Function at 0x180014e30
Capabilities:
Create directory
Delete directory
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov r13, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], al
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], bl
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], bl
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], bl
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rbp + 0x100]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180014ee2
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.180014bc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [0x180043930]
movups xmmword [rbp - 0x28], xmm1
mov ecx, dword [0x180043940]
mov dword [rbp - 0x18], ecx
movzx ecx, byte [0x180043944]
mov byte [rbp - 0x14], cl
mov ecx, eax
test eax, eax
jns 0x180014f38
neg ecx
mov byte [rbp - 0x10], 0x2d
shr eax, 0x1f
mov r8d, eax
mov r9d, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
movzx ecx, byte [rbp + rcx - 0x38]
mov byte [rbp + r8 - 0x10], cl
inc r9d
inc r8
mov ecx, edx
test edx, edx
jne 0x180014f41
movsxd rcx, r9d
mov byte [rbp + rcx - 0x10], dl
mov ecx, ebx
cmp byte [rbp - 0x10], 0x2d
sete cl
sub r9d, ecx
lea eax, [r9 - 1]
cdq
sub eax, edx
sar eax, 1
mov edx, ecx
movsxd r9, eax
cmp rdx, r9
jg 0x180014fbc
sub r8, rdx
lea r8, [rbp + r8 - 0x11]
nop word [rax + rax]
movzx ecx, byte [rbp + rdx - 0x10]
movzx eax, byte [r8]
mov byte [rbp + rdx - 0x10], al
mov byte [r8], cl
inc rdx
lea r8, [r8 - 1]
cmp rdx, r9
jle 0x180014fa0
lea rax, [rbp - 0x10]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180014fc0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180015010
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
xor ebx, ebx
jmp 0x180015029
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180012460
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r12, qword [rsp + 0x30]
movabs rdi, 0x7fffffffffffffff
movabs rdx, 0x8000000000000000
mov r15, qword [rsp + 0x68]
cmp r14, r15
ja 0x1800150a9
lea rbx, [rsp + 0x50]
cmp r15, 0xf
cmova rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], r14
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
mov rbx, qword [rsp + 0x50]
jmp 0x18001518c
cmp r14, rdi
ja 0x1800156f2
mov rsi, r14
or rsi, 0xf
cmp rsi, rdi
jbe 0x1800150c7
mov rsi, rdi
lea rcx, [rdx + 0x27]
jmp 0x18001510a
mov rcx, r15
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r15, rax
jbe 0x1800150e1
mov rsi, rdi
lea rcx, [rdx + 0x27]
jmp 0x18001510a
lea rax, [rcx + r15]
cmp rsi, rax
cmovb rsi, rax
lea rax, [rsi + 1]
test rax, rax
je 0x180015131
cmp rax, 0x1000
jb 0x180015126
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x1800156f8
call fcn.18003ced0
test rax, rax
je 0x1800154e5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180015131
mov rcx, rax
call fcn.18003ced0
mov rbx, rax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rsi
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
cmp r15, 0xf
jbe 0x180015187
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800154e5
call fcn.18003cf0c
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x1800151d7
lea rax, [rcx + 6]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 6
lea rdx, str....._
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
jmp 0x1800151f9
mov qword [rsp + 0x20], 6
lea r9, str....._
xor r8d, r8d
mov edx, 6
lea rcx, [rsp + 0x50]
call fcn.180012460
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r12, qword [rsp + 0x30]
mov r15, qword [rbp - 0x58]
cmp r14, r15
ja 0x180015260
lea rbx, [rbp - 0x70]
cmp r15, 0xf
cmova rbx, qword [rbp - 0x70]
mov qword [rbp - 0x60], r14
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r14], 0
mov rbx, qword [rbp - 0x70]
jmp 0x180015344
cmp r14, rdi
ja 0x1800156f2
mov rsi, r14
or rsi, 0xf
cmp rsi, rdi
jbe 0x180015288
mov rsi, rdi
movabs rcx, 0x8000000000000000
add rcx, 0x27
jmp 0x1800152c6
mov rcx, r15
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r15, rax
ja 0x180015275
lea rax, [r15 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rax, [rsi + 1]
test rax, rax
jne 0x1800152b1
xor ebx, ebx
jmp 0x1800152ed
cmp rax, 0x1000
jb 0x1800152e2
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x1800156f8
call fcn.18003ced0
test rax, rax
je 0x1800154e5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800152ed
mov rcx, rax
call fcn.18003ced0
mov rbx, rax
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rsi
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
cmp r15, 0xf
jbe 0x180015340
lea rdx, [r15 + 1]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001533b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800154e5
call fcn.18003cf0c
mov qword [rbp - 0x70], rbx
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x18001538b
lea rax, [rcx + 0x13]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 0x13
lea rdx, str.....TemporaryFile
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], 0
jmp 0x1800153ac
mov qword [rsp + 0x20], 0x13
lea r9, str.....TemporaryFile
xor r8d, r8d
mov edx, 0x13
lea rcx, [rbp - 0x70]
call fcn.180012460
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rsi, qword [rsp + 0x40]
lea r15, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r15, qword [rsp + 0x30]
mov r14, qword [rbp - 0x78]
cmp rsi, r14
ja 0x180015411
lea rbx, [rsp + 0x70]
cmp r14, 0xf
cmova rbx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rsi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x70]
jmp 0x1800154f6
cmp rsi, rdi
ja 0x1800156f2
mov rcx, rsi
or rcx, 0xf
cmp rcx, rdi
ja 0x18001546a
mov rdx, r14
shr rdx, 1
mov rax, rdi
sub rax, rdx
cmp r14, rax
ja 0x18001546a
lea rax, [rdx + r14]
mov rdi, rcx
cmp rcx, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x180015452
xor ebx, ebx
jmp 0x18001549b
cmp rcx, 0x1000
jb 0x180015493
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800156f8
jmp 0x180015478
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18003ced0
test rax, rax
je 0x1800154e5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001549b
call fcn.18003ced0
mov rbx, rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
cmp r14, 0xf
jbe 0x1800154f1
lea rdx, [r14 + 1]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800154ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800154ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003cf0c
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x18001553e
lea rax, [rcx + 0xe]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 0xe
lea rdx, str.TemporaryFile
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
jmp 0x180015560
mov qword [rsp + 0x20], 0xe
lea r9, str.TemporaryFile
xor r8d, r8d
mov edx, 0xe
lea rcx, [rsp + 0x70]
call fcn.180012460
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1800155de
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800155d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800155d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003cf0c
xor ebx, ebx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x18001562e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015629
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003cf0c
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18001567e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180015679
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003cf0c
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1800156d1
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800156cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800156cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003cf0c
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180011e40
nop
call fcn.180011e20
int3