Function at 0x1400852fc
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x20e0
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x20d0], rax
mov rdi, qword [rsp + 0x2130]
mov r12, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x140085ac7
mov rcx, qword [rcx]
cmp qword [rdi], rcx
jne 0x140085ac7
mov eax, dword [rdi + 0x10]
xor r14d, r14d
mov qword [rsp + 0x40], r14
cmp eax, 0xfffffe34
je 0x1400859a2
cmp eax, 0xfffffe35
je 0x140085945
cmp eax, 0xfffffe36
je 0x1400858f8
cmp eax, 0xfffffe3a
je 0x14008583b
cmp eax, 0xfffffe3d
je 0x1400854c3
cmp eax, 0xfffffe64
je 0x140085482
cmp eax, 0xfffffffb
jne 0x140085ac7
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx]
mov qword [rsp + 0x98], rdx
lea r9, [rsp + 0x98]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0xa8]
cmp r9, r14
je 0x140085ac7
mov rcx, qword [rbx]
lea r8d, [r14 + 9]
mov edx, 0x110b
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0xa0], 4
je 0x140085ac7
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
je 0x140085ac7
mov r8, qword [rsp + 0x78]
cmp r8, r14
je 0x140085ac7
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140083918
jmp 0x140085ac7
movzx eax, word [rdi + 0x18]
cmp eax, 0x2e
je 0x1400854b6
cmp eax, 0x71
je 0x1400854a9
cmp eax, 0x74
jne 0x140085ac7
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.1400850a0
jmp 0x140085ac7
mov rcx, rbx
call fcn.1400843d0
jmp 0x140085ac7
mov rcx, rbx
call fcn.140085194
jmp 0x140085ac7
mov rsi, qword [rdi + 0x88]
mov word [rsp + 0x10d0], r14w
cmp rsi, r14
jne 0x140085629
mov r12, qword [rdi + 0x60]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
mov esi, 0x800
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
je 0x140085ac7
or rbp, 0xffffffffffffffff
mov rcx, qword [rbx]
mov r9, r12
mov edx, 0x110a
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
mov r12, rax
cmp rax, r14
je 0x14008570e
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r14
je 0x1400855e7
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x10d0]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x7ff
jae 0x1400855e7
cmp word [rsp + 0x10d0], r14w
je 0x1400855cf
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.1400504d4
lea rdx, [rsp + 0x10d0]
lea rcx, [rsp + 0xd0]
mov r8, rsi
call fcn.140065dac
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x10d0]
mov r8, rsi
call fcn.140065d2c
mov rcx, qword [rbx]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x68], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
jne 0x140085523
jmp 0x140085ac7
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x140085721
cmp word [0x1401551a0], r14w
jne 0x14008568e
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
lea edx, [r9 + 0x13]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1401551a0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [0x14018c420]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1401551a0]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x10d0]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x1401551a0]
call fcn.1400ee530
cmp eax, r14d
jne 0x1400856f9
lea r8, [rsi + 8]
lea r9, [rsp + 0xd0]
mov rdx, rsi
mov rcx, r12
call fcn.1400844a4
cmp al, r14b
je 0x14008570b
mov rcx, r14
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x10ce], ax
cmp ax, r14w
jne 0x1400856dd
jmp 0x14008570b
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x10d0]
jmp 0x140085825
call fcn.140044e3c
cmp eax, 0x601
jb 0x140085ac7
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r14
je 0x140085ac7
lea rdx, str.SHCreateItemFromIDList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r14
je 0x140085ac7
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x88]
lea rdx, [0x14010ff00]
call rax
cmp eax, r14d
jne 0x140085ac7
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x90]
lea r8, [0x14010fea8]
xor edx, edx
call fcn.140084410
cmp eax, r14d
jne 0x140085ac7
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x80]
lea r8, [0x14010ff00]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x48]
cmp eax, r14d
jne 0x140085ac7
mov rcx, qword [rsp + 0x80]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp eax, r14d
jne 0x140085ac7
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xd0]
mov r8d, 0x800
call fcn.140065d2c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0xd0]
mov rcx, rax
xor r8d, r8d
mov edx, 0x800b
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140085ac7
test byte [rdi + 0x68], 0x40
jne 0x140085ac7
mov rsi, qword [rdi + 0x88]
cmp rsi, r14
je 0x140085ac7
mov eax, dword [0x140155190]
mov ecx, eax
inc eax
mov dword [0x140155190], eax
cmp ecx, r14d
ja 0x140085ac7
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
lea r9, [0x140117f58]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsi + 8]
xor r8d, r8d
call qword [rax + 0x28]
cmp eax, r14d
jl 0x1400858b1
mov rax, qword [rdi + 0x60]
mov r9, qword [rsi + 0x10]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140083d78
mov rax, qword [rdi + 0x60]
mov rcx, qword [rbx]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0xb0], rax
lea rax, [0x1400840b4]
xor r8d, r8d
mov edx, 0x1115
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
dec dword [0x140155190]
jmp 0x140085ac7
mov rdi, qword [rdi + 0x50]
cmp rdi, r14
je 0x140085ac7
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14018c420]
mov rdx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x14018c420]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x14018c420]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x140085ac7
mov rcx, qword [rdi + 0x48]
cmp rcx, r14
jne 0x14008595d
movabs rax, 1
jmp 0x140085ac9
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x14008594e
lea rcx, [rsp + 0x10d0]
call fcn.140042584
cmp al, r14b
je 0x14008594e
lea rcx, [rsp + 0x10d0]
call fcn.140050ce0
cmp word [rax], r14w
je 0x14008594e
mov byte [rbx + 0x11], 1
jmp 0x140085ac7
mov byte [rbx + 0x11], r14b
cmp qword [rdi + 0x30], r14
je 0x140085ac7
mov rcx, qword [rdi + 0x48]
cmp rcx, r14
je 0x140085ac7
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x140085ac7
mov rcx, r14
movzx eax, word [rsp + rcx + 0x10d0]
add rcx, 2
mov word [rsp + rcx + 0xce], ax
cmp ax, r14w
jne 0x1400859db
lea rcx, [rsp + 0xd0]
call fcn.140050ce0
or rbp, 0xffffffffffffffff
mov esi, 0x800
mov word [rax], r14w
mov r8, qword [rdi + 0x30]
xor eax, eax
mov rdi, r8
mov rcx, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0xd0]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, rsi
jae 0x140085ac9
lea rdi, [rsp + 0xd0]
mov rcx, rbp
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r8 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140085a55
lea rcx, [rsp + 0xd0]
call fcn.140042584
cmp al, r14b
je 0x140085a8e
mov ecx, 0x50d
call fcn.14005fad0
mov rcx, rax
call fcn.1400c5808
jmp 0x140085ac7
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r14d
je 0x140085ac7
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.1400850a0
lea rdx, [rsp + 0xd0]
mov r8b, 1
mov rcx, rbx
call fcn.1400849f4
xor eax, eax
mov rcx, qword [rsp + 0x20d0]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x2120]
add rsp, 0x20e0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret