Function at 0x18001ddf0
Capabilities:
Create directory
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x1800b3dc8]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov edi, dword [rsp + 0x30]
lea eax, [r9 - 0xa]
mov qword [rsp + 0x60], rdx
mov r15, r8
mov dword [rsp + 0x34], r9d
mov rdx, rcx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
cmp r9d, eax
jbe case.0x18001dec5.0
mov eax, dword [rsp + 0x30]
lea r14d, [r9 - 0xe8]
mov r13d, dword [rsp + 0x30]
lea r9, [0x180000000]
mov r12d, dword [rsp + 0x30]
xor r8d, r8d
mov esi, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov eax, dword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x48], r14d
nop dword [rax + rax]
cmp r14d, 0xf
ja case.default.0x18001dec5
mov ecx, dword [r9 + r14*4 + 0x1e4cc]
add rcx, r9
jmp rcx
mov eax, dword [r15 + 0x10]
test al, 1
je 0x18001dfeb
mov r15d, 0x29
nop dword [rax]
mov eax, r15d
sub eax, 0x28
je 0x18001df10
cmp eax, 1
jne 0x18001dfd5
lea r9, str.Ring0
lea r8, [0x180059254]
lea edx, [rax + 0x1f]
lea rcx, [rbp - 0x50]
call fcn.18004e5f0
jmp 0x18001dfd5
mov r14d, 0x57
cmp r14d, 0x57
je 0x18001dfa8
cmp r14d, 0x39c6
je 0x18001df82
cmp r14d, 0x7335
jne 0x18001dfc1
test r13d, r13d
je 0x18001dfc1
movsxd r8, dword [rsp + 0x4c]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x4c]
cmp ecx, edx
jg 0x18001df7d
mov rax, qword [rsp + 0x70]
add eax, ecx
movsxd rcx, eax
cmp rcx, 0x20
jae 0x18001e4b9
mov byte [rbp + rcx - 0x70], 0
xor r13d, r13d
jmp 0x18001dfc1
sub r13d, edx
jmp 0x18001dfc1
lea rax, [rbp - 0x70]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x18001df90
lea eax, [r13 - 1]
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x4c], eax
jmp 0x18001dfc1
lea rax, [rbp - 0x50]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x18001dfb3
mov qword [rsp + 0x78], rdx
add r14d, 0x396f
cmp r14d, 0xac4d
jbe 0x18001df16
dec r15d
cmp r15d, 0x27
ja 0x18001dee0
mov r15, qword [rsp + 0x58]
mov eax, dword [r15 + 0x10]
test al, 2
je 0x18001e11c
mov r15d, 0x6a
nop dword [rax]
cmp r15d, 0x6a
je 0x18001e0e3
cmp r15d, 0x12a
jne 0x18001e0ff
mov r14d, 0x22
nop dword [rax]
cmp r14d, 0x22
je 0x18001e091
cmp r14d, 0x1694
je 0x18001e087
cmp r14d, 0x2d06
jne 0x18001e0cd
test r13d, r13d
je 0x18001e0cd
movsxd r8, dword [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8, qword [rbp - 0x80]
mov ecx, dword [rsp + 0x50]
cmp ecx, r8d
jg 0x18001e082
mov rax, qword [rbp - 0x78]
add eax, ecx
movsxd rcx, eax
cmp rcx, 0x20
jae 0x18001e4bf
mov byte [rbp + rcx - 0x70], 0
xor r13d, r13d
jmp 0x18001e0cd
sub r13d, r8d
jmp 0x18001e0cd
lea eax, [r13 - 1]
mov dword [rsp + 0x50], eax
jmp 0x18001e0cd
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001e0a0
mov qword [rbp - 0x80], r8
lea rax, [rbp - 0x70]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x18001e0c0
mov qword [rbp - 0x78], rdx
add r14d, 0x1672
cmp r14d, 0x4356
jbe 0x18001e020
jmp 0x18001e0ff
lea r9, str.SMM
mov edx, 0x20
lea r8, [0x180059254]
lea rcx, [rbp - 0x50]
call fcn.18004e5f0
add r15d, 0xc0
cmp r15d, 0x1ea
jb 0x18001e000
mov r15, qword [rsp + 0x58]
mov eax, dword [r15 + 0x10]
test al, 4
je 0x18001e214
mov r15d, 4
nop word [rax + rax]
mov eax, r15d
sub eax, 3
je 0x18001e160
cmp eax, 1
jne 0x18001e202
lea r9, str.logo2x.png
lea r8, [0x180059254]
lea edx, [rax + 0x1f]
lea rcx, [rbp - 0x50]
call fcn.18004e5f0
jmp 0x18001e202
mov r14d, 0x97
mov eax, r14d
sub eax, 0x97
je 0x18001e1ba
cmp eax, 1
jne 0x18001e1f2
test r13d, r13d
je 0x18001e1f2
movsxd r8, dword [rsp + 0x30]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x30]
cmp ecx, eax
jg 0x18001e1b5
lea eax, [rcx + r12]
movsxd rcx, eax
cmp rcx, 0x20
jae 0x18001e4c5
mov byte [rbp + rcx - 0x70], 0
xor r13d, r13d
jmp 0x18001e1f2
sub r13d, eax
jmp 0x18001e1f2
lea rcx, [rbp - 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18001e1c5
mov qword [rsp + 0x68], rax
mov r12, 0xffffffffffffffff
lea rax, [rbp - 0x70]
nop
inc r12
cmp byte [rax + r12], 0
jne 0x18001e1e0
lea eax, [r13 - 1]
mov dword [rsp + 0x30], eax
inc r14d
cmp r14d, 0x99
jb 0x18001e166
dec r15d
cmp r15d, 2
ja 0x18001e130
mov r15, qword [rsp + 0x58]
mov r14d, dword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
lea r9, [0x180000000]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x34]
dec eax
dec r14d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x48], r14d
cmp eax, ecx
ja 0x18001deb0
mov eax, edi
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1800508f0
mov rbx, qword [rsp + 0x758]
add rsp, 0x700
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp + 0x1d0]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xd0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r8d, r8d
test eax, eax
mov edi, r8d
setne dil
jmp 0x18001e21c
xor edx, edx
lea rcx, [0x18005c300]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9d, 0x79
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180003f50
mov r9, rax
lea rcx, [rbp - 0x30]
mov edx, 0x100
mov qword [rsp + 0x20], r15
lea r8, str._s__.9s
call fcn.1800354a0
jmp 0x18001e219
mov esi, dword [rdx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
jmp case.0x18001dec5.6
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001e219
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x18001e219
mov r13d, 0x20
jmp case.0x18001dec5.6
mov eax, 0x8d
cmp eax, 0x8d
je 0x18001e39e
cmp eax, 0x127
je 0x18001e38a
cmp eax, 0x2c1
je 0x18001e3b1
jmp 0x18001e3a5
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
mov qword [r8 + 0x20], rcx
jmp 0x18001e3a5
lea rbx, [0x18005c1f0]
add eax, 0x234
cmp eax, 0x69c
jbe 0x18001e373
mov r9, rbx
lea rcx, [rbp + 0xd0]
jmp 0x18001e2f6
mov r14d, dword [rsp + 0x30]
mov r12d, 0x2b
mov ebx, dword [rsp + 0x30]
mov edi, dword [rsp + 0x30]
mov eax, r12d
sub eax, 0x2a
je 0x18001e400
cmp eax, 1
jne 0x18001e49b
lea r9, [rbp - 0x70]
lea r8, [0x180055368]
lea edx, [rax + 0x1f]
lea rcx, [rbp - 0x50]
call fcn.18004e5f0
jmp 0x18001e49b
mov r9, qword [rsp + 0x60]
mov r15d, 0xfa
nop dword [rax + rax]
mov eax, r15d
sub eax, 0xfa
je 0x18001e466
sub eax, 1
je 0x18001e45e
cmp eax, 1
jne 0x18001e48b
cmp dword [rdx], 0
je 0x18001e48b
movsxd r8, r14d
lea rdx, [rbp - 0x50]
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r9, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
cmp r14d, ebx
jg 0x18001e45a
lea eax, [rdi + r14]
movsxd rcx, eax
xor eax, eax
mov byte [rcx + r9], 0
mov dword [rdx], eax
jmp 0x18001e48b
sub dword [rdx], ebx
jmp 0x18001e48b
mov r14d, dword [rdx]
dec r14d
jmp 0x18001e48b
lea rax, [rbp - 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18001e471
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r9 + rdi], 0
jne 0x18001e481
inc r15d
cmp r15d, 0xfd
jb 0x18001e410
mov rdx, qword [rsp + 0x40]
dec r12d
cmp r12d, 0x29
ja 0x18001e3d3
sub esi, dword [rdx]
mov rax, rdx
mov eax, esi
jmp 0x18001e248
call fcn.1800505d8
int3
call fcn.1800505d8
int3
call fcn.1800505d8
int3