Function at 0x101035c9
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], 3
push esi
mov dword [ebp - 4], ebx
jne 0x10103838
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10103838
cmp dword [esi + 0x10], 0
je 0x10103838
mov eax, dword [ebp + 8]
dec eax
push edi
sub eax, ebx
jne 0x10103717
cmp dword [esi], 4
jae 0x10103717
mov ecx, esi
xor edi, edi
call fcn.1013b146
mov ecx, dword [esi + 0x10]
mov edx, eax
call fcn.101336f5
mov dword [ebp - 0x18], eax
test eax, eax
je 0x101036f3
push edi
mov ecx, eax
call fcn.10133764
mov edi, eax
test edi, edi
je 0x101036f3
mov ecx, dword [edi + 0x2c]
lea eax, [ecx + edi]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x101036f3
mov edx, dword [ecx + 0x134]
test edx, edx
je 0x101036fc
mov eax, dword [ecx + 0x138]
add eax, edx
mov dword [ebp - 0x10], eax
je 0x101036fc
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov dword [ebp - 0x14], eax
pop ecx
pop ecx
test eax, eax
je 0x101036fc
mov ecx, dword [esi + 0x10]
and dword [ebp - 0xc], 0
call fcn.10135c8b
mov dword [ebp - 8], eax
test eax, eax
je 0x101036e8
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
push eax
call fcn.10134608
test eax, eax
je 0x101036e5
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
push 0x1002a808
call fcn.10103502
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101036cb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x101036fc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x101036fc
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x101036d5
jmp 0x101036ce
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x10103703
mov ecx, edi
call fcn.10133796
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1010370f
call fcn.10133732
test ebx, ebx
je 0x101037e9
mov edx, dword [esi + 0x14]
push esi
call fcn.10138339
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x101037df
push 1
mov edx, edi
xor ecx, ecx
call fcn.101387c0
test eax, eax
je 0x101037d5
mov eax, dword [ebp - 8]
add edi, 0x14
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x101037c9
dec ecx
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], ecx
je 0x101037bc
cmp dword [edi + 0x24], 0
je 0x10103780
push dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov ecx, edi
push esi
push 3
call fcn.100ff2c7
mov ecx, dword [ebp - 4]
cmp eax, 0x80004001
je 0x101037bc
xor ebx, ebx
test eax, eax
setns bl
jmp 0x101037bc
test byte [edi + 0x3d], 0x20
je 0x1010378b
mov eax, dword [edi + 0x74]
jmp 0x10103798
push 0xd
pop edx
mov ecx, edi
call fcn.10138916
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x101037bc
push dword [ebp + 0x14]
mov ecx, eax
push esi
push 3
push dword [ebp + 8]
call dword [0x101d880c]
call dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and ebx, eax
add edi, 0x78
test ecx, ecx
jne 0x1010374d
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
xor edx, edx
mov ecx, eax
inc edx
call fcn.1013877f
jmp 0x101037e3
xor edx, edx
mov ecx, edi
inc edx
call fcn.1013877f
and dword [ebp - 4], 0
cmp dword [ebp + 8], 2
jne 0x10103832
cmp dword [esi], 4
jae 0x10103832
mov eax, dword [0x100083d4]
mov ebx, 0x100083d4
jmp 0x1010382e
push dword [ebx + 4]
mov ecx, dword [esi + 0x10]
mov edx, eax
call fcn.10103502
mov edi, eax
test edi, edi
je 0x10103829
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10103822
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 8
mov eax, dword [ebx]
test eax, eax
jne 0x101037fa
mov eax, dword [ebp - 4]
pop edi
jmp 0x1010383a
xor eax, eax
pop esi
pop ebx
leave
ret 0x10