Function at 0x10005a89
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
mov ecx, dword [0x1000d3ec]
push esi
push 0x1000b864
xor esi, esi
push esi
push 0x1000b820
mov dword [ebp - 0x20], 0x101
call fcn.1000927d
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x10005ac4
mov dword [0x1000d408], ecx
jmp 0x10005d39
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x574]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x10005d39
and byte [ebp - 0x128], 0
push esi
push 0x21
lea eax, [ebp - 0x128]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x10005d39
push ebx
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov esi, 0x1000b7e8
mov edi, 0x1000b8a8
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x1000b848
jne 0x10005bc4
mov ecx, dword [0x1000d3ec]
push eax
push esi
push edi
push 0x1000b7e4
mov dword [ebp - 0x10], 0x1000b850
call fcn.10009215
push eax
call fcn.10009600
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x10005b73
mov ecx, dword [0x1000d3ec]
push esi
push 0x1000b8a0
push 0x1000b7e4
call fcn.100092c1
cmp dword [ebp - 4], 0
jle 0x10005bc4
mov ecx, dword [0x1000d3ec]
push esi
push 0
push 0x1000b7e0
call fcn.1000927d
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10009998
pop ecx
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
sub eax, dword [ebp - 8]
jns 0x10005ba5
neg eax
cmp eax, 0x278d00
jle 0x10005bb0
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
sub ecx, dword [ebp - 8]
imul eax, eax, 0xe10
cmp ecx, eax
jl 0x10005d1d
and dword [ebp - 0x14], 0
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x774]
push str._s_d
push eax
call ebx
mov ecx, dword [0x1000d3ec]
add esp, 0x10
push esi
push edi
lea eax, [ebp - 0x774]
push eax
mov dword [ebp - 8], 2
call fcn.10009215
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10005d1d
push dword [ebp - 4]
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x470]
push str._s_s__s__.txt
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x10005cac
cmp dword [ebp - 0xc], 0
jne 0x10005cee
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x36c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10005c5a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 8]
lea eax, [ebp - 0x774]
push dword [ebp - 0x10]
push str._s_d
push eax
call ebx
mov ecx, dword [0x1000d3ec]
add esp, 0x10
inc dword [ebp - 8]
push esi
push edi
lea eax, [ebp - 0x774]
push eax
call fcn.10009215
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10005c0b
jmp 0x10005cf9
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [0x1000d408], eax
cmp dword [ebp - 0x14], 0
je 0x10005d1d
lea eax, [ebp - 0x24]
push eax
call fcn.10009998
pop ecx
mov ecx, dword [0x1000d3ec]
push esi
push dword [ebp - 0x24]
push 0x1000b7e0
call fcn.100092e6
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0xc], eax
sete cl
cmp ecx, eax
mov dword [ebp - 0xc], ecx
je 0x10005d37
cmp dword [ebp - 0x18], eax
je 0x10005b22
pop edi
pop ebx
pop esi
leave
ret