Function at 0x4470b0
Capabilities:
Delete file
Get file size
Move file
Timestomp file

Disassembly:
push rbp
push rbx
sub rsp, 0x188
mov rbp, rsp
mov qword [rbp + 0x78], r8
mov qword [rbp + 0x80], r9
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x1a0], rcx
mov qword [rbp + 0x1a8], rdx
lea rcx, [rbp + 0x1a0]
call fcn.0040bf00
lea rcx, [rbp + 0x1a8]
call fcn.0040bf00
nop
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
mov r9d, dword [rbp + 0x1c0]
call fcn.00444b80
test al, al
je 0x44791d
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x170]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x447247
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
cmp qword [rbp + 0x170], 0
jne 0x447262
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
cmp qword [rbp + 0x170], 0x10
jle 0x4472c1
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xe8]
lea r9, [rbp + 0xf0]
mov byte [rsp + 0x20], 0
call fcn.00444860
test al, al
je 0x4472c1
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
lea rcx, [rbp + 0x108]
mov rdx, qword [rbp + 0x1a8]
call fcn.00414390
xor eax, eax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x4472e5
mov eax, dword [rcx - 4]
mov rcx, qword [rbp + 0x80]
mov rcx, qword [rcx]
test rcx, rcx
je 0x4472f8
mov rcx, qword [rcx - 8]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x1a8]
mov r9d, ecx
lea rcx, [rbp + 0xfe]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xff]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x16c]
mov qword [rsp + 0x30], rcx
mov rcx, qword [0x00463f38]
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov rcx, qword [0x00463f38]
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x00464168]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], 1
mov rcx, rdx
mov rdx, r8
mov r8d, eax
call fcn.004431c0
lea rcx, [rbp + 0x160]
mov rdx, qword [0x0042ee20]
call fcn.00410600
lea rcx, [rbp + 0x160]
mov rdx, qword [0x0042ee20]
mov r8d, 1
mov r9d, dword [rbp + 0x16c]
call fcn.00410430
mov rax, qword [rbp + 0x160]
mov byte [rax + 1], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 3], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 5], 0
mov rax, qword [rbp + 0x160]
mov byte [rax + 7], 0
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x160]
mov rax, qword [rbp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.004442e0
test al, al
jne 0x447460
lea rcx, [rbp + 0xd8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xd8]
call fcn.00443770
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
lea rcx, [rbp + 0x158]
lea rdx, [rbp + 0x150]
xor r8, r8
call fcn.00443910
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x148]
lea r8, [rbp + 0x138]
lea r9, [rbp + 0x140]
call sub.kernel32.dll_GetFileTime
test eax, eax
jne 0x4474af
mov dword [rbp + 0x148], 0
mov dword [rbp + 0x14c], 0
lea rcx, [rbp + 0x130]
mov edx, dword [rbp + 0x148]
call fcn.00430990
lea rcx, [rbp + 0x128]
mov edx, dword [rbp + 0x14c]
call fcn.00430990
cmp dword [rbp + 0x148], 0
jne 0x4474e5
cmp dword [rbp + 0x14c], 0
je 0x44751a
mov dword [rbp + 0x148], 1
mov dword [rbp + 0x14c], 0
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x148]
lea r8, [rbp + 0x138]
lea r9, [rbp + 0x140]
call sub.kernel32.dll_SetFileTime
lea rcx, [rbp + 0x130]
lea rdx, [rbp + 0x128]
lea r8, [rbp + 0x120]
call fcn.004300b0
lea rcx, [rbp + 0x108]
lea rdx, [0x00447a50]
mov r8, qword [rbp + 0x108]
call fcn.0040ca10
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x118]
call fcn.00430db0
lea rcx, [rbp + 0x120]
lea rdx, [rbp + 0x118]
lea r8, [rbp + 0x120]
call fcn.004300b0
lea rcx, [rbp + 0x110]
mov rdx, qword [0x0042ee20]
call fcn.00410600
lea rcx, [rbp + 0x110]
mov rdx, qword [0x0042ee20]
mov r8d, 1
mov r9d, 0x10
call fcn.00410430
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x4475bd
mov rax, qword [rax - 8]
mov rcx, qword [rbp + 0x120]
mov edx, eax
mov r8, qword [rbp + 0x110]
call fcn.00446e40
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x120]
lea r8, [rbp + 0x120]
call fcn.004300b0
lea rcx, [rbp + 0x118]
mov rdx, qword [0x0042ee20]
call fcn.00410600
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x44760f
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x118]
mov rdx, qword [0x0042ee20]
mov r8d, 1
mov r9, rax
call fcn.00410430
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x44763b
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x78]
lea r8, [rbp + 0x158]
lea r9, [rbp + 0x118]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x28], rax
call fcn.00435c80
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x80]
lea r8, [rbp + 0x158]
movzx r9, byte [rbp + 0xff]
movzx rax, byte [rbp + 0xfe]
mov byte [rsp + 0x20], al
lea rax, [rbp + 0x118]
mov qword [rsp + 0x28], rax
call fcn.00441ae0
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x4476b3
mov rbx, qword [rbx - 8]
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8d, ebx
lea r9, [rbp + 0x160]
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x20], rax
call fcn.004442e0
test al, al
jne 0x44773f
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xc8]
call fcn.00443770
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
xor r9, r9
call fcn.00444b80
test al, al
je 0x44791d
mov rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x170]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x447798
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
xor eax, eax
cmp qword [rbp + 0x170], 0x10
jle 0x4477e4
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0xc0]
lea r9, [rbp + 0xf0]
mov byte [rsp + 0x20], 0
call fcn.00444860
cmp al, 2
je 0x4477fa
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
jmp 0x44791d
mov rcx, qword [rbp + 0x178]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x100]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x170]
movzx r9, byte [rbp + 0xff]
mov byte [rsp + 0x20], 1
call fcn.0042ef80
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
call fcn.0042f780
mov rcx, qword [rbp + 0xb8]
call fcn.0040d180
mov rbx, rax
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x100]
call fcn.0040d230
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
call fcn.0042f780
mov rcx, qword [rbp + 0xa8]
call fcn.0040d180
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x44791d
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
mov rcx, qword [rbp + 0x98]
call fcn.0042fe80
test al, al
je 0x44791c
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1a8]
call fcn.0040d230
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x88]
call fcn.0042f780
mov rcx, qword [rbp + 0x90]
call fcn.0040d180
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
nop
lea rcx, [rbp + 0x88]
mov edx, 0xd
call fcn.0040be70
lea rcx, [rbp + 0xf0]
mov rdx, qword [0x0042ee20]
call fcn.00410600
lea rcx, [rbp + 0x100]
call fcn.0040bd90
lea rcx, [rbp + 0x108]
call fcn.0040bd40
lea rcx, [rbp + 0x110]
mov rdx, qword [0x0042ee20]
mov r8d, 5
call fcn.0040ec40
lea rcx, [rbp + 0x150]
mov rdx, qword [0x0042ee20]
mov r8d, 3
call fcn.0040ec40
lea rcx, [rbp + 0x1a0]
mov edx, 2
call fcn.0040be70
lea rsp, [rbp + 0x188]
pop rbx
pop rbp
ret