Function at 0x63a7f0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xc8], rbp
nop
lea rcx, [rbp + 0xe0]
mov rax, qword [0x00a8dd40]
mov rdx, qword [rax]
xor r8, r8
lea r9, [0x0063af28]
call fcn.00480810
lea rcx, [rbp + 0xc0]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0xc0]
mov edx, 7
call fcn.00480590
mov byte [0x00a99740], 0
mov rcx, qword [0x005fd8a0]
mov dl, 1
xor r8, r8
call fcn.00617c60
mov qword [rbp + 0xe8], rax
nop
mov rax, qword [rbp + 0xe8]
add rax, 0x190
mov rcx, qword [0x00a99758]
mov qword [rax + 8], rcx
lea rcx, [0x0063a0b0]
mov qword [rax], rcx
mov rax, qword [rbp + 0xe8]
add rax, 0x120
mov rcx, qword [0x00a99758]
mov qword [rax + 8], rcx
lea rcx, [0x0063a2c0]
mov qword [rax], rcx
mov rax, qword [rbp + 0xe8]
add rax, 0x200
mov rcx, qword [0x00a99758]
mov qword [rax + 8], rcx
lea rcx, [0x0063a340]
mov qword [rax], rcx
mov rcx, qword [rbp + 0xe8]
add rcx, 0x78
mov rdx, qword [rbp + 0xe0]
call fcn.0040e6f0
mov rcx, qword [rbp + 0xe8]
mov dx, 0xff00
call fcn.00617570
mov rax, qword [rbp + 0xe8]
mov byte [rax + 0x248], 0
mov rax, qword [rbp + 0xe8]
mov byte [rax + 0x102], 1
cmp qword [0x00a996e0], 0
je 0x63aa43
mov rax, qword [rbp + 0xe8]
movzx rcx, byte [0x00a996e8]
mov byte [rax + 0x233], cl
lea rcx, [rbp + 0xb8]
mov rdx, qword [0x00a996e0]
xor r8, r8
call fcn.0040f6a0
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xe8]
mov rbx, qword [rax]
call qword [rbx + 0x80]
mov rcx, qword [rbp + 0xe8]
mov dl, 3
call fcn.00609770
mov rcx, qword [rbp + 0xe8]
mov dl, 9
call fcn.006097c0
mov rcx, qword [rbp + 0xe8]
add rcx, 0x98
mov rax, qword [0x00a8dd40]
mov rdx, qword [rax]
call fcn.0040e6f0
mov rcx, qword [rbp + 0xe8]
xor rdx, rdx
call fcn.00609450
lea rcx, [rbp + 0xb0]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xb0]
mov r8d, 0x28bf
xor r9, r9
call fcn.00617a30
nop
mov rcx, qword [rbp + 0xe8]
call fcn.0040ae10
mov rcx, qword [rbp + 0xe0]
call fcn.00480050
cmp rax, 0x19
jge 0x63ab33
mov rcx, qword [rbp + 0xe0]
call fcn.00480050
lea rcx, [rbp + 0xa0]
mov rdx, rax
call fcn.0042bdf0
lea rcx, [rbp + 0xa8]
lea rdx, [0x0063af40]
mov r8, qword [rbp + 0xa0]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0xa8]
call fcn.0047cfa0
mov byte [0x00a99740], 1
cmp byte [0x00a99740], 1
jne 0x63aba9
mov rcx, qword [rbp + 0xe0]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne al
test al, al
jne 0x63ae31
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x90]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x98]
lea rdx, [0x0063af94]
mov r8, qword [rbp + 0x90]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x98]
call fcn.0047cfa0
jmp 0x63ae31
lea rcx, [rbp + 0x88]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x88]
xor rdx, rdx
call fcn.00480100
movsd qword [rbp + 0xd0], xmm0
movsd xmm0, qword [rbp + 0xd0]
ucomisd xmm0, qword [0x0063ae70]
jp 0x63ac42
jne 0x63ac42
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x78]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x80]
lea rdx, [0x0063afe0]
mov r8, qword [rbp + 0x78]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x80]
call fcn.0047cfa0
call fcn.00433700
movsd qword [rbp + 0xd0], xmm0
mov rcx, qword [rbp + 0xe0]
movsd xmm1, qword [rbp + 0xd0]
xor r8, r8
call fcn.00480370
test al, al
jne 0x63ac98
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x68]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x70]
lea rdx, [0x0063b034]
mov r8, qword [rbp + 0x68]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x70]
call fcn.0047cfa0
mov rcx, qword [rbp + 0xe0]
call fcn.0040feb0
mov rbx, rax
lea rcx, [rbp + 0x60]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8da40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x60]
call fcn.0040feb0
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_MoveFileW
test eax, eax
setne al
test al, al
jne 0x63ad81
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x58]
lea rdx, [0x0063b088]
mov r8, qword [rbp + 0x50]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x58]
call fcn.0047cfa0
mov rcx, qword [rbp + 0xe0]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne al
test al, al
jne 0x63ae31
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x40]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x48]
lea rdx, [0x0063b0cc]
mov r8, qword [rbp + 0x40]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x48]
call fcn.0047cfa0
jmp 0x63ae31
lea rcx, [rbp + 0x38]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x38]
call fcn.0040feb0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne al
test al, al
jne 0x63adf3
call sub.kernel32.dll_GetLastError_2
mov dword [rbp + 0xdc], eax
lea rcx, [rbp + 0x28]
mov edx, dword [rbp + 0xdc]
call fcn.00435d20
lea rcx, [rbp + 0x30]
lea rdx, [0x0063b118]
mov r8, qword [rbp + 0x28]
call fcn.004102f0
mov cx, 1
mov rdx, qword [rbp + 0x30]
call fcn.0047cfa0
lea rcx, [rbp + 0x20]
mov rax, qword [0x00a8ddd0]
mov rdx, qword [rax]
mov rax, qword [0x00a8df40]
mov r8, qword [rax]
call fcn.004102f0
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.0042cb00
cmp al, 1
jne 0x63ae30
mov cx, 1
lea rdx, [0x0063b164]
call fcn.0047cfa0
nop
lea rcx, [rbp + 0x20]
mov edx, 0x13
call fcn.0040e160
lea rcx, [rbp + 0xb8]
call fcn.0040e0d0
lea rcx, [rbp + 0xc0]
call fcn.0040e080
lea rcx, [rbp + 0xe0]
call fcn.0040e080
lea rsp, [rbp + 0xf8]
pop rbx
pop rbp
ret