Function at 0x100028f9c
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r15d, r15d
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov edi, r15d
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x10002900f
test byte [rcx + 0x1c], 1
je 0x10002900f
cmp byte [rcx + 0x19], 4
jb 0x10002900f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x126
call fcn.10001c7b8
mov ecx, dword [r12 + 0x14c]
or rbp, 0xffffffffffffffff
mov rbx, r15
mov qword [rsp + 0x68], r15
mov rsi, r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x50], r15
mov r13, r15
mov qword [rsp + 0x60], r15
call fcn.1000a31e8
test al, 8
jne 0x100029099
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x100029155
test byte [rcx + 0x1c], 1
je 0x100029155
cmp byte [rcx + 0x19], 4
jb 0x100029155
mov r9d, dword [r12 + 0x14c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x127
call fcn.10001c7dc
jmp 0x100029155
cmp qword [r12 + 0x1d8], r15
jne 0x1000290e3
mov edi, 0x80070057
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x100029155
test byte [rcx + 0x1c], 1
je 0x100029155
cmp byte [rcx + 0x19], 2
jb 0x100029155
mov edx, 0x128
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
call fcn.10001c7b8
jmp 0x100029155
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.100027d20
cmp eax, r15d
mov edi, eax
jge 0x100029188
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x10002912b
test byte [rcx + 0x1c], 1
je 0x10002912b
cmp byte [rcx + 0x19], 2
jb 0x10002912b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x129
mov r9d, eax
call fcn.10001c7dc
mov r14, qword [rsp + 0x50]
cmp r14, r15
je 0x100029146
mov rcx, r14
call fcn.1000a9128
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbp, 0xffffffffffffffff
je 0x100029155
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r14, qword [rsp + 0x50]
cmp r14, r15
jne 0x1000291bb
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029155
test byte [rcx + 0x1c], 1
je 0x100029155
cmp byte [rcx + 0x19], 4
jb 0x100029155
mov edx, 0x12a
jmp 0x1000290d1
mov rcx, qword [r12 + 0x1d8]
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.100120b70
cmp eax, r15d
mov edi, eax
jl 0x10002979e
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
xor r9d, r9d
call fcn.10010b8b4
cmp eax, r15d
mov edi, eax
jge 0x100029247
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029238
test byte [rcx + 0x1c], 1
je 0x100029238
cmp byte [rcx + 0x19], 2
jb 0x100029238
mov r9, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x12b
mov dword [rsp + 0x20], edi
call fcn.10001daa4
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
jmp 0x10002979e
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbp
cmp rbx, r15
je 0x10002977c
movdqu xmm0, xmmword [0x100001fe0]
movdqu xmmword [rsp + 0xf0], xmm0
cmp rsi, r15
je 0x100029283
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x48], r15
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
je 0x10002929e
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x80], r15
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.10009fb8c
cmp eax, r15d
mov edi, eax
jl 0x1000297f7
mov rsi, qword [rsp + 0x48]
lea rdx, [0x100004b00]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r15d
jne 0x100029313
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x100029736
test byte [rcx + 0x1c], 1
je 0x100029736
cmp byte [rcx + 0x19], 4
jb 0x100029736
mov edx, 0x12c
jmp 0x1000293a8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jae 0x10002935d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029736
test byte [rcx + 0x1c], 1
je 0x100029736
cmp byte [rcx + 0x19], 4
jb 0x100029736
mov edx, 0x12d
jmp 0x1000293a8
lea rdx, [rsp + 0xf0]
mov rcx, rsi
mov word [rsi + 0x48], r15w
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r15d
je 0x1000293c0
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029736
test byte [rcx + 0x1c], 1
je 0x100029736
cmp byte [rcx + 0x19], 4
jb 0x100029736
mov edx, 0x12e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov r9, rbx
call fcn.10001da24
jmp 0x100029736
lea rax, [rsp + 0xf0]
lea rcx, [0x100001fe0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000293e6
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000293e6
mov eax, r15d
jmp 0x1000293eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
je 0x100029736
mov r8, qword [rsp + 0x50]
mov ebp, r15d
mov dword [rsp + 0x78], r15d
mov edi, dword [r8 + 0x40]
mov r14, r15
cmp edi, r15d
jbe 0x10002944d
mov eax, ebp
lea rcx, [rsp + 0xf0]
imul rax, rax, 0x78
add rax, qword [r8 + 0x48]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x100029436
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x100029436
mov eax, r15d
jmp 0x10002943b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
je 0x100029449
inc ebp
inc r14
cmp ebp, edi
jb 0x10002940d
mov dword [rsp + 0x78], ebp
cmp ebp, edi
jb 0x100029499
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029731
test byte [rcx + 0x1c], 1
je 0x100029731
cmp byte [rcx + 0x19], 3
jb 0x100029731
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x12f
mov r9, rbx
call fcn.10001da24
jmp 0x100029731
mov r12d, dword [r12 + 0x170]
xor edi, edi
mov esi, r15d
cmp r12d, edi
jbe 0x100029513
mov rdi, qword [rsp + 0x70]
mov rbx, qword [r8 + 0x48]
imul r14, r14, 0x78
mov rdi, qword [rdi + 0xd8]
movzx r13d, word [r14 + rbx + 0x44]
add rdi, 0x70
xor ebp, ebp
cmp r13w, word [rdi - 6]
jne 0x1000294ed
cmp r13w, bp
je 0x1000294ed
mov rdx, qword [rdi]
mov rcx, qword [r14 + rbx + 0x48]
movzx r8d, r13w
call sub.msvcrt.dll_memcmp
cmp eax, ebp
je 0x1000294fe
inc esi
inc r15
add rdi, 0x160
cmp esi, r12d
jb 0x1000294cb
mov rbx, qword [rsp + 0x58]
mov ebp, dword [rsp + 0x78]
mov r13, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
xor edi, edi
cmp esi, r12d
jne 0x10002957a
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x10002956d
test byte [rax + 0x1c], 1
je 0x10002956d
cmp byte [rax + 0x19], 4
jb 0x10002956d
mov edx, ebp
lea rcx, [rsp + 0x88]
imul rdx, rdx, 0x78
add rdx, qword [r8 + 0x48]
call fcn.10009b2bc
mov rcx, qword [0x1001653b8]
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
mov edx, 0x130
mov r9, rax
call fcn.10001da24
mov r12, qword [rsp + 0x70]
xor r15d, r15d
jmp 0x10002972c
mov r12, qword [rsp + 0x70]
imul rsi, rsi, 0x160
mov rax, qword [r12 + 0xd8]
lea rcx, [rsi + rax + 0x44]
mov eax, ebp
imul rax, rax, 0x78
add rax, qword [r8 + 0x48]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000295b3
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000295b3
mov eax, edi
jmp 0x1000295b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x1000295f8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100029572
test byte [rcx + 0x1c], 1
je 0x100029572
cmp byte [rcx + 0x19], 4
jb 0x100029572
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x131
mov r9, rbx
call fcn.10001da24
jmp 0x100029572
cmp r13, rdi
je 0x10002960b
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x60], rdi
mov rax, qword [r12 + 0xd8]
mov rcx, qword [r12 + 0x1d8]
imul r15, r15, 0x160
mov r8d, dword [rax + r15 + 0x54]
lea rdx, [rax + rsi + 0x44]
lea r9, [rsp + 0x60]
call fcn.100120b70
mov edi, eax
xor eax, eax
cmp edi, eax
jl 0x1000297e8
mov rax, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rax, rdi
je 0x1000296cd
test byte [rax + 0x1c], 1
je 0x1000296cd
cmp byte [rax + 0x19], 4
jb 0x1000296cd
mov rcx, qword [r12 + 0xd8]
lea rdi, [0x100005988]
mov rax, qword [rcx + r15 + 0x58]
lea rdx, [rsi + rcx + 0x44]
xor r15d, r15d
cmp rax, r15
lea rcx, [rsp + 0x88]
cmovne rdi, rax
call fcn.10009b2bc
mov rcx, qword [0x1001653b8]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x100003d08]
mov edx, 0x132
mov r9, rbx
mov qword [rsp + 0x20], r13
call fcn.10001e1a4
lea rdi, [0x1001653b8]
jmp 0x1000296d5
mov r13, qword [rsp + 0x60]
xor r15d, r15d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r15d
jne 0x10002972c
mov rax, qword [0x1001653b8]
cmp rax, rdi
je 0x10002972c
test byte [rax + 0x1c], 1
je 0x10002972c
cmp byte [rax + 0x19], 3
jb 0x10002972c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov edx, 0x133
mov r9, rbx
mov qword [rsp + 0x20], r13
call fcn.10001e360
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
cmp rbx, r15
je 0x100029749
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x58], r15
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x58]
xor r9d, r9d
mov rdx, rbp
call fcn.10010bad8
mov rbx, qword [rsp + 0x58]
cmp eax, r15d
mov edi, eax
jl 0x1000297f7
cmp rbx, r15
jne 0x10002925f
mov r14, qword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
or rbp, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x100029799
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x48]
cmp qword [rsp + 0x68], r15
je 0x1000297b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbx, r15
je 0x1000297be
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rsi, r15
je 0x1000297cc
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
je 0x100029130
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100029130
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
xor r15d, r15d
jmp 0x100029789
mov r14, qword [rsp + 0x50]
jmp 0x100029789