Function at 0x1800325b0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
xor r12d, r12d
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
call fcn.18000f420
mov qword [rbp - 0x29], rax
mov r8, rbx
lea rcx, [rbp - 0x59]
call fcn.180032070
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1800320c0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x29]
call fcn.18000c550
nop
lea rcx, [rbp - 0x51]
call fcn.180001e50
lea rcx, [rbp - 0x29]
call fcn.18000cb50
mov r14d, eax
test eax, eax
jne 0x180032a27
mov qword [rbp - 1], 7
mov qword [rbp - 9], r12
mov word [rbp - 0x19], r12w
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r12
mov qword [rbp - 0x61], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x69], r12
mov byte [rbp - 0x79], al
lea r8d, [r12 + 4]
lea rdx, str.down
lea rcx, [rbp - 0x79]
call fcn.1800020b0
nop
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], r14b
lea r8d, [r12 + 1]
lea rdx, [0x180059f18]
lea rcx, [rsp + 0x30]
call fcn.1800020b0
nop
lea r8, [rbp + 7]
lea rdx, [rbp - 0x79]
lea rcx, [rsp + 0x30]
call fcn.18000cf40
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x180032721
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x18003271c
test cl, 0x1f
je 0x1800326ef
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800326fe
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18003270d
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180032719
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], 0
mov rax, qword [rbp - 0x61]
cmp rax, 0x10
jb 0x18003278a
inc rax
mov rcx, qword [rbp - 0x79]
cmp rax, 0x1000
jb 0x180032785
test cl, 0x1f
je 0x180032758
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180032767
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180032776
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180032782
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x61], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x69], r12
mov byte [rbp - 0x79], 0
mov r8d, 1
lea rdx, [0x180059f18]
lea rcx, [rbp - 0x79]
call fcn.1800020b0
nop
mov rdx, r15
lea rcx, [rbp - 0x59]
call fcn.180031670
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180031670
nop
lea r9, [rbp - 0x19]
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.18000d310
mov r14d, eax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x18003283c
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x180032837
test cl, 0x1f
je 0x18003280a
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180032819
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180032828
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180032834
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x30], 0
mov rax, qword [rbp - 0x41]
cmp rax, 0x10
jb 0x1800328a5
inc rax
mov rcx, qword [rbp - 0x59]
cmp rax, 0x1000
jb 0x1800328a0
test cl, 0x1f
je 0x180032873
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180032882
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180032891
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18003289d
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x49], r12
mov byte [rbp - 0x59], 0
mov rax, qword [rbp - 0x61]
cmp rax, 0x10
jb 0x18003290b
inc rax
mov rcx, qword [rbp - 0x79]
cmp rax, 0x1000
jb 0x180032906
test cl, 0x1f
je 0x1800328d9
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800328e8
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800328f7
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180032903
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
test r14d, r14d
jne 0x18003296d
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18003296d
cmp qword [rdi + 0x18], 8
jb 0x180032932
mov rdi, qword [rdi]
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
mov r8d, 3
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18003296d
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r14d, 0xfffffffe
mov rsi, qword [rbp + 7]
test rsi, rsi
je 0x1800329a7
mov rbx, rsi
mov rdi, qword [rbp + 0xf]
cmp rsi, rdi
je 0x180032993
mov rcx, rbx
call fcn.180001e50
add rbx, 0x20
cmp rbx, rdi
jne 0x180032982
mov r8, qword [rbp + 0x17]
sub r8, rsi
sar r8, 5
mov rdx, rsi
call fcn.18000a480
nop
mov rax, qword [rbp - 1]
cmp rax, 8
jb 0x180032a16
inc rax
mov rcx, qword [rbp - 0x19]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x1800329cd
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x180032a11
test byte [rbp - 0x19], 0x1f
je 0x1800329e4
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800329f3
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x180032a02
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x180032a0e
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 1], 7
mov qword [rbp - 9], r12
mov word [rbp - 0x19], r12w
mov r8, qword [rbp - 0x29]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x29]
call fcn.18000e170
mov rcx, qword [rbp - 0x29]
call fcn.180033ed0
mov eax, r14d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180033e70
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret