Function at 0x5baf52f6
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa24
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
xor esi, esi
push 0x1e
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x9f0], esi
lea edi, [ebp - 0x9ec]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0xa24]
mov dword [ebp - 0x958], esi
mov dword [ebp - 0x954], esi
mov dword [ebp - 0x95c], esi
mov dword [ebp - 0x960], esi
mov dword [ebp - 0x964], esi
call fcn.5bacda67
push 0x5ba5f15a
push sub.SHLWAPI.dll_Ordinal_107
push 0x30
push esi
push 0x1197
push 0x1073
push esi
push dword [0x5bb73708]
call sub.MSOERT2.dll_MessageBoxInstW
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x13c]
push eax
call fcn.5ba6aead
mov edi, eax
cmp edi, esi
jl 0x5baf5831
push ebx
lea eax, [ebp - 0x240]
push eax
push 0x5ba4cc94
push 0x5ba479c4
lea eax, [ebp - 0x13c]
push eax
call fcn.5ba572e2
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [0x5bb73898]
mov ecx, dword [eax]
lea edx, [ebp - 0x958]
push edx
push esi
push 0x5ba5054c
push esi
lea edx, [ebp - 0x240]
push edx
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax]
push esi
push esi
push esi
lea edx, [ebp - 0x974]
push edx
push eax
call dword [ecx + 0xac]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.5baf1c64
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x974]
xor ecx, ecx
cmp ecx, dword [ebp - 0x96c]
jb 0x5baf54b3
ja 0x5baf5439
cmp eax, dword [ebp - 0x970]
jbe 0x5baf54b3
sub eax, dword [ebp - 0x970]
push 0x32
lea ecx, [ebp - 0x38]
push ecx
push eax
call sub.SHLWAPI.dll_StrFormatByteSizeA
mov edi, 0xff
push edi
lea eax, [ebp - 0x540]
push eax
push 0x1330
call fcn.5ba56439
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x340]
push edi
push eax
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x14
push 0x30
push esi
lea eax, [ebp - 0x340]
push eax
push 0x1073
push esi
push dword [0x5bb73708]
call sub.MSOERT2.dll_MessageBoxInst
mov dword [ebp - 0x964], 1
mov edi, 0x800c013c
jmp 0x5baf5831
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x95c]
push edx
push esi
push esi
push eax
call dword [ecx + 0x44]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
jmp 0x5baf56da
cmp dword [ebp - 0x9dc], esi
je 0x5baf56c8
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x954]
push edx
push ebx
push esi
push dword [ebp - 0x9e8]
push eax
call dword [ecx + 0xd0]
test eax, eax
jl 0x5baf5667
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push dword [ebp - 0x9e8]
push eax
call dword [ecx + 0xe0]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
push dword [ebp - 0x9dc]
call sub.SHLWAPI.dll_PathFindExtensionA
lea edx, [ebp - 0x968]
push edx
mov ebx, eax
mov eax, dword [ebp - 0x954]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x34]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x968]
add dword [ebp - 0x960], eax
cmp ebx, esi
je 0x5baf558d
push 0x5ba4e95c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x5baf564f
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x950]
push eax
push 0x5ba4cc94
push dword [ebp - 0x9dc]
lea eax, [ebp - 0x13c]
push eax
call fcn.5ba572e2
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x954]
cmp eax, esi
je 0x5baf55d1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x954], esi
push esi
push esi
push ebx
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x9f0]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.5ba7bdab
mov edi, eax
cmp edi, esi
jl 0x5baf5831
lea eax, [ebp - 0x748]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x5baf5762
lea eax, [ebp - 0x748]
push eax
call sub.SHLWAPI.dll_PathFindFileNameA
mov dword [ebp - 0x9dc], eax
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x18]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x954]
cmp eax, esi
je 0x5baf56c8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x954], esi
jmp 0x5baf56c8
cmp dword [ebp - 0x9dc], esi
je 0x5baf56c8
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push dword [ebp - 0x9e8]
push eax
call dword [ecx + 0xe0]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [0x5bb73870]
lea edx, [ebp - 0x9f0]
push edx
mov dword [ebp - 0x9dc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x9f0]
push edx
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x95c]
push eax
call dword [ecx + 0x4c]
test eax, eax
je 0x5baf54d6
push 0xff
lea eax, [ebp - 0x440]
push eax
push 0x1239
call fcn.5ba56439
push ebx
push esi
push 7
push dword [ebp - 0x960]
lea eax, [ebp - 0x440]
push esi
push eax
push esi
lea ecx, [ebp - 0xa24]
call fcn.5bacdb50
push esi
lea ecx, [ebp - 0xa24]
call fcn.5baccde9
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
push esi
push esi
push esi
push dword [ebp - 0x95c]
push eax
call dword [ecx + 0x48]
mov edi, eax
cmp edi, esi
jl 0x5baf5831
jmp 0x5baf57ec
mov edi, 0x80004005
jmp 0x5baf5831
cmp dword [ebp - 0x9dc], esi
je 0x5baf57da
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x954]
push edx
push ebx
push esi
push dword [ebp - 0x9e8]
push eax
call dword [ecx + 0xd0]
test eax, eax
jl 0x5baf57da
push dword [ebp - 0x9e0]
lea ecx, [ebp - 0xa24]
call fcn.5bacce5d
push dword [ebp - 0x954]
lea eax, [ebp - 0xa24]
push dword [ebp - 0x958]
push eax
call fcn.5baf1cda
mov edi, eax
cmp edi, esi
jl 0x5baf5831
mov eax, dword [ebp - 0x954]
cmp eax, esi
je 0x5baf57da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x954], esi
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x9f0]
push edx
push ebx
push dword [ebp - 0x95c]
push eax
call dword [ecx + 0x4c]
test eax, eax
je 0x5baf576c
mov eax, dword [ebp - 0x958]
cmp eax, esi
je 0x5baf5824
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x958], esi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x958]
cmp eax, esi
je 0x5baf5847
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x958], esi
mov eax, dword [ebp - 0x954]
cmp eax, esi
je 0x5baf585d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x954], esi
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x95c]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x9f0]
push edx
push eax
call dword [ecx + 0x28]
cmp edi, esi
jge 0x5baf589e
cmp dword [ebp - 0x964], esi
jne 0x5baf589e
push edi
push 0x132f
push 0x1073
push esi
call fcn.5babe36d
lea ecx, [ebp - 0xa24]
call fcn.5bacdb13
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret