Function at 0x180031c20
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xe8
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
call fcn.18000f420
mov qword [rbp - 0x19], rax
mov r8, rbx
lea rcx, [rbp - 0x69]
call fcn.180032070
nop
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1800320c0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x19]
call fcn.18000c550
nop
lea rcx, [rbp - 0x61]
call fcn.180001e50
lea rcx, [rbp - 0x19]
call fcn.18001df70
mov ebx, eax
test eax, eax
jne 0x180031f2e
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r15
mov word [rbp - 9], r15w
mov qword [rbp - 0x71], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x79], r15
mov byte [rsp + 0x30], al
lea r8d, [r15 + 1]
lea rdx, [0x180059f18]
lea rcx, [rsp + 0x30]
call fcn.1800020b0
nop
mov rdx, rdi
lea rcx, [rbp - 0x69]
call fcn.180031670
mov rdi, rax
mov rdx, r14
lea rcx, [rbp - 0x41]
call fcn.180031670
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800205b0
lea r9, [rbp - 9]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.180020de0
mov ebx, eax
mov rax, qword [rbp - 0x29]
cmp rax, 0x10
jb 0x180031d81
inc rax
mov rcx, qword [rbp - 0x41]
cmp rax, 0x1000
jb 0x180031d7c
test cl, 0x1f
je 0x180031d4f
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180031d5e
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180031d6d
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180031d79
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x31], r15
mov byte [rbp - 0x41], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x180031de7
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x180031de2
test cl, 0x1f
je 0x180031db5
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180031dc4
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180031dd3
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180031ddf
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x59], r15
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x71]
cmp rax, 0x10
jb 0x180031e4e
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x180031e49
test cl, 0x1f
je 0x180031e1c
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180031e2b
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180031e3a
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180031e46
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
test ebx, ebx
jne 0x180031eae
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180031eae
cmp qword [rsi + 0x18], 8
jb 0x180031e74
mov rsi, qword [rsi]
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
mov r8d, 3
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x180031eae
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0xfffffffe
mov rax, qword [rbp + 0xf]
cmp rax, 8
jb 0x180031f1d
inc rax
mov rcx, qword [rbp - 9]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x180031ed4
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x180031f18
test byte [rbp - 9], 0x1f
je 0x180031eeb
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180031efa
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180031f09
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180031f15
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r15
mov word [rbp - 9], r15w
mov r8, qword [rbp - 0x19]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x19]
call fcn.18000e170
mov rcx, qword [rbp - 0x19]
call fcn.180033ed0
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180033e70
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret