Function at 0x1400966a0
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r15d, r9d
mov rdi, r8
mov r14, rdx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x80], rdx
movzx r13d, r9w
shr r13w, 8
mov eax, r9d
shr eax, 0x10
mov dword [rsp + 0x78], eax
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140096dc2
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, r15d
lea rdx, str.__d_theme.png
lea rcx, [rsp + 0x58]
call fcn.14000b080
mov rcx, rdi
call fcn.140101140
mov rbx, rax
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140096dcd
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14002e390
mov r12, 0xffffffffffffffff
test al, al
jne 0x14009679b
test rbx, rbx
jne 0x14009677a
xor eax, eax
jmp 0x14009678a
mov rax, r12
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140096780
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140010860
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140096dd8
mov rsi, qword [rsp + 0x58]
mov rax, rsi
mov r9, rcx
sub r9, rsi
nop word [rax + rax]
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x1400967d6
add rax, 2
test edx, edx
jne 0x1400967c0
test r8d, r8d
jne 0x140096830
lea rbx, [rcx - 0x18]
mov rcx, rbx
call fcn.14000ae30
add rax, 0x18
mov qword [r14], rax
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140096808
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140096d7c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x140096d7c
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x200]
mov rcx, rax
call fcn.14009af50
mov rbx, rax
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140096de3
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14002e390
test al, al
jne 0x1400968ab
test rbx, rbx
jne 0x140096887
xor eax, eax
jmp 0x14009689a
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140096890
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140010860
nop
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140096dee
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
lea r14, [rax + 0x18]
mov qword [rsp + 0x60], r14
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140096db7
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
mov rbx, qword [rsp + 0x48]
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x68], rcx
add r14, 0xffffffffffffffe8
cmp rcx, r14
je 0x14009695f
cmp dword [r14 + 0x10], 0
jl 0x14009694e
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x14009694e
call fcn.14000ae30
mov rbx, rax
mov ecx, r12d
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x140096934
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
jmp 0x14009695f
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140010860
mov r8, rsi
lea rdx, str..png
lea rcx, [rsp + 0x60]
call fcn.14007f8c0
add rdi, 0xffffffffffffffe8
mov rsi, qword [rsp + 0x68]
cmp rsi, rdi
je 0x1400969d5
cmp dword [rdi + 0x10], 0
jl 0x1400969c4
mov rax, qword [rdi]
cmp qword [rsi], rax
jne 0x1400969c4
mov rcx, rsi
call fcn.14000ae30
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x1400969b4
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x48]
jmp 0x1400969d5
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140010860
lea r8, str._temp.png
lea rdx, str..png
lea rcx, [rsp + 0x50]
call fcn.14007f8c0
xor edi, edi
mov qword [rbp - 0x78], rdi
lea rdx, [rbp - 0x78]
mov rcx, rbx
call sub.gdiplus.dll_GdipCreateBitmapFromFile
mov rbx, qword [rbp - 0x78]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x44], edi
lea rdx, [rsp + 0x44]
mov rcx, rbx
call sub.gdiplus.dll_GdipGetImageWidth
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.gdiplus.dll_GdipGetImageHeight
mov qword [rbp - 0x80], rdi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, 0x26200a
xor r8d, r8d
mov edi, dword [rsp + 0x40]
mov edx, edi
mov ebx, dword [rsp + 0x44]
mov ecx, ebx
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
mov r14, qword [rbp - 0x80]
mov qword [rbp - 0x70], 0
mov dword [rbp - 0x68], ebx
mov dword [rbp - 0x64], edi
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x26200a
mov r8d, 1
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x38]
call sub.gdiplus.dll_GdipBitmapLockBits
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x26200a
mov r8d, 2
lea rdx, [rbp - 0x70]
mov rcx, r14
call sub.gdiplus.dll_GdipBitmapLockBits
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 8]
test edi, edi
jle 0x140096af6
mov r10d, edi
mov r9d, dword [rsp + 0x78]
test ebx, ebx
jle 0x140096af0
mov r8, rbx
nop word [rax + rax]
mov byte [rax], r9b
mov byte [rax + 1], r13b
mov byte [rax + 2], r15b
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
add rax, 4
add rdx, 4
sub r8, 1
jne 0x140096ad0
sub r10, 1
jne 0x140096ac0
lea rdx, [rbp - 0x18]
mov rcx, r14
call sub.gdiplus.dll_GdipBitmapUnlockBits
lea rdx, [rbp + 8]
mov r15, qword [rsp + 0x38]
mov rcx, r15
call sub.gdiplus.dll_GdipBitmapUnlockBits
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call sub.gdiplus.dll_GdipGetImageEncodersSize
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140096bbe
mov ecx, eax
call fcn.14028fd08
mov rbx, rax
test rax, rax
je 0x140096bbe
mov r8, rax
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
call sub.gdiplus.dll_GdipGetImageEncoders
mov r8d, r13d
mov r10d, dword [rsp + 0x38]
test r10d, r10d
je 0x140096bb6
lea r11, str.image_png
nop
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rbx + 0x40]
mov rcx, r13
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x140096da6
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x140096da6
add rcx, 2
cmp rcx, 0xa
jne 0x140096b80
imul rax, r9, 0x68
movups xmm0, xmmword [rax + rbx]
movups xmmword [rbp + 0x28], xmm0
mov rcx, rbx
call fcn.14028fcf4
xor r9d, r9d
lea r8, [rbp + 0x28]
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r14
call sub.gdiplus.dll_GdipSaveImageToFile
mov rcx, r14
call sub.gdiplus.dll_GdipDisposeImage
mov rcx, r15
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [rdi - 0x10]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140096cd9
cmp dword [rbx - 0x10], r13d
je 0x140096cd9
add eax, 2
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, r12
mov rcx, rax
call fcn.140172464
mov rsi, rax
test rax, rax
je 0x140096cd4
lea r8, [r14 + r14]
xor edx, edx
mov rcx, rax
call fcn.140289490
movsxd r8, dword [rdi - 0x10]
add r8, r8
mov rdx, rdi
mov rcx, rsi
call fcn.140289020
mov ecx, dword [rbx - 0x10]
add ecx, 2
movsxd r15, ecx
mov eax, 2
mul r15
cmovo rax, r12
mov rcx, rax
call fcn.140172464
mov r14, rax
test rax, rax
je 0x140096cd4
lea r8, [r15 + r15]
xor edx, edx
mov rcx, rax
call fcn.140289490
movsxd r8, dword [rbx - 0x10]
add r8, r8
mov rdx, rbx
mov rcx, r14
call fcn.140289020
mov qword [rbp - 0x50], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x58], r13
mov ecx, 0x614
movd eax, xmm0
or ax, cx
mov word [rbp - 0x38], ax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], r14
lea rcx, [rbp - 0x58]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rsi
call fcn.140171af0
mov rcx, r14
call fcn.140171af0
mov rsi, qword [rsp + 0x68]
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov r14, qword [rbp - 0x60]
mov qword [r14], rax
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140096d08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140096d24
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140096d3e
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140096d5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140096d7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r14
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
inc r8d
cmp r8d, r10d
jae 0x140096bb6
jmp 0x140096b70
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
int3