Function at 0x64f000
Capabilities:
Delete file
Move file

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], rbp
nop
mov cx, 2
lea rdx, [0x0064f464]
call fcn.0047cfa0
call fcn.0061d8c0
mov rax, qword [0x00a8d628]
cmp qword [rax], 0
je 0x64f113
xor rcx, rcx
mov rax, qword [0x00a8d628]
mov rdx, qword [rax]
call fcn.0047f200
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x64f113
lea rcx, [rbp + 0x88]
mov edx, dword [rbp + 0xa4]
call fcn.00435d20
lea rcx, [rbp + 0x90]
lea rdx, [0x0064f49c]
mov r8, qword [rbp + 0x88]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x90]
call fcn.0047cfa0
mov rax, qword [0x00a8dfe0]
cmp qword [rax], 0
je 0x64f1bd
lea rcx, [rbp + 0x80]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8dfe0]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x80]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [rbp + 0x78]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8dfe0]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x78]
mov dl, 1
call fcn.0042cb00
cmp al, 1
jne 0x64f1bd
lea rcx, [rbp + 0x70]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8dfe0]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x70]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, 4
call sub.kernel32.dll_MoveFileExW
mov rax, qword [0x00a8de78]
cmp qword [rax], 0
je 0x64f261
lea rcx, [rbp + 0x68]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8de78]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x68]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [rbp + 0x60]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8de78]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x60]
mov dl, 1
call fcn.0042cb00
cmp al, 1
jne 0x64f261
lea rcx, [rbp + 0x58]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8de78]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x58]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, 4
call sub.kernel32.dll_MoveFileExW
mov rax, qword [0x00a8df40]
cmp qword [rax], 0
je 0x64f305
lea rcx, [rbp + 0x50]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x50]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [rbp + 0x48]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.0042cb00
cmp al, 1
jne 0x64f305
lea rcx, [rbp + 0x40]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x40]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, 4
call sub.kernel32.dll_MoveFileExW
mov rax, qword [0x00a8da40]
cmp qword [rax], 0
je 0x64f3a9
lea rcx, [rbp + 0x38]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8da40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x38]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
lea rcx, [rbp + 0x30]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8da40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x30]
mov dl, 1
call fcn.0042cb00
cmp al, 1
jne 0x64f3a9
lea rcx, [rbp + 0x28]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8da40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x28]
call fcn.0040feb0
mov rcx, rax
xor rdx, rdx
mov r8d, 4
call sub.kernel32.dll_MoveFileExW
nop
mov ecx, 0xbb8
call fcn.0064e970
jmp 0x64f3f0
nop
lea rcx, [rbp + 0x20]
mov edx, 0xf
call fcn.0040e160
lea rsp, [rbp + 0xb0]
pop rbp
ret