Function at 0x10002ab8c
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x500
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1000cc510]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov r13, r8
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x90], rdx
xor ebx, ebx
mov dword [rsp + 0x8c], ebx
mov word [rsp + 0xd0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xd2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000aa388]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1000aa308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x1000461b9
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov esi, 0x80000000
mov r9d, esi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
cmp eax, ebx
jl 0x1000461ea
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x18]
cmp eax, ebx
jl 0x100046219
movdqu xmm0, xmmword [0x1000a9d70]
movdqu xmmword [rsp + 0xb8], xmm0
movdqu xmmword [rsp + 0xa8], xmm0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x100046248
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x100046268
lea rax, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x100046288
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x100046288
mov eax, ebx
jmp 0x10002ad09
cmp eax, ebx
jne 0x100046292
lea rdx, [rsp + 0x2e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x1000462a2
lea r8, [rsp + 0x2e0]
lea rdx, [rsp + 0xd0]
mov rcx, r12
call fcn.100029f08
jmp 0x10002ad46
cmp eax, ebx
je 0x1000462a9
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x70]
cmp eax, ebx
jl 0x1000462b9
mov dword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edi, 0x40000000
mov r8d, edi
lea rdx, [rsp + 0xd0]
call qword [rax + 0x78]
cmp eax, ebx
jl 0x1000462d6
mov dword [rsp + 0x60], ebx
xor eax, eax
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x1000462f9
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [0x1000aa318]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x40]
cmp eax, ebx
jl 0x10004631c
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edi, 2
mov r8d, edi
mov rdx, qword [rsp + 0x50]
call qword [rax + 0x18]
cmp eax, ebx
jl 0x100046348
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
cmp rdi, rbx
je 0x100046368
cmp rsi, rbx
je 0x100046378
mov rcx, rbx
mov qword [rsp + 0x80], rbx
cmp rdi, rbx
je 0x10002ae58
mov rax, qword [rdi]
lea r8, [rsp + 0x80]
lea rdx, [0x1000aa368]
mov rcx, rdi
call qword [rax]
mov rcx, qword [rsp + 0x80]
cmp rcx, rbx
jne 0x10002afcd
cmp rcx, rbx
jne 0x10002b036
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x68], ebx
mov rdi, qword [rsp + 0x58]
mov rax, qword [rdi]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, ebx
jl 0x1000463c4
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x60]
cmp eax, ebx
jl 0x1000463e1
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x78], eax
jne 0x1000463fe
mov edi, ebx
cmp edi, dword [rsp + 0x68]
jae 0x10002aeee
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call fcn.10002a6dc
inc edi
jmp 0x10002aeb5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, ebx
jl 0x10004640e
mov dword [rsp + 0x8c], 1
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x10002af1d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x10002af2e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x10002af3f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, rbx
je 0x10002af50
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, rbx
je 0x10002af61
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x10002af63
mov r8d, 3
mov rdx, r12
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
cmp eax, ebx
je 0x100046440
mov eax, edi
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1000010a0
add rsp, 0x500
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, rbx
mov qword [rsp + 0x60], rbx
cmp rsi, rbx
je 0x10002affb
mov rax, qword [rsi]
lea r8, [rsp + 0x60]
lea rdx, [0x1000aa378]
mov rcx, rsi
call qword [rax]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x60]
cmp rax, rbx
je 0x100046388
mov r8, qword [rax]
mov rdx, rcx
mov rcx, rax
call qword [r8 + 0x38]
cmp eax, ebx
jl 0x1000463a4
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x10002b029
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
jmp 0x10002ae61
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x10002ae6a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000aa388]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1000aa308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ac28
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ac61
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x18]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ac8b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
call qword [rax + 0x28]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002acc0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x28]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002acdb
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x10002ad09
mov ecx, 0x80070057
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ad11
mov eax, ebx
jmp 0x10002ad46
mov ecx, 0x8000ffff
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ad4e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x70]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ad6b
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov r8d, edi
lea rdx, [rsp + 0xd0]
call qword [rax + 0x78]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ad99
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x28]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002adc1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [0x1000aa318]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x40]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002aded
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov r8d, edi
mov rdx, qword [rsp + 0x50]
call qword [rax + 0x18]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ae0d
mov ecx, 0x80004003
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ae20
mov ecx, 0x80004003
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ae29
mov ecx, 0x80004002
call sub.MFC42u.dll_AfxVerifyLicFile
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x60]
jmp 0x10002b004
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x80]
call qword [rax + 0x38]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002b019
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x60]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002ae8d
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x60]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002aea5
mov ecx, 0x80070057
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002aeb3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ecx, eax
call sub.MFC42u.dll_AfxVerifyLicFile
nop
jmp 0x10002af01
cmp dword [rsp + 0x88], ebx
je 0x10002af84
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x10002af84