Function at 0x1daba2252
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0xffffffffffffffff
je 0x1daba253b
lea rax, [rbp - 0x15]
mov rcx, rax
call sym.f_dpf_char__char_const_::lambda__1::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__4853712405131818253ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x1daba2327
mov edx, dword [0x1dae36bc0]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x1dac85020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x1daba253b
lea rax, [rbp - 0x14]
mov rcx, rax
call sym.f_dpf_char__char_const_::lambda__2::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__14785301942539353593ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x1daba23a3
mov edx, dword [0x1db0a658c]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x1dae36be0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x1daba253b
lea rax, [rbp - 0x13]
mov rcx, rax
call sym.f_dpf_char__char_const_::lambda__3::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__558909356935435235ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x1daba241f
mov edx, dword [0x1db428240]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x1db0a65a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x1daba253b
lea rax, [rbp - 0x12]
mov rcx, rax
call sym.f_dpf_char__char_const_::lambda__4::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__6738803094373365577ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x1daba249b
mov edx, dword [0x1db428c60]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x1db428260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x1daba253b
lea rax, [rbp - 0x11]
mov rcx, rax
call sym.f_dpf_char__char_const_::lambda__5::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__682739098309466553ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x1daba2514
mov edx, dword [0x1db46dc80]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x1db428c80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
jmp 0x1daba253b
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov dword [rbp - 4], 1
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret