Function at 0x140064a84
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
xor edx, edx
mov r15d, ebx
mov r12, rcx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov r14, rax
test rax, rax
jne 0x140064ad9
mov eax, 0x2714
jmp 0x140064cf1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
cmp dword [rax + 0x22c], ebx
je 0x140064b08
mov ecx, 0x7f
call fcn.140055b80
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
or eax, 0xffffffff
jmp 0x140064cf1
mov r13d, 0x106
lea rax, [rsp + 0x30]
mov r8, rdi
lea rcx, [rsp + 0x30]
mov edx, r13d
sub r8, rax
lea rax, [rdx + 0x7ffffef8]
test rax, rax
je 0x140064b41
mov al, byte [r8 + rcx + 4]
test al, al
je 0x140064b41
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140064b21
test rdx, rdx
lea rax, [rcx - 1]
mov r8, rdi
mov rdx, r13
cmovne rax, rcx
lea rcx, [rbp + 0x40]
mov byte [rax], bl
lea rax, [rbp + 0x40]
sub r8, rax
lea rax, [rdx + 0x7ffffef8]
test rax, rax
je 0x140064b7f
mov al, byte [r8 + rcx + 4]
test al, al
je 0x140064b7f
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140064b5f
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
lea rcx, [rsp + 0x30]
mov byte [rax], bl
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x140064b95
test rax, rax
sete bl
test rax, rax
je 0x140064cd6
mov r8d, 2
mov byte [rsp + rax + 0x2f], 0x24
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140064900
mov ebx, eax
test eax, eax
jne 0x140064cd6
mov rcx, qword [rdi + 0x210]
mov dword [rsp + 0x20], 1
cmp rcx, 0xffffffffffffffff
je 0x140064be9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r15, [rdi + 4]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov ebx, eax
test eax, eax
je 0x140064c32
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8d, 2
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.140064900
mov ebx, eax
test eax, eax
jne 0x140064cd1
lea r8, [rbp + 0x40]
mov dword [rsp + 0x20], 1
sub r8, r15
mov rcx, r15
lea rax, [r13 + 0x7ffffef8]
test rax, rax
je 0x140064c63
mov al, byte [r8 + rcx]
test al, al
je 0x140064c63
mov byte [rcx], al
inc rcx
sub r13, 1
jne 0x140064c44
lea rax, [rcx - 1]
test r13, r13
mov edx, 2
cmovne rax, rcx
lea rcx, [rbp + 0x40]
mov byte [rax], 0
call fcn.14007d020
cmp rax, 0xffffffffffffffff
jne 0x140064c8c
mov ebx, 0x2713
jmp 0x140064cd1
and dword [rdi + 0x22c], 0
mov rcx, r15
mov qword [rdi + 0x210], rax
call fcn.140060fd8
test eax, eax
je 0x140064cbb
mov rcx, qword [rdi + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 0x210], 0xffffffffffffffff
mov edx, 5
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, rax
call fcn.140071a88
mov r15d, dword [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r15d, r15d
je 0x140064cef
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14008a940
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret