Function at 0x23194338a
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
cmp qword [rbp + 0x18], 0
je 0x2319433b5
cmp dword [rbp + 0x20], 1
jne 0x2319433b5
mov eax, 0x278
jmp 0x23194371b
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.strlen
add rax, 1
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
call rax
lea rax, [rbp - 0x23]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__1::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_5ull__12248504477067470651ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
call rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0xffffffffffffffff
je 0x231943705
lea rax, [rbp - 0x22]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__2::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__18251808880012363663ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x2319434e1
lea rax, [rbp - 0x21]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__3::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__9758598601459203037ull__char_.operator_char__
mov rdx, rax
mov r8d, dword [0x231b957a0]
mov r9d, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rdx, [0x231a29020]
mov rcx, rax
call sym.f_dpf_cmm_void__void__unsigned_long__int__char_const__char_const__char_const_
mov dword [rbp - 4], eax
jmp 0x231943705
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__4::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__11050658646552295323ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x231943561
lea rax, [rbp - 0x1f]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__5::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__970857007557337565ull__char_.operator_char__
mov rdx, rax
mov r8d, dword [0x231d63d34]
mov r9d, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rdx, [0x231b957c0]
mov rcx, rax
call sym.f_dpf_cmm_void__void__unsigned_long__int__char_const__char_const__char_const_
mov dword [rbp - 4], eax
jmp 0x231943705
lea rax, [rbp - 0x1e]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__6::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__3546306577914391355ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x2319435e1
lea rax, [rbp - 0x1d]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__7::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__3601135367115475233ull__char_.operator_char__
mov rdx, rax
mov r8d, dword [0x231e96c0c]
mov r9d, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rdx, [0x231d63d40]
mov rcx, rax
call sym.f_dpf_cmm_void__void__unsigned_long__int__char_const__char_const__char_const_
mov dword [rbp - 4], eax
jmp 0x231943705
lea rax, [rbp - 0x1c]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__8::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__8731133459963704319ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x231943661
lea rax, [rbp - 0x1b]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__9::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__2859125497775225713ull__char_.operator_char__
mov rdx, rax
mov r8d, dword [0x231e96e98]
mov r9d, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rdx, [0x231e96c20]
mov rcx, rax
call sym.f_dpf_cmm_void__void__unsigned_long__int__char_const__char_const__char_const_
mov dword [rbp - 4], eax
jmp 0x231943705
lea rax, [rbp - 0x1a]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__10::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__7346395056683689739ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x2319436de
lea rax, [rbp - 0x19]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__11::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__10354762414161236447ull__char_.operator_char__
mov rdx, rax
mov r8d, dword [0x231ec7f98]
mov r9d, dword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rdx, str.MSCF
mov rcx, rax
call sym.f_dpf_cmm_void__void__unsigned_long__int__char_const__char_const__char_const_
mov dword [rbp - 4], eax
jmp 0x231943705
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov dword [rbp - 4], 0x57
cmp qword [rbp - 0x10], 0
je 0x231943718
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.operator_delete___void_
mov eax, dword [rbp - 4]
add rsp, 0x70
pop rbp
ret