Function at 0x14001068c
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, r8
mov r13, rdx
mov rsi, rcx
mov ebx, 0x8007000e
xor edi, edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x88], rdi
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x1400106e1
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rsi + 0x68], rdi
mov rax, qword [rsp + 0x90]
test r13, r13
je 0x140010957
test rax, rax
je 0x140010957
mov ecx, 1
call fcn.14000c3c0
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001095c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
mov rsi, rax
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
lea ecx, [rax + 1]
add ecx, esi
mov qword [rsp + 0x80], rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140001284
mov r15, rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400107cb
lea eax, [rsi + 1]
mov edx, eax
dec rax
cmp rax, 0x7ffffffe
jbe 0x140010793
mov r14d, 0x80070057
mov ebx, r14d
mov eax, r14d
test rdx, rdx
je 0x1400107a4
mov word [r15], di
jmp 0x1400107d1
mov r9, r12
mov rcx, r15
call fcn.14000bec8
mov r14d, 0x80070057
mov ebx, eax
test eax, eax
js 0x1400107d1
mov r8, r13
mov rdx, qword [rsp + 0x80]
mov rcx, r15
call fcn.14000520c
mov ebx, eax
test eax, eax
mov eax, 1
cmovns ebx, eax
jmp 0x1400107d1
mov r14d, 0x80070057
mov rcx, r15
test ebx, ebx
js 0x140010935
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
mov rbx, rax
mov r13, qword [rsp + 0x90]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
lea ecx, [rax + 1]
add ecx, ebx
mov qword [rsp + 0x80], rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140001284
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140010894
lea eax, [rbx + 1]
mov edx, eax
dec rax
cmp rax, 0x7ffffffe
jbe 0x14001085a
mov ebx, r14d
test rdx, rdx
je 0x140010868
mov word [rsi], di
jmp 0x140010899
mov r9, r12
mov rcx, rsi
call fcn.14000bec8
mov r14d, eax
mov ebx, r14d
test r14d, r14d
js 0x140010899
mov r8, r13
mov rdx, qword [rsp + 0x80]
mov rcx, rsi
call fcn.14000520c
mov ebx, eax
test eax, eax
js 0x140010899
mov r14d, 1
mov ebx, r14d
jmp 0x14001089f
mov ebx, 0x8007000e
mov r14d, 1
test ebx, ebx
js 0x140010905
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov r8d, r14d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400108e8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140010905
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140010905
mov ebx, edi
jmp 0x140010905
mov rcx, r15
test rsi, rsi
je 0x140010935
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, r15
jmp 0x140010935
test rcx, rcx
je 0x140010946
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
jmp 0x14001095c
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret