Function at 0x14000739c
Capabilities:
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x58], 0
lea r9, [rbp + 0x58]
xor r14d, r14d
mov r15, rcx
and dword [rbp - 0x10], r14d
lea rcx, [0x140034e18]
and dword [rbp - 0xc], r14d
xor r8d, r8d
and qword [rbp - 8], r14
xor edx, edx
and qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000760c
mov rcx, qword [rbp + 0x58]
lea r9, [rbp + 0x50]
call fcn.140006b10
mov edi, eax
test eax, eax
jns 0x140007416
mov ecx, eax
call fcn.140008aa4
mov r14, qword [rbp + 0x50]
jmp 0x140007613
mov r14, qword [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
or r13d, 0xffffffff
mov ebx, eax
cmp eax, r13d
je 0x14000743c
shr ebx, 4
and ebx, 1
jmp 0x14000743e
xor ebx, ebx
xor ecx, ecx
call fcn.140004734
xor ecx, ecx
call fcn.140004734
test ebx, ebx
jne 0x140007462
mov rcx, r14
call fcn.140006c44
mov edi, eax
test eax, eax
js 0x14000760c
xor esi, esi
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x14000749d
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004734
and qword [rbp + 0x48], 0
inc esi
lea r9, str.RUXIMLog
mov r8, r14
mov dword [rsp + 0x20], esi
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.140006f54
mov edi, eax
test eax, eax
js 0x14000760c
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.140007264
mov edi, eax
test eax, eax
js 0x14000760c
cmp esi, 0x32
jb 0x140007464
mov rsi, qword [rbp - 8]
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x14000750b
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14000750d
xor ebx, ebx
xor ecx, ecx
call fcn.140004734
xor ecx, ecx
call fcn.140004734
test ebx, ebx
je 0x140007562
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140007562
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000754d
mov edi, 0x80004005
jmp 0x14000755b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14000760e
mov edi, 0x188
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140007589
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14000758b
xor ebx, ebx
xor ecx, ecx
call fcn.140004734
xor ecx, ecx
call fcn.140004734
test ebx, ebx
je 0x1400075b6
mov rdx, qword [rsi + rdi]
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x140007536
sub rdi, 8
jne 0x140007567
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x1400075dc
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400075de
xor ebx, ebx
xor ecx, ecx
call fcn.140004734
xor ecx, ecx
call fcn.140004734
xor edi, edi
test ebx, ebx
je 0x140007601
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rax, qword [rsi]
and qword [rsi], rdi
mov qword [r15], rax
jmp 0x140007613
mov ecx, eax
call fcn.140008aa4
mov ecx, edi
call fcn.140004734
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x14000764e
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004734
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140006f94
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x140007682
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x1400076af
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140004734
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400076c4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret