Function at 0x2319433ba
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
cmp qword [rbp + 0x18], 0
je 0x2319433e5
cmp dword [rbp + 0x20], 1
jne 0x2319433e5
mov eax, 0x32
jmp 0x23194373c
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rax, 1
mov rcx, rax
call fcn.231a35480
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
call rax
lea rax, [rbp - 0x23]
mov rcx, rax
call fcn.231942bec
mov rcx, rax
call fcn.231986360
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
call rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0xffffffffffffffff
je 0x231943726
lea rax, [rbp - 0x22]
mov rcx, rax
call fcn.231942c96
mov rcx, rax
call fcn.23198aa40
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
test al, al
je 0x23194350e
lea rax, [rbp - 0x21]
mov rcx, rax
call fcn.231942d48
mov rcx, rax
call fcn.23198a800
mov r8d, dword [0x231ba37a0]
mov r9d, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rax, [0x231a37020]
mov rdx, rax
call fcn.231942a58
mov dword [rbp - 4], eax
jmp 0x231943726
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.231942dfa
mov rcx, rax
call fcn.23198a5c0
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
test al, al
je 0x23194358b
lea rax, [rbp - 0x1f]
mov rcx, rax
call fcn.231942eac
mov rcx, rax
call fcn.23198a920
mov r8d, dword [0x231d71d34]
mov r9d, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rax, [0x231ba37c0]
mov rdx, rax
call fcn.231942a58
mov dword [rbp - 4], eax
jmp 0x231943726
lea rax, [rbp - 0x1e]
mov rcx, rax
call fcn.231942f5e
mov rcx, rax
call fcn.23198b100
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
test al, al
je 0x231943608
lea rax, [rbp - 0x1d]
mov rcx, rax
call fcn.231943010
mov rcx, rax
call fcn.23198ab60
mov r8d, dword [0x231ea4c0c]
mov r9d, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rax, [0x231d71d40]
mov rdx, rax
call fcn.231942a58
mov dword [rbp - 4], eax
jmp 0x231943726
lea rax, [rbp - 0x1c]
mov rcx, rax
call fcn.2319430c2
mov rcx, rax
call fcn.23197a300
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
test al, al
je 0x231943685
lea rax, [rbp - 0x1b]
mov rcx, rax
call fcn.231943180
mov rcx, rax
call fcn.23197ae40
mov r8d, dword [0x231ea4e98]
mov r9d, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rax, [0x231ea4c20]
mov rdx, rax
call fcn.231942a58
mov dword [rbp - 4], eax
jmp 0x231943726
lea rax, [rbp - 0x1a]
mov rcx, rax
call fcn.23194323e
mov rcx, rax
call fcn.23197be00
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
test al, al
je 0x2319436ff
lea rax, [rbp - 0x19]
mov rcx, rax
call fcn.2319432fc
mov rcx, rax
call fcn.23197c4c0
mov r8d, dword [0x231ec3cc8]
mov r9d, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rax, str.MSCF
mov rdx, rax
call fcn.231942a58
mov dword [rbp - 4], eax
jmp 0x231943726
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov dword [rbp - 4], 0x57
cmp qword [rbp - 0x10], 0
je 0x231943739
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.231a35440
mov eax, dword [rbp - 4]
add rsp, 0x70
pop rbp
ret