Function at 0x140002e50
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x30]
call fcn.140013fb0
test eax, eax
jne 0x1400030ce
movzx eax, word [rsp + 0x36]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
je 0x140002f6e
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x1400351a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x60]
call fcn.1400147a0
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140002c24
test eax, eax
lea rdi, [rsp + 0x60]
mov esi, eax
cmovne rdi, rbx
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140002f2a
mov ecx, dword [0x14003f0a8]
test cl, 1
jne 0x140002f21
and qword [0x14003f0c0], 0
or ecx, 1
mov dword [0x14003f0a8], ecx
lea rcx, [0x14002aae0]
call fcn.14000fc8c
lea rdx, str.remove_recursive_on_reboot:_file_will_be_removed_on_OS_reboot:__S
jmp 0x140002f58
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002f51
and qword [0x14003f0c0], 0
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
lea rdx, str.remove_recursive_on_reboot:_failed_to_schedule_OS_reboot_removal_of_file:__S
mov r8, rdi
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, esi
jmp 0x1400030ce
mov rcx, rbx
call fcn.1400087a8
mov rdi, rax
test rax, rax
jne 0x140002fcf
mov eax, dword [0x14003f0a8]
test al, 1
jne 0x140002fa4
and qword [0x14003f0c0], rdi
lea rcx, [0x14002aae0]
or eax, 1
mov dword [0x14003f0a8], eax
call fcn.14000fc8c
call fcn.140018ec4
xor r9d, r9d
lea rdx, str.remove_recursive_on_reboot:_unable_to_open_directory:__S__rv:__d__err:__d
mov r8, rbx
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
xor eax, eax
jmp 0x1400030ce
mov rcx, rax
jmp 0x140003041
movzx ecx, word [rdx]
cmp cx, word [0x140034f78]
jne 0x140002fed
movzx ecx, word [rdx + 2]
cmp cx, word [0x140034f7a]
je 0x14000303e
movzx eax, word [rdx]
cmp ax, word [0x140034eb8]
jne 0x140003013
movzx eax, word [rdx + 2]
cmp ax, word [0x140034eba]
jne 0x140003013
movzx eax, word [rdx + 4]
cmp ax, word [0x140034ebc]
je 0x14000303e
mov qword [rsp + 0x20], rdx
lea r8, str._s__s
mov edx, 0x104
lea rcx, [rsp + 0x60]
mov r9, rbx
call fcn.1400024cc
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140002e50
mov rcx, rdi
call fcn.140008834
mov rdx, rax
test rax, rax
jne 0x140002fd4
cmp qword [rdi], 0xffffffffffffffff
je 0x14000305d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call fcn.14000fca4
mov edx, 0x180
mov rcx, rbx
call fcn.140018d70
mov rcx, rbx
call fcn.1400147c8
mov edi, eax
test eax, eax
je 0x1400030cc
mov ecx, dword [0x14003f0a8]
test cl, 1
jne 0x1400030a8
and qword [0x14003f0c0], 0
or ecx, 1
mov dword [0x14003f0a8], ecx
lea rcx, [0x14002aae0]
call fcn.14000fc8c
call fcn.140018ec4
mov r9d, edi
lea rdx, str.remove_recursive_on_reboot:_unable_to_remove_directory:__S__rv:__d__err:__d
mov r8, rbx
mov ecx, dword [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [0x14003f0c0]
call fcn.14000b1bc
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000f700
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret