Function at 0x140039ad4
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14004d298]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rdi, r9
mov r13d, r8d
xor r9d, r9d
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x14003a0d7
mov ebx, 0x104
mov rax, r14
mov ecx, ebx
cmp word [rax], r9w
je 0x140039b36
add rax, 2
sub rcx, 1
jne 0x140039b26
mov rax, rcx
mov esi, 0x80070057
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rcx, rcx
je 0x14003a0dd
mov rax, rbx
sub rax, rcx
add rax, rax
neg rcx
sbb rdx, rdx
and rdx, rax
test rdi, rdi
je 0x14003a091
mov rcx, rbx
mov rax, rdi
cmp word [rax], r9w
je 0x140039b84
add rax, 2
sub rcx, 1
jne 0x140039b74
mov rax, rcx
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rcx, rcx
je 0x14003a094
mov rax, rbx
sub rax, rcx
add rax, rax
neg rcx
sbb r12, r12
and r12, rax
lea rax, [r12 + rdx]
cmp rax, 0x206
jb 0x140039c07
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xc
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047140]
mov r9, rdi
call fcn.14000a4fc
jmp 0x14003a119
lea rax, [rbp + 0x140]
mov r8, r14
sub r8, rax
lea rcx, [rbp + 0x140]
mov rdx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140039c41
movzx eax, word [rcx + r8]
test ax, ax
je 0x140039c41
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140039c1e
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r9w
mov rax, rdx
neg rax
sbb r8d, r8d
not r8d
and r8d, 0x8007007a
test rdx, rdx
jne 0x140039c9d
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xd
jmp 0x14003a0b8
mov r8, rdi
lea rcx, [rbp + 0x140]
call fcn.1400178e4
mov r8d, eax
test eax, eax
jns 0x140039ce8
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xe
jmp 0x14003a0b8
xor r14d, r14d
test r13d, r13d
je 0x140039fe6
test r15, r15
je 0x140039fab
mov rdx, rbx
mov rax, r15
cmp word [rax], r14w
je 0x140039d13
add rax, 2
sub rdx, 1
jne 0x140039d03
mov rax, rdx
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rdx, rdx
je 0x140039fae
mov rcx, rbx
sub rcx, rdx
add rcx, rcx
neg rdx
sbb rax, rax
and rax, rcx
add rax, r12
cmp rax, 0x206
jb 0x140039d82
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0x10
mov qword [rsp + 0x20], r15
jmp 0x140039bef
lea rax, [rsp + 0x30]
mov rdx, r15
sub rdx, rax
lea rcx, [rsp + 0x30]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140039db4
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140039db4
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140039d92
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov rax, rbx
neg rax
sbb r8d, r8d
not r8d
and r8d, 0x8007007a
test rbx, rbx
jne 0x140039e18
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
lea edx, [rbx + 0x11]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r15
jmp 0x14003a0c2
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.1400178e4
mov r8d, eax
test eax, eax
jns 0x140039e5e
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0x12
jmp 0x140039e09
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
cmp r13d, 2
jne 0x140039f01
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
je 0x140039ec0
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 4
jb 0x14003a119
lea edx, [r13 + 0x11]
lea r9, [rsp + 0x30]
jmp 0x14003a034
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x14
jmp 0x140039f82
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x140039f46
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 4
jb 0x14003a119
mov edx, 0x15
jmp 0x140039eb6
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x16
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [0x140047140]
mov rcx, qword [0x14004d128]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a2a8
jmp 0x14003a119
mov r8d, esi
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xf
mov r9, r15
jmp 0x14003a104
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
je 0x14003a049
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 3
jb 0x14003a119
mov edx, 0x17
lea r9, [rbp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047140]
call fcn.14000a404
jmp 0x14003a119
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x18
lea rcx, [rbp + 0x140]
jmp 0x140039f87
mov r8d, esi
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xb
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047140]
mov r9, rdi
call fcn.14001936c
jmp 0x14003a119
mov r8d, 0x80070057
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a119
test byte [rcx + 0x1c], 1
je 0x14003a119
cmp byte [rcx + 0x19], 2
jb 0x14003a119
mov edx, 0xa
mov r9, r14
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x140047140]
call fcn.14000a620
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140001e80
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret