Function at 0x140001410
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r13, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140001490
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x68]
call fcn.1400056b0
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400053e0
nop
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400051a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000151c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001517
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r14, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 6
jb 0x140001e38
lea r12, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r12, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r14 + 6]
mov edi, 0xf
mov ebx, edi
lea rsi, [rsp + 0x40]
movabs rax, 0x8000000000000000
lea edx, [rdi + 7]
cmp r15, rbx
jbe 0x14000160f
mov rbx, r15
or rbx, rdi
cmp rbx, rcx
jbe 0x1400015d6
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x140001690
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000160a
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400015f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e14
jmp 0x1400015b7
test rcx, rcx
je 0x140001608
call fcn.140006660
mov rsi, rax
jmp 0x14000160a
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str....._]
mov dword [rsi + r14], eax
movzx eax, word [0x140008528]
mov word [rsi + r14 + 4], ax
mov byte [rsi + r15], 0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
cmova rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rsp + 0x58]
cmp rdx, rdi
jbe 0x14000169c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001697
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001697
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
mov r14, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x13
jb 0x140001e3e
lea r12, [rsp + 0x68]
cmp qword [rbp - 0x80], rdi
cmova r12, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r14 + 0x13]
mov rbx, rdi
lea rsi, [rsp + 0x40]
cmp r15, rbx
jbe 0x140001766
mov rbx, r15
or rbx, rdi
cmp rbx, rcx
jbe 0x140001727
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x1400017f4
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001761
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001750
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e1a
jmp 0x140001708
test rcx, rcx
je 0x14000175f
call fcn.140006660
mov rsi, rax
jmp 0x140001761
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.....TemporaryFile]
movups xmmword [rsi + r14], xmm0
movzx eax, word [0x140008540]
mov word [rsi + r14 + 0x10], ax
movzx eax, byte [0x140008542]
mov byte [rsi + r14 + 0x12], al
mov byte [rsi + r15], 0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
cmova rdx, qword [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rdx, qword [rsp + 0x58]
cmp rdx, rdi
jbe 0x140001800
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
mov r14, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xe
jb 0x140001e44
lea r12, [rsp + 0x68]
cmp qword [rbp - 0x80], rdi
cmova r12, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r15, [r14 + 0xe]
mov rbx, rdi
lea rsi, [rsp + 0x20]
cmp r15, rbx
jbe 0x1400018ca
mov rbx, r15
or rbx, rdi
cmp rbx, rcx
jbe 0x14000188b
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x140001abf
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400018c5
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400018b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e20
jmp 0x14000186c
test rcx, rcx
je 0x1400018c3
call fcn.140006660
mov rsi, rax
jmp 0x1400018c5
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.TemporaryFile]
movsd qword [rsi + r14], xmm0
mov eax, dword [0x140008550]
mov dword [rsi + r14 + 8], eax
movzx eax, word [0x140008554]
mov word [rsi + r14 + 0xc], ax
mov byte [rsi + r15], 0
lea r12, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 6
jb 0x140001e4a
lea r15, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r15, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r14, [r13 + 6]
mov rbx, rdi
lea rsi, [rsp + 0x40]
cmp r14, rbx
jbe 0x1400019ea
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400019ab
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x140001a6c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400019e5
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400019d4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e26
jmp 0x14000198c
test rcx, rcx
je 0x1400019e3
call fcn.140006660
mov rsi, rax
jmp 0x1400019e5
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
mov r8, r13
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str....._]
mov dword [rsi + r13], eax
movzx eax, word [0x140008528]
mov word [rsi + r13 + 4], ax
mov byte [rsi + r14], 0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001a78
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
movdqa xmm0, xmmword [0x140008970]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001acb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ac6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
mov r14, qword [rsp + 0x78]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x1c
jb 0x140001e50
lea r12, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r12, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r15, [r14 + 0x1c]
mov rbx, rdi
lea rsi, [rsp + 0x20]
cmp r15, rbx
jbe 0x140001b97
mov rbx, r15
or rbx, 0xf
cmp rbx, r13
jbe 0x140001b58
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x140001c25
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001b92
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001b81
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e2c
jmp 0x140001b39
test rcx, rcx
je 0x140001b90
call fcn.140006660
mov rsi, rax
jmp 0x140001b92
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.TemporaryFileTemporaryFile]
movups xmmword [rsi + r14], xmm0
movsd xmm0, qword [0x140008568]
movsd qword [rsi + r14 + 0x10], xmm0
mov eax, dword [0x140008570]
mov dword [rsi + r14 + 0x18], eax
mov byte [rsi + r15], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001c31
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
mov rsi, qword [rsp + 0x78]
mov rax, r13
sub rax, rsi
cmp rax, 0xe
jb 0x140001e0e
lea r15, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r15, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [rsi + 0xe]
lea rbx, [rsp + 0x20]
cmp r14, 0xf
jbe 0x140001cf1
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
jbe 0x140001cb2
mov rdi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006660
test rax, rax
je 0x140001d7c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001cec
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001cdb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e32
jmp 0x140001c93
test rcx, rcx
je 0x140001cea
call fcn.140006660
mov rbx, rax
jmp 0x140001cec
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.TemporaryFile]
movsd qword [rbx + rsi], xmm0
mov eax, dword [0x140008550]
mov dword [rbx + rsi + 8], eax
movzx eax, word [0x140008554]
mov word [rbx + rsi + 0xc], ax
mov byte [rbx + r14], 0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001d88
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140001dde
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000669c
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140006640
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001220
nop
call fcn.140001180
int3
call fcn.140001180
int3
call fcn.140001180
nop
call fcn.140001180
nop
call fcn.140001180
int3
call fcn.140001180
int3
call fcn.140001220
int3
call fcn.140001220
int3
call fcn.140001220
nop
call fcn.140001220
nop
call fcn.140001220
int3