Function at 0x14003bf20
Capabilities:
Delete file
Move file

Disassembly:
push rbx
push rbp
push r15
mov eax, 0x40
call fcn.1400473e0
sub rsp, rax
mov qword [rsp + 0x68], rsi
xor r15d, r15d
mov qword [rsp + 0x78], r12
mov eax, r15d
mov rbp, rcx
mov qword [rsp + 0x38], r13
mov r13, rdx
mov qword [rsp + 0x30], r14
mov r8, rcx
cmp byte [rcx], al
je 0x14003bf71
nop dword [rax]
cmp eax, 0x80000000
jae 0x14003bf71
inc r8
inc eax
cmp byte [r8], r15b
jne 0x14003bf60
btr eax, 0x1f
mov rcx, r13
lea r12d, [rax + 1]
mov eax, r15d
mov esi, r12d
cmp byte [rdx], al
je 0x14003bf97
cmp eax, 0x80000000
jae 0x14003bf97
inc rcx
inc eax
cmp byte [rcx], r15b
jne 0x14003bf86
btr eax, 0x1f
mov qword [rsp + 0x70], rdi
inc eax
mov dword [rsp + 0x60], eax
mov r14d, eax
lea rcx, [rax + r12]
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14003c20f
mov dword [rsp + 0x28], r12d
lea rdi, [rax + r12*2]
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov r8, rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14003c0b0
mov rcx, r15
test r12d, r12d
je 0x14003c0b0
cmp rsi, 0x20
jb 0x14003c08c
lea rax, [rbp - 1]
add rax, rsi
lea rdx, [r12 - 1]
lea rdx, [rbx + rdx*2]
cmp rbx, rax
ja 0x14003c018
cmp rdx, rbp
jae 0x14003c08c
mov rdx, rsi
and rdx, 0xffffffffffffffe0
lea rax, [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
movq xmm0, qword [rcx + rbp]
lea rax, [rax + 0x40]
movq xmm1, qword [rcx + rbp + 8]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rax - 0x60], xmm0
movq xmm0, qword [rcx + rbp + 0x10]
psraw xmm1, 8
movdqu xmmword [rax - 0x50], xmm1
movq xmm1, qword [rcx + rbp + 0x18]
add rcx, 0x20
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax - 0x40], xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp rcx, rdx
jb 0x14003c030
cmp rcx, rsi
jae 0x14003c0b0
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + rbp]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rsi
jb 0x14003c0a0
mov r9d, dword [rsp + 0x60]
mov r8, r13
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14003c191
mov rax, r15
test r14, r14
je 0x14003c191
cmp r14, 0x20
jb 0x14003c170
lea rcx, [r13 - 1]
add rcx, r14
lea rdx, [rdi - 2]
lea rdx, [rdx + r14*2]
cmp rdi, rcx
ja 0x14003c103
cmp rdx, r13
jae 0x14003c170
mov rdx, r14
and rdx, 0xffffffffffffffe0
lea rcx, [rdi + 0x20]
nop
movq xmm0, qword [rax + r13]
lea rcx, [rcx + 0x40]
movq xmm1, qword [rax + r13 + 8]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
movdqu xmmword [rcx - 0x60], xmm0
movq xmm0, qword [rax + r13 + 0x10]
psraw xmm1, 8
movdqu xmmword [rcx - 0x50], xmm1
movq xmm1, qword [rax + r13 + 0x18]
add rax, 0x20
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rcx - 0x40], xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp rax, rdx
jb 0x14003c110
cmp rax, r14
jae 0x14003c191
nop word [rax + rax]
movsx ecx, byte [rax + r13]
mov word [rdi + rax*2], cx
inc rax
cmp rax, r14
jb 0x14003c180
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14003c215
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x14003c1b5
cmp eax, 0x50
jne 0x14003c1da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14003c1d2
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14003c215
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x14003c203
cmp ecx, 5
jne 0x14003c1f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], recv
jmp 0x14003c20f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x14003c20f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov r15d, 0xffffffff
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
test rbx, rbx
je 0x14003c241
cmp rbx, rbp
je 0x14003c241
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r15d
add rsp, 0x40
pop r15
pop rbp
pop rbx
ret