Function at 0x54d0a0
Capabilities:
Delete file
Get file size
Move file
Timestomp file

Disassembly:
push rbp
push rbx
sub rsp, 0x188
mov rbp, rsp
mov qword [rbp + 0x78], r8
mov qword [rbp + 0x80], r9
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x1a0], rcx
mov qword [rbp + 0x1a8], rdx
lea rcx, [rbp + 0x1a0]
call fcn.00410d40
lea rcx, [rbp + 0x1a8]
call fcn.00410d40
nop
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
mov r9d, dword [rbp + 0x1c0]
call fcn.0054ab70
test al, al
je 0x54d90d
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x170]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x54d237
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
cmp qword [rbp + 0x170], 0
jne 0x54d252
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
cmp qword [rbp + 0x170], 0x10
jle 0x54d2b1
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xe8]
lea r9, [rbp + 0xf0]
mov byte [rsp + 0x20], 0
call fcn.0054a850
test al, al
je 0x54d2b1
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
lea rcx, [rbp + 0x108]
mov rdx, qword [rbp + 0x1a8]
call fcn.00419f60
xor eax, eax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x54d2d5
mov eax, dword [rcx - 4]
mov rcx, qword [rbp + 0x80]
mov rcx, qword [rcx]
test rcx, rcx
je 0x54d2e8
mov rcx, qword [rcx - 8]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x1a8]
mov r9d, ecx
lea rcx, [rbp + 0xfe]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xff]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x16c]
mov qword [rsp + 0x30], rcx
mov rcx, qword [0x00587f90]
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov rcx, qword [0x00587f90]
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x00588370]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], 1
mov rcx, rdx
mov rdx, r8
mov r8d, eax
call fcn.005491b0
lea rcx, [rbp + 0x160]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rcx, [rbp + 0x160]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9d, dword [rbp + 0x16c]
call fcn.00415a20
mov rax, qword [rbp + 0x160]
mov byte [rax + 1], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 3], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 5], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 7], 0
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x160]
mov rax, qword [rbp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.0054a2d0
test al, al
jne 0x54d450
lea rcx, [rbp + 0xd8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xd8]
call fcn.00549760
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
lea rcx, [rbp + 0x158]
lea rdx, [rbp + 0x150]
xor r8, r8
call fcn.00549900
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x148]
lea r8, [rbp + 0x138]
lea r9, [rbp + 0x140]
call sub.kernel32.dll_GetFileTime
test eax, eax
jne 0x54d49f
mov dword [rbp + 0x148], 0
mov dword [rbp + 0x14c], 0
lea rcx, [rbp + 0x130]
mov edx, dword [rbp + 0x148]
call fcn.00449950
lea rcx, [rbp + 0x128]
mov edx, dword [rbp + 0x14c]
call fcn.00449950
cmp dword [rbp + 0x148], 0
jne 0x54d4d5
cmp dword [rbp + 0x14c], 0
je 0x54d50a
mov dword [rbp + 0x148], 1
mov dword [rbp + 0x14c], 0
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x148]
lea r8, [rbp + 0x138]
lea r9, [rbp + 0x140]
call sub.kernel32.dll_SetFileTime
lea rcx, [rbp + 0x130]
lea rdx, [rbp + 0x128]
lea r8, [rbp + 0x120]
call fcn.00449180
lea rcx, [rbp + 0x108]
lea rdx, [0x0054da40]
mov r8, qword [rbp + 0x108]
call fcn.00411a50
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x118]
call fcn.00449d70
lea rcx, [rbp + 0x120]
lea rdx, [rbp + 0x118]
lea r8, [rbp + 0x120]
call fcn.00449180
lea rcx, [rbp + 0x110]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rcx, [rbp + 0x110]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9d, 0x10
call fcn.00415a20
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x54d5ad
mov rax, qword [rax - 8]
mov rcx, qword [rbp + 0x120]
mov edx, eax
mov r8, qword [rbp + 0x110]
call fcn.0054ce30
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x120]
lea r8, [rbp + 0x120]
call fcn.00449180
lea rcx, [rbp + 0x118]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x54d5ff
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x118]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9, rax
call fcn.00415a20
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x54d62b
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x78]
lea r8, [rbp + 0x158]
lea r9, [rbp + 0x118]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
call fcn.0053efd0
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x80]
lea r8, [rbp + 0x158]
movzx r9, byte [rbp + 0xff]
movzx rax, byte [rbp + 0xfe]
mov byte [rsp + 0x20], al
lea rax, [rbp + 0x118]
mov qword [rsp + 0x28], rax
call fcn.00547bc0
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x54d6a3
mov rbx, qword [rbx - 8]
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8d, ebx
lea r9, [rbp + 0x160]
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x20], rax
call fcn.0054a2d0
test al, al
jne 0x54d72f
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xc8]
call fcn.00549760
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
xor r9, r9
call fcn.0054ab70
test al, al
je 0x54d90d
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x170]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x54d788
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
xor eax, eax
cmp qword [rbp + 0x170], 0x10
jle 0x54d7d4
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xc0]
lea r9, [rbp + 0xf0]
mov byte [rsp + 0x20], 0
call fcn.0054a850
cmp al, 2
je 0x54d7ea
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x54d90d
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x100]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x170]
movzx r9, byte [rbp + 0xff]
mov byte [rsp + 0x20], 1
call fcn.00448350
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
call fcn.00448b50
mov rcx, qword [rbp + 0xb8]
call fcn.004121c0
mov rbx, rax
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x100]
call fcn.00412270
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
call fcn.00448b50
mov rcx, qword [rbp + 0xa8]
call fcn.004121c0
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x54d90d
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
mov rcx, qword [rbp + 0x98]
call fcn.00448f50
test al, al
je 0x54d90c
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.00412270
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x88]
call fcn.00448b50
mov rcx, qword [rbp + 0x90]
call fcn.004121c0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
nop
lea rcx, [rbp + 0x88]
mov edx, 0xd
call fcn.00410cb0
lea rcx, [rbp + 0xf0]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rcx, [rbp + 0x100]
call fcn.00410bd0
lea rcx, [rbp + 0x108]
call fcn.00410b80
lea rcx, [rbp + 0x110]
mov rdx, qword [0x004481f0]
mov r8d, 5
call fcn.00413da0
lea rcx, [rbp + 0x150]
mov rdx, qword [0x004481f0]
mov r8d, 3
call fcn.00413da0
lea rcx, [rbp + 0x1a0]
mov edx, 2
call fcn.00410cb0
lea rsp, [rbp + 0x188]
pop rbx
pop rbp
ret