Function at 0x140003c40
Capabilities:
Move file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r12d, r12d
mov esi, r12d
lea r15, str.queen
mov rax, r15
nop dword [rax + rax]
inc esi
lea rax, [rax + 1]
cmp byte [rax], r12b
jne 0x140003ca0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rcx, qword [rax]
mov r14, qword [rcx]
mov ebx, r12d
mov edi, r12d
cmp byte [r14], r12b
je 0x140003cd0
mov rax, r14
inc ebx
lea rax, [rax + 1]
cmp byte [rax], dil
jne 0x140003cc5
movsxd rcx, ebx
add rcx, r14
cmp byte [rcx], 0x5c
je 0x140003ceb
nop dword [rax + rax]
dec ebx
lea rcx, [rcx - 1]
cmp byte [rcx], 0x5c
jne 0x140003ce0
inc ebx
movsxd rcx, ebx
add rcx, r14
cmp byte [rcx], 0x2e
je 0x140003d0d
nop dword [rax + rax]
inc edi
inc ebx
lea rcx, [rcx + 1]
cmp byte [rcx], 0x2e
jne 0x140003d00
cmp esi, edi
jne 0x140004096
movsxd rcx, edi
inc rcx
call fcn.14000745c
mov r10, rax
movsxd r9, edi
mov byte [r9 + rax], r12b
sub ebx, edi
movsxd r8, ebx
movzx edx, byte [r8 + r14]
cmp dl, 0x2e
je 0x140003d5f
mov rcx, rax
sub r8, rax
lea rax, [r8 + r14]
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], dl
lea rcx, [rcx + 1]
movzx edx, byte [rax + rcx]
cmp dl, 0x2e
jne 0x140003d50
mov rdx, r12
test edi, edi
jle 0x140003d89
mov r8, r10
sub r8, r15
nop dword [rax]
lea rcx, [rdx + r15]
movzx eax, byte [rcx]
cmp byte [rcx + r8], al
jne 0x140004096
inc rdx
cmp rdx, r9
jl 0x140003d70
mov rcx, r10
call fcn.140007410
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov qword [rbp - 0x18], r12
movdqu xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x30], r12
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, 3
lea rdx, [0x140009764]
lea rcx, [rbp - 0x60]
call fcn.140005d00
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
call fcn.1400031b0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140003e18
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007410
mov r14d, r12d
mov rax, qword [rbp - 0x20]
sub rax, qword [rbp - 0x28]
sar rax, 5
test rax, rax
je 0x140003eaa
mov r15, r12
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rcx, qword [rax]
mov rdx, qword [rcx]
mov rdi, qword [rbp - 0x28]
lea rbx, [r15 + rdi]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140003e50
mov r8, qword [rbx + 0x10]
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0xf
jbe 0x140003e6d
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140003e7b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003e90
cmp rsi, 0xf
jbe 0x140003e84
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.140003920
mov rdi, qword [rbp - 0x28]
inc r14d
add r15, 0x20
mov rcx, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 5
movsxd rax, r14d
cmp rax, rcx
jb 0x140003e30
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8d, 3
lea rdx, [0x14000976c]
lea rcx, [rbp - 0x60]
call fcn.140005d00
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
call fcn.1400031b0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140003f1c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007410
mov r14d, r12d
mov rax, qword [rbp - 0x38]
sub rax, qword [rbp - 0x40]
sar rax, 5
test rax, rax
je 0x140003faa
mov r15, r12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov rcx, qword [rax]
mov rdx, qword [rcx]
mov rdi, qword [rbp - 0x40]
lea rbx, [r15 + rdi]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140003f50
mov r8, qword [rbx + 0x10]
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0xf
jbe 0x140003f6d
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140003f7b
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003f90
cmp rsi, 0xf
jbe 0x140003f84
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.140003920
mov rdi, qword [rbp - 0x40]
inc r14d
add r15, 0x20
mov rcx, qword [rbp - 0x38]
sub rcx, rdi
sar rcx, 5
movsxd rax, r14d
cmp rax, rcx
jb 0x140003f33
lea rdx, [0x140009770]
lea rcx, str.queen.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140004019
mov rdx, qword [rbp - 0x38]
call fcn.140005e00
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007410
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r12
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140004067
mov rdx, qword [rbp - 0x20]
call fcn.140005e00
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004062
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007410
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400073f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3