Function at 0x10005a80
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dffd9
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x10275008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10007250
call fcn.10006040
xor eax, eax
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
mov dword [ebp - 4], eax
push 0x20c
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x10006012
xor eax, eax
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005b30
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x284]
call fcn.10005390
cmp dword [ebp - 0x274], 0
je 0x10006012
xorps xmm0, xmm0
mov dword [ebp - 0x24c], 0
movq qword [ebp - 0x254], xmm0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov byte [ebp - 4], 1
movq qword [ebp - 0x248], xmm0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov byte [ebp - 4], 2
xor eax, eax
push 0xb
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 0
push str.Defender_f3
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.10005390
mov byte [ebp - 4], 3
lea eax, [ebp - 0x234]
push eax
lea edx, [ebp - 0x284]
lea ecx, [ebp - 0x29c]
call fcn.100e17c0
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x234]
call fcn.10005300
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x23c], xmm0
push 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
call fcn.10008e30
mov ebx, eax
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x28c], 0
je 0x10005daf
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov byte [ebp - 4], 9
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x29c]
call fcn.100e0a00
mov esi, dword [ebp - 0x228]
cmp esi, dword [ebp - 0x224]
je 0x10005da0
cmp dword [esi + 0x10], 0
je 0x10005d30
push esi
lea ecx, [ebp - 0x26c]
call fcn.100086d0
mov byte [ebp - 4], 0xa
mov edx, 4
lea ecx, [ebp - 0x26c]
call fcn.100e1620
lea ecx, [ebp - 0x26c]
call fcn.100fc040
cmp eax, 0xffffffff
je 0x10005d21
test al, 0x10
je 0x10005d21
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x26c]
call fcn.10005300
jmp 0x10005d91
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x26c]
call fcn.10005300
mov ecx, esi
call fcn.100e0140
test al, al
je 0x10005d91
mov ecx, esi
call fcn.100e02d0
add eax, 0xffffffff
adc edx, 0xffffffff
test edx, edx
ja 0x10005d8a
jb 0x10005d55
cmp eax, 0xc7ff
ja 0x10005d8a
mov edi, dword [ebx + 4]
push esi
push edi
push ebx
call fcn.10009d60
mov edx, dword [ebp - 0x238]
mov ecx, 0x7fffffe
sub ecx, edx
cmp ecx, 1
jb 0x10005e26
inc edx
mov dword [ebp - 0x238], edx
mov dword [ebx + 4], eax
mov ebx, dword [ebp - 0x23c]
mov dword [edi], eax
jmp 0x10005d91
mov ecx, esi
call fcn.100fc520
add esi, 0x18
cmp esi, dword [ebp - 0x224]
jne 0x10005cd6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x228]
call fcn.10008a90
mov esi, dword [ebx]
cmp esi, ebx
je 0x10005e8f
nop dword [eax]
push 1
lea edi, [esi + 8]
push edi
lea eax, [ebp - 0x26c]
push eax
call fcn.10006500
mov byte [ebp - 4], 0xb
mov ecx, edi
call fcn.100fc520
test al, al
jne 0x10005e53
push str..temp
mov edx, edi
lea ecx, [ebp - 0x234]
call fcn.10008ee0
add esp, 4
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x234]
mov ecx, edi
call fcn.100fc240
test al, al
je 0x10005e31
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push 4
cmovae eax, dword [ebp - 0x234]
push 0
push eax
jmp 0x10005e3e
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
cmp dword [edi + 0x14], 8
jb 0x10005e39
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x234]
call fcn.10005300
cmp dword [ebp - 0x25c], 0
je 0x10005e76
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.10006a20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x26c]
call fcn.10005300
mov esi, dword [esi]
cmp esi, ebx
jne 0x10005dc0
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x250]
je 0x10005fc2
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x244]
je 0x10005fc2
push 0xa0
lea eax, [ebp - 0xb0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xa8]
call fcn.1001ee40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xb0]
push 0
call fcn.10046070
push 5
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x234]
push str.EBD11
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.10005390
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0xb0]
call fcn.100469c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x234]
call fcn.10005300
lea ecx, [ebp - 0xb0]
call fcn.100464b0
mov byte [ebp - 4], 8
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x48]
call fcn.10005300
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x60]
call fcn.10005300
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x78]
call fcn.10005300
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x90]
call fcn.10005300
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa8]
call fcn.10005300
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x23c]
call fcn.10008d50
mov byte [ebp - 4], 5
push 0x20
push dword [ebp - 0x23c]
call fcn.101c8702
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x29c]
call fcn.10005300
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10008a90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.10008a90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.10005300
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c837b
mov esp, ebp
pop ebp
ret