Function at 0x140039cfc
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14004d298]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rdi, r9
mov r13d, r8d
xor r9d, r9d
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x14003a2ff
mov ebx, 0x104
mov rax, r14
mov ecx, ebx
cmp word [rax], r9w
je 0x140039d5e
add rax, 2
sub rcx, 1
jne 0x140039d4e
mov rax, rcx
mov esi, 0x80070057
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rcx, rcx
je 0x14003a305
mov rax, rbx
sub rax, rcx
add rax, rax
neg rcx
sbb rdx, rdx
and rdx, rax
test rdi, rdi
je 0x14003a2b9
mov rcx, rbx
mov rax, rdi
cmp word [rax], r9w
je 0x140039dac
add rax, 2
sub rcx, 1
jne 0x140039d9c
mov rax, rcx
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rcx, rcx
je 0x14003a2bc
mov rax, rbx
sub rax, rcx
add rax, rax
neg rcx
sbb r12, r12
and r12, rax
lea rax, [r12 + rdx]
cmp rax, 0x206
jb 0x140039e2f
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xc
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047130]
mov r9, rdi
call fcn.14000a4e8
jmp 0x14003a341
lea rax, [rbp + 0x140]
mov r8, r14
sub r8, rax
lea rcx, [rbp + 0x140]
mov rdx, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140039e69
movzx eax, word [rcx + r8]
test ax, ax
je 0x140039e69
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140039e46
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r9w
mov rax, rdx
neg rax
sbb r8d, r8d
not r8d
and r8d, 0x8007007a
test rdx, rdx
jne 0x140039ec5
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xd
jmp 0x14003a2e0
mov r8, rdi
lea rcx, [rbp + 0x140]
call fcn.140017968
mov r8d, eax
test eax, eax
jns 0x140039f10
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xe
jmp 0x14003a2e0
xor r14d, r14d
test r13d, r13d
je 0x14003a20e
test r15, r15
je 0x14003a1d3
mov rdx, rbx
mov rax, r15
cmp word [rax], r14w
je 0x140039f3b
add rax, 2
sub rdx, 1
jne 0x140039f2b
mov rax, rdx
neg rax
sbb r8d, r8d
not r8d
and r8d, esi
test rdx, rdx
je 0x14003a1d6
mov rcx, rbx
sub rcx, rdx
add rcx, rcx
neg rdx
sbb rax, rax
and rax, rcx
add rax, r12
cmp rax, 0x206
jb 0x140039faa
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0x10
mov qword [rsp + 0x20], r15
jmp 0x140039e17
lea rax, [rsp + 0x30]
mov rdx, r15
sub rdx, rax
lea rcx, [rsp + 0x30]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140039fdc
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140039fdc
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140039fba
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov rax, rbx
neg rax
sbb r8d, r8d
not r8d
and r8d, 0x8007007a
test rbx, rbx
jne 0x14003a040
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
lea edx, [rbx + 0x11]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r15
jmp 0x14003a2ea
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.140017968
mov r8d, eax
test eax, eax
jns 0x14003a086
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0x12
jmp 0x14003a031
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
cmp r13d, 2
jne 0x14003a129
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
je 0x14003a0e8
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 4
jb 0x14003a341
lea edx, [r13 + 0x11]
lea r9, [rsp + 0x30]
jmp 0x14003a25c
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x14
jmp 0x14003a1aa
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14003a16e
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 4
jb 0x14003a341
mov edx, 0x15
jmp 0x14003a0de
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x16
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r8, [0x140047130]
mov rcx, qword [0x14004d128]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.14000a290
jmp 0x14003a341
mov r8d, esi
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xf
mov r9, r15
jmp 0x14003a32c
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
je 0x14003a271
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 3
jb 0x14003a341
mov edx, 0x17
lea r9, [rbp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047130]
call fcn.14000a3f0
jmp 0x14003a341
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x18
lea rcx, [rbp + 0x140]
jmp 0x14003a1af
mov r8d, esi
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xb
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x140047130]
mov r9, rdi
call fcn.1400193d8
jmp 0x14003a341
mov r8d, 0x80070057
mov rcx, qword [0x14004d128]
lea rax, [0x14004d128]
cmp rcx, rax
je 0x14003a341
test byte [rcx + 0x1c], 1
je 0x14003a341
cmp byte [rcx + 0x19], 2
jb 0x14003a341
mov edx, 0xa
mov r9, r14
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x140047130]
call fcn.14000a60c
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140001e70
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret