Function at 0x14004dab0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.14005d7e0
sub rsp, rax
xor r12d, r12d
mov r14, rdx
mov eax, r12d
mov rbp, rcx
mov r8, rcx
cmp byte [rcx], al
je 0x14004daf4
cmp eax, 0x80000000
jae 0x14004daf4
inc r8
inc eax
cmp byte [r8], r12b
jne 0x14004dae3
btr eax, 0x1f
mov rcx, r14
lea r13d, [rax + 1]
mov eax, r12d
mov esi, r13d
cmp byte [rdx], al
je 0x14004db21
nop dword [rax]
cmp eax, 0x80000000
jae 0x14004db21
inc rcx
inc eax
cmp byte [rcx], r12b
jne 0x14004db10
btr eax, 0x1f
mov qword [rsp + 0x68], rdi
inc eax
mov dword [rsp + 0x60], eax
mov r15d, eax
lea rcx, [rax + r13]
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004de1f
mov dword [rsp + 0x28], r13d
lea rdi, [rax + r13*2]
mov r9d, r13d
mov qword [rsp + 0x20], rax
mov r8, rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14004dc80
mov rcx, r12
test r13d, r13d
je 0x14004dc5c
cmp rsi, 4
jb 0x14004dc70
lea rax, [rbp - 1]
add rax, rsi
lea rdx, [r13 - 1]
lea rdx, [rbx + rdx*2]
cmp rbx, rax
ja 0x14004dba5
cmp rdx, rbp
jae 0x14004dc70
cmp rsi, 0x20
jb 0x14004dc37
mov rax, rsi
mov r9, rsi
and eax, 0x1f
sub r9, rax
lea rdx, [rbp + 0x10]
lea r8, [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
movq xmm0, qword [rdx - 0x10]
lea r8, [r8 + 0x40]
movq xmm1, qword [rdx - 8]
lea rdx, [rdx + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [r8 - 0x60], xmm0
movq xmm0, qword [rdx - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 - 0x50], xmm1
movq xmm1, qword [rdx - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [r8 - 0x40], xmm0
movdqu xmmword [r8 - 0x30], xmm1
cmp rcx, r9
jb 0x14004dbd0
cmp rax, 4
jb 0x14004dc5c
mov rax, rsi
and rax, 0xfffffffffffffffc
nop
movd xmm0, dword [rcx + rbp]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rbx + rcx*2], xmm0
add rcx, 4
cmp rcx, rax
jb 0x14004dc40
cmp rcx, rsi
jae 0x14004dc80
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + rbp]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rsi
jb 0x14004dc70
mov r9d, dword [rsp + 0x60]
mov r8, r14
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14004dda1
mov rax, r12
test r15, r15
je 0x14004dd7d
cmp r15, 4
jb 0x14004dd90
lea rcx, [r14 - 1]
add rcx, r15
lea rdx, [rdi - 2]
lea rdx, [rdx + r15*2]
cmp rdi, rcx
ja 0x14004dcd7
cmp rdx, r14
jae 0x14004dd90
cmp r15, 0x20
jb 0x14004dd55
mov r8, r15
mov r9, r15
and r8d, 0x1f
sub r9, r8
lea rcx, [r14 + 0x10]
lea rdx, [rdi + 0x20]
movq xmm0, qword [rcx - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x20]
punpcklbw xmm0, xmm0
add rax, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rcx - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rcx - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rax, r9
jb 0x14004dcf2
cmp r8, 4
jb 0x14004dd7d
mov rcx, r15
and rcx, 0xfffffffffffffffc
nop dword [rax]
movd xmm0, dword [rax + r14]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rdi + rax*2], xmm0
add rax, 4
cmp rax, rcx
jb 0x14004dd60
cmp rax, r15
jae 0x14004dda1
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rax + r14]
mov word [rdi + rax*2], cx
inc rax
cmp rax, r15
jb 0x14004dd90
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14004de2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x14004ddc5
cmp eax, 0x50
jne 0x14004ddea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14004dde2
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14004de2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x14004de13
cmp ecx, 5
jne 0x14004de05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
jmp 0x14004de1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x14004de1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov r12d, 0xffffffff
test rbx, rbx
je 0x14004de38
cmp rbx, rbp
je 0x14004de38
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x68]
mov eax, r12d
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret