Function at 0x100131b0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a94db
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x10223008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2bc], ecx
xor eax, eax
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 7
mov word [ebp - 0x270], ax
mov dword [ebp - 4], eax
push 0x20c
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1001362b
xor eax, eax
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10013260
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x270]
call fcn.10004a60
cmp dword [ebp - 0x260], 0
je 0x1001362b
push 0xb
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x23c]
push str.Defender_f1
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
call fcn.10004a60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x23c]
push eax
lea edx, [ebp - 0x270]
lea ecx, [ebp - 0x2b8]
call fcn.10099c10
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x23c]
call fcn.100049f0
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x224], xmm0
push 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
call fcn.100145f0
mov ebx, eax
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2a8], 0
je 0x10013479
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x230]
lea ecx, [ebp - 0x2b8]
call fcn.100a4210
mov esi, dword [ebp - 0x230]
cmp esi, dword [ebp - 0x22c]
je 0x1001346a
nop dword [eax + eax]
cmp dword [esi + 0x10], 0
je 0x100133fa
push esi
lea ecx, [ebp - 0x2a0]
call fcn.100050f0
mov byte [ebp - 4], 8
mov edx, 4
lea ecx, [ebp - 0x2a0]
call fcn.10099a70
lea ecx, [ebp - 0x2a0]
call fcn.100b6af0
cmp eax, 0xffffffff
je 0x100133eb
test al, 0x10
je 0x100133eb
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2a0]
call fcn.100049f0
jmp 0x1001345b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2a0]
call fcn.100049f0
mov ecx, esi
call fcn.100a3940
test al, al
je 0x1001345b
mov ecx, esi
call fcn.100a3ad0
add eax, 0xffffffff
adc edx, 0xffffffff
test edx, edx
ja 0x10013454
jb 0x1001341f
cmp eax, 0xc7ff
ja 0x10013454
mov edi, dword [ebx + 4]
push esi
push edi
push ebx
call fcn.10015360
mov edx, dword [ebp - 0x220]
mov ecx, 0x7fffffe
sub ecx, edx
cmp ecx, 1
jb 0x100134e7
inc edx
mov dword [ebp - 0x220], edx
mov dword [ebx + 4], eax
mov ebx, dword [ebp - 0x224]
mov dword [edi], eax
jmp 0x1001345b
mov ecx, esi
call fcn.100b6e90
add esi, 0x18
cmp esi, dword [ebp - 0x22c]
jne 0x100133a0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x230]
call fcn.10008850
mov esi, dword [ebx]
cmp esi, ebx
je 0x100135f9
lea edi, [esi + 8]
push edi
lea eax, [ebp - 0x288]
push eax
call fcn.10013660
mov byte [ebp - 4], 9
mov ecx, edi
call fcn.100b6e90
test al, al
jne 0x10013514
push str..temp
mov edx, edi
lea ecx, [ebp - 0x23c]
call fcn.1000f040
add esp, 4
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x23c]
mov ecx, edi
call fcn.100b6cf0
test al, al
je 0x100134f2
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
push 4
cmovae eax, dword [ebp - 0x23c]
push 0
push eax
jmp 0x100134ff
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
cmp dword [edi + 0x14], 8
jb 0x100134fa
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x23c]
call fcn.100049f0
cmp dword [ebp - 0x278], 0
je 0x100135e0
mov dword [ebp - method.Poco::Any::ValueHolder.virtual_4], vtable.RC::DmAvCore::IVBusMessageHolder.0
mov byte [ebp - 4], 0xb
xor eax, eax
push eax
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], 0
push 0x101e1e90
mov dword [ebp - 0x258], 0x101ea6bc
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.10004a60
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x288]
cmp dword [ebp - 0x274], 8
lea ecx, [ebp - 0x254]
push dword [ebp - 0x278]
cmovae eax, dword [ebp - 0x288]
push eax
call fcn.10004a60
mov eax, dword [ebp - 0x2bc]
lea edx, [ebp - 0x258]
push 0
push 0
push edx
mov ecx, dword [eax + 0x14]
push str.4A49A6BD_0B72_4328_8D7B_87CC31AE28F2
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x254]
call fcn.100049f0
mov byte [ebp - 4], 9
mov dword [ebp - method.Poco::Any::ValueHolder.virtual_4], vtable.RC::DmAvCore::IVBusMessageHolder.0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x288]
call fcn.100049f0
mov esi, dword [esi]
cmp esi, ebx
jne 0x10013483
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x224]
call fcn.10014430
mov byte [ebp - 4], 3
push 0x20
push dword [ebp - 0x224]
call fcn.1018d5e5
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.100049f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.100049f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018d5a4
mov esp, ebp
pop ebp
ret