov word [ebp - 0xc0], ax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0xc8], edi
call edi
mov edi, dword [ebp - 0xc4]
sub esp, 8
mov esi, eax
mov dword [esp], edi
mov edi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0xb4], edi
call edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [esp], str.PATH
add esi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0xd0], edi
call edi
movzx edx, word [ebp - 0xc0]
add esi, eax
sub esp, 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
add esi, edx
lea ecx, [esi + 6]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov dword [ebp - 0xc0], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc0]
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x6c8071a0
lea edi, [edx + 2]
add esi, 4
mov eax, 0x3b2e
mov byte [edx + 2], 0
movzx esi, si
mov word [edx], ax
lea eax, [edx + ecx]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc0], eax
call fcn.6c806e40
mov esi, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], edi
call esi
add edi, eax
mov eax, dword [ebp - 0xc0]
lea esi, [edi + 1]
mov byte [edi], 0x3b
mov edi, dword [ebp - 0xc8]
mov dword [esp], esi
sub eax, esi
mov dword [esp + 4], eax
call edi
mov eax, dword [ebp - 0xb4]
sub esp, 8
mov dword [esp], esi
call eax
mov edx, dword [ebp - 0xcc]
add esi, eax
cmp byte [ebp - 0x98], 0
mov byte [esi], 0x3b
lea edi, [esi + 1]
jne 0x6c807638
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xb4], edx
mov dword [esp + 4], edi
mov dword [esp], str.PATH
sub eax, edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xd0]
call eax
mov eax, dword [ebp - 0xbc]
sub esp, 0xc
mov edx, dword [ebp - 0xb4]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xb8]
mov dword [esp], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SearchPathA]
mov edx, dword [ebp - 0xb4]
sub esp, 0x18
mov esi, eax
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test esi, esi
jne 0x6c807166
jmp 0x6c8071a0
mov eax, dword [ebp - 0xb0]
movzx ebx, bx
xor esi, esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_OpenFile]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
movzx eax, bx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll__lopen]
sub esp, 8
mov edi, eax
cmp eax, 0xffffffff
je 0x6c8071a0
lea ecx, [ebp - 0x98]
mov esi, eax
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_GetFileTime]
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x9a]
sub esp, 0x10
lea ecx, [ebp - 0x98]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x9c]
sub esp, 0xc
test bx, bx
jns 0x6c8075fb
cmp byte [ebp - 0xd4], 0
jne 0x6c8077f8
movzx edx, word [ebp - 0x9a]
mov edi, dword [ebp - 0xb0]
mov word [edi + 4], ax
mov word [edi + 6], dx
jmp 0x6c80720a
movzx eax, byte [0x6c845750]
mov ebx, dword [ebp - 0xb8]
and eax, 4
mov dword [ebp - 0xac], ebx
jmp 0x6c8071aa
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], edx
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov dword [esp], edi
mov eax, dword [ebp - 0xb4]
call eax
mov edx, dword [ebp - 0xc8]
add eax, edi
lea edi, [eax + 1]
mov byte [eax], 0x3b
jmp 0x6c807492
call sym.krnl386.exe16_GetCurrentTask
lea edi, [ebp - 0x98]
mov dword [esp + 8], pe_nt_image_headers32
movzx eax, ax
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [ebp - 0xc4], edi
call fcn.6c826ad0
sub esp, 0xc
test ax, ax
je 0x6c807343
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strrchr]
test eax, eax
cmove eax, edi
mov byte [eax], 0
jmp 0x6c807343
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xd4], 0
jmp 0x6c807322
mov esi, 1
test byte [0x6c845750], 8
je 0x6c8071cb
mov eax, dword [ebp - 0xac]
mov dword [esp + 0xc], str.__s_:_OF_DELETE_return__OK_n
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6c805ec0
jmp 0x6c8071cb
mov eax, dword [ebp - 0xac]
cmp byte [eax], 0
mov dword [ebp - 0xb8], eax
je 0x6c807750
cmp byte [eax + 1], 0x3a
jne 0x6c807750
add eax, 2
mov dword [ebp - 0xb8], eax
lea esi, [esi]
nop
mov edi, dword [ebp - 0xb8]
mov dword [esp + 4], 0x5c
mov esi, dword [sym.imp.ucrtbase.dll_strrchr]
mov dword [esp], edi
call esi
mov dword [esp + 4], 0x2f
lea edx, [eax + 1]
test eax, eax
cmove edx, edi
mov edi, edx
mov dword [esp], edx
call esi
mov byte [ebp - 0xd4], 1
lea edx, [eax + 1]
test eax, eax
cmove edx, edi
cmp byte [edx], 0
mov dword [ebp - 0xb8], edx
jne 0x6c807322
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 2
movzx eax, byte [0x6c845750]
and eax, 4
jmp 0x6c8071aa
mov eax, dword [ebp - 0xbc]
call fcn.6c805c30
mov dword [esp + 0xc], str.found__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp], 3
call fcn.6c805ec0
jmp 0x6c807173
mov ecx, dword [ebp - 0xb0]
cmp word [ecx + 4], ax
jne 0x6c807815
movzx edx, word [ebp - 0x9a]
cmp word [ecx + 6], dx
je 0x6c807602
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [0x6c845750]
sub esp, 4
and eax, 4
jne 0x6c80784f
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 2
jmp 0x6c8071aa
mov esi, 0xffffffff
mov eax, 0xffffffff
jmp 0x6c807237
mov eax, dword [ebp - 0xac]
mov dword [esp + 0xc], str.__s_:_OF_VERIFY_failed_n
mov dword [esp + 8], 0x6c847b30
mov dword [esp + 4], 0x6c845750
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.6c805ec0
movzx eax, byte [0x6c845750]
and eax, 4
jmp 0x6c80782d