Function at 0x23194319a
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x298
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x230], rcx
mov qword [rbp + 0x238], rdx
mov dword [rbp + 0x240], r8d
mov rax, qword [rbp + 0x238]
mov rcx, rax
call sym.strlen
add rax, 1
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x200], rax
mov rdx, qword [rbp + 0x238]
mov rax, qword [rbp + 0x200]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
call rax
lea rax, [rbp - 0x32]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__1::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_5ull__14974322558366718385ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
call rax
mov rax, qword [rbp + 0x238]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1f8], rax
cmp qword [rbp + 0x1f8], 0xffffffffffffffff
je 0x231943ad9
lea rax, [rbp - 0x31]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__2::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__13522455835454207827ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x23194340a
mov edx, dword [0x231b947a0]
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x231a28020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x240], 0
je 0x2319433f6
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp - 1]
mov qword [rbp + 0x1f0], rax
nop
nop
lea rcx, [rbp - 1]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x2d]
mov qword [rbp + 0x1e8], rax
nop
nop
lea rcx, [rbp + 0x2d]
mov rdx, qword [rbp + 0x200]
mov rax, rbp
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp - 0x30]
mov rax, rbp
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
mov rax, rbp
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x2d]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 1]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x2e]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__3::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__4983698286846223833ull__char_.operator_char__
mov rcx, rax
mov rax, qword [rbp + 0x238]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x20c], eax
jmp 0x231943ad9
lea rax, [rbp + 0x2f]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__4::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__17570549706495081933ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x23194359c
mov edx, dword [0x231d62d34]
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x231b947c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x240], 0
je 0x231943588
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp + 0x5f]
mov qword [rbp + 0x1e0], rax
nop
nop
lea rcx, [rbp + 0x5f]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x30]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x8d]
mov qword [rbp + 0x1d8], rax
nop
nop
lea rcx, [rbp + 0x8d]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x60]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x60]
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x8d]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x5f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x8e]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__5::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__11087224280252235243ull__char_.operator_char__
mov rcx, rax
mov rax, qword [rbp + 0x238]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x20c], eax
jmp 0x231943ad9
lea rax, [rbp + 0x8f]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__6::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__11196444842276129261ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x23194374c
mov edx, dword [0x231f399b0]
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x231d62d40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x240], 0
je 0x231943738
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp + 0xbf]
mov qword [rbp + 0x1d0], rax
nop
nop
lea rcx, [rbp + 0xbf]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x90]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0xed]
mov qword [rbp + 0x1c8], rax
nop
nop
lea rcx, [rbp + 0xed]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0xc0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0xc0]
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
lea rax, [rbp + 0xc0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xed]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x90]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xbf]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0xee]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__7::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_7ull__18251808880012363663ull__char_.operator_char__
mov rcx, rax
mov rax, qword [rbp + 0x238]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x20c], eax
jmp 0x231943ad9
lea rax, [rbp + 0xef]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__8::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__3546306577914391355ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x2319438fc
mov edx, dword [0x231f39c34]
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, [0x231f399c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x240], 0
je 0x2319438e8
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp + 0x11f]
mov qword [rbp + 0x1c0], rax
nop
nop
lea rcx, [rbp + 0x11f]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0xf0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x14d]
mov qword [rbp + 0x1b8], rax
nop
nop
lea rcx, [rbp + 0x14d]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x120]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp + 0xf0]
lea rax, [rbp + 0x120]
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x14d]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x11f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x14e]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__9::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__2867482145655985941ull__char_.operator_char__
mov rcx, rax
mov rax, qword [rbp + 0x238]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x20c], eax
jmp 0x231943ad9
lea rax, [rbp + 0x14f]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__10::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__3989032536995744723ull__char_.operator_char__
mov rdx, rax
mov rax, qword [rbp + 0x230]
mov rcx, rax
call sym.strcmp
test eax, eax
sete al
test al, al
je 0x231943aa9
mov edx, dword [0x231f58c30]
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, edx
lea rdx, str.MSCF
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x240], 0
je 0x231943a98
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
lea rax, [rbp + 0x17f]
mov qword [rbp + 0x1b0], rax
nop
nop
lea rcx, [rbp + 0x17f]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x150]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x1a6]
mov qword [rbp + 0x1a8], rax
nop
nop
lea rcx, [rbp + 0x1a6]
mov rdx, qword [rbp + 0x200]
lea rax, [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x180]
mov r8d, 0x8000000
mov rcx, rax
call sym.f_xpc_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____unsigned_long_
lea rax, [rbp + 0x180]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1a6]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x150]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x17f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x1a7]
mov rcx, rax
call sym.f_dpf_char__char_const__int_::lambda__11::operator_____const
mov rcx, rax
call method.ay::obfuscated_data_10ull__3872386999216203527ull__char_.operator_char__
mov rcx, rax
mov rax, qword [rbp + 0x238]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rax, qword [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x20c], eax
jmp 0x231943ad9
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x238]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov dword [rbp + 0x20c], 1
cmp qword [rbp + 0x200], 0
je 0x231943af2
mov rax, qword [rbp + 0x200]
mov rcx, rax
call sym.operator_delete___void_
mov eax, dword [rbp + 0x20c]
jmp 0x231943c95
add rsp, 0x298
pop rbx
pop rbp
ret