Function at 0x18019f960
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x438
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov rax, qword [rsp + 0x440]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x18019f99e
cmp dword [rsp + 0x48], 1
je 0x18019faa7
jmp 0x18019feda
mov rax, qword [rsp + 0x440]
add rax, 0xb8
mov rcx, rax
call fcn.1800736f0
mov rax, qword [rsp + 0x440]
add rax, 0xb8
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x440]
add rcx, 0x58
call fcn.180073860
mov rcx, qword [rsp + 0x440]
mov rcx, qword [rcx]
xor r9d, r9d
mov rdx, qword [rsp + 0xa8]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rcx + 0x48]
call fcn.180163130
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x18019fa2a
mov rax, qword [rsp + 0x440]
add rax, 0xb8
mov rcx, rax
call fcn.1800738f0
movzx eax, al
test eax, eax
je 0x18019faa0
mov rax, qword [rsp + 0x440]
add rax, 0x58
mov rcx, rax
call fcn.180073860
mov rcx, qword [rsp + 0x440]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x48]
mov r9, rax
mov r8d, dword [rcx + 0x20]
lea rdx, [0x1803a5510]
lea rcx, [rsp + 0x1a8]
call fcn.1801e9200
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x440]
add rax, 0xd8
mov rdx, qword [rsp + 0xf8]
mov rcx, rax
call fcn.180073190
lea rcx, [rsp + 0x1a8]
call fcn.180073360
jmp 0x18019feda
mov al, 1
jmp 0x18019fede
mov rdx, qword [0x1803babf0]
lea rcx, [rsp + 0x100]
call fcn.1801e98d0
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x440]
add rax, 0x98
mov rdx, rax
lea rcx, [rsp + 0x228]
call fcn.1801a2ad0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov rdx, qword [0x1803babf0]
lea rcx, [rsp + 0x168]
call fcn.1801e63d0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xa0]
call fcn.180074060
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xd0]
call fcn.180074060
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
lea r9, [0x1803a5530]
mov r8, rax
lea rdx, [0x1803a5548]
lea rcx, [rsp + 0x78]
call fcn.1801e9260
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x168]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x228]
call fcn.180073fc0
lea rcx, [rsp + 0x100]
call fcn.180074060
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x78]
call fcn.180074060
mov rcx, qword [rsp + 0xf0]
mov rdx, rcx
mov rcx, rax
call fcn.18017dc80
test eax, eax
jne 0x18019fbe9
mov byte [rsp + 0x43], 1
lea rcx, [rsp + 0x78]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x100]
call fcn.180073fc0
movzx eax, byte [rsp + 0x43]
jmp 0x18019fede
mov rax, qword [rsp + 0x440]
add rax, 0xb8
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.1801a2ad0
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x78]
call fcn.180074060
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xc0]
call fcn.180074060
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18019fc4a
mov dword [rsp + 0x4c], 1
jmp 0x18019fc52
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0x4c]
mov byte [rsp + 0x40], al
lea rcx, [rsp + 0x1e8]
call fcn.180073fc0
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x18019fd45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x440]
add rcx, 0x98
call fcn.180073860
mov ecx, dword [rsp + 0x50]
mov r9d, ecx
mov r8, rax
lea rdx, [0x1803a5560]
lea rcx, [rsp + 0x248]
call fcn.1801e9200
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x440]
add rax, 0xd8
mov rdx, qword [rsp + 0x98]
mov rcx, rax
call fcn.180073190
lea rcx, [rsp + 0x248]
call fcn.180073360
mov rax, qword [rsp + 0x440]
add rax, 0xb8
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.1801a2ad0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180074060
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x188]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x78]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x100]
call fcn.180073fc0
jmp 0x18019feda
lea rcx, [rsp + 0x130]
call fcn.1800740e0
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x78]
call fcn.180074060
xor edx, edx
mov rcx, rax
call fcn.1802bf510
xor r8d, r8d
lea rdx, [0x1803a5580]
mov rcx, qword [0x1803babd0]
call fcn.1802bfe70
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x78]
call fcn.180074060
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1802b2098
lea rcx, [rsp + 0x100]
call fcn.180074060
xor edx, edx
mov rcx, rax
call fcn.1802bf450
lea rcx, [rsp + 0x270]
call fcn.1800a5fd0
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x270], 2
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1c8]
call fcn.1801a2a70
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x2d0]
call fcn.180073190
lea rcx, [rsp + 0x1c8]
call fcn.180073360
mov rax, qword [rsp + 0x440]
mov rdx, qword [rax]
lea rcx, [rsp + 0x310]
call fcn.1801a3350
mov qword [rsp + 0x128], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x310]
call fcn.1801a05f0
mov byte [rsp + 0x42], al
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x45], al
lea rcx, [rsp + 0x310]
call fcn.18005cce0
nop
lea rcx, [rsp + 0x270]
call fcn.1800a6370
mov byte [rsp + 0x44], 1
lea rcx, [rsp + 0x130]
call fcn.1800748f0
nop
lea rcx, [rsp + 0x78]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x100]
call fcn.180073fc0
movzx eax, byte [rsp + 0x44]
jmp 0x18019fede
jmp 0x18019fedc
xor al, al
add rsp, 0x438
ret