Function at 0x14002adf0
Capabilities:
Delete file
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x600
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
xor r15d, r15d
mov dword [rsp + 0x44], r15d
call fcn.14002a450
mov rcx, rsi
call fcn.14002a370
cmp qword [rsi + 8], r15
je 0x14002b306
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
lea r8d, [r15 + 0xa]
lea rdx, [rsp + 0x4e0]
call fcn.14010ff10
mov rdx, qword [rsi + 8]
mov r14, qword [rdx + 0x168]
mov ecx, 0x3f0
call fcn.1400854f0
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14002aec9
mov rdx, qword [rsi]
mov r9, qword [rdx + 0xb0]
lea rax, [r9 + 0x139c]
lea rcx, [r9 + 0x1298]
add r9, 0xf8c
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rdi
call fcn.14002b730
mov rbx, rax
jmp 0x14002aecc
mov rbx, r15
lea rdx, [rsp + 0x4e0]
mov rcx, rbx
call fcn.14002dcd0
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.14002c760
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.14002c5d0
mov r14, rax
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400a3d50
nop
lea rcx, [rsp + 0x80]
call fcn.1400a45d0
mov rdi, rax
test rax, rax
je 0x14002af62
mov rdx, r13
mov rcx, rax
call r12
test eax, eax
je 0x14002af60
mov rdx, rdi
mov rcx, rbx
call fcn.14002d290
jmp 0x14002af33
mov rcx, rbx
call fcn.14002d8b0
mov rcx, r14
call fcn.14002cec0
lea rcx, [rsp + 0x58]
call fcn.14002bbe0
test rbx, rbx
je 0x14002af8e
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, rsi
call fcn.14002a450
mov edx, 0x2e
mov word [rsp + 0x40], dx
mov rax, qword [rsi]
mov rcx, qword [rax + 0xb0]
add rcx, 0xf8c
lea rdx, [rsp + 0xa0]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x14002afc0
lea rcx, [rsp + 0xa0]
call fcn.1400c9bc0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1b0]
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x14002aff0
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x3d0]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x14002b010
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x2c0]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x14002b030
mov r8, qword [rsi]
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx + 0x9680]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b060
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b090
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0xa0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx + 0x1298]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b0c0
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx + 0x9680]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b0f0
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b120
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0x1b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx + 0x139c]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b150
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x4e0]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b180
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b1b0
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0x3d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx + 0x1298]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b1e0
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x4e0]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b210
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
mov byte [rdi + rdx - 1], al
inc rdx
test al, al
jne 0x14002b240
mov rdx, qword [r8 + 0xb0]
lea rdi, [rsp + 0x2c0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx + 0x139c]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x14002b270
lea rcx, [rsp + 0x3d0]
call fcn.1400d0090
test eax, eax
je 0x14002b2f8
lea rcx, [rsp + 0x2c0]
call fcn.1400d0090
test eax, eax
je 0x14002b2f8
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r15d, 1
mov dword [rsp + 0x44], r15d
lea rcx, [rsp + 0x80]
call fcn.1400a3d70
nop
mov eax, r15d
jmp 0x14002b30f
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret