Function at 0x100017254
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r12, rcx
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x40]
test al, al
jne 0x100017293
xor eax, eax
jmp 0x10001777b
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x38]
mov ebx, eax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
test ebx, eax
jne 0x1000172b3
xor eax, eax
jmp 0x10001777b
mov dl, 1
lea rcx, [0x100008d50]
call fcn.100015444
mov ebp, 1
mov rax, qword [r12]
mov edx, ebp
mov rcx, r12
call qword [rax + 0x40]
test al, al
je 0x10001753a
mov rax, qword [r12]
mov edx, ebp
mov rcx, r12
call qword [rax + 0x50]
mov r15, rax
mov rcx, rax
call fcn.100024dbc
test eax, eax
jns 0x10001753a
movsxd rax, ebp
mov qword [rsp + 0x40], rax
mov rcx, rax
shl rcx, 5
lea r14, [0x100007990]
mov r14, qword [rcx + r14]
and qword [rsp + 0x50], 0
and qword [rsp + 0xc8], 0
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
mov edx, ebp
mov rcx, r12
call fcn.100016ca4
mov ebx, eax
test eax, eax
js 0x100017762
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
je 0x100017747
and qword [rsp + 0xb0], 0
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.100015958
mov edi, eax
test eax, eax
js 0x100017728
mov rsi, qword [rsp + 0xb0]
mov rax, qword [r12]
mov r8, rsi
mov edx, ebp
mov rcx, r12
call qword [rax + 0x58]
mov r13, rax
test rax, rax
je 0x1000176db
and qword [rsp + 0x58], 0
and qword [rsp + 0xb0], 0
mov r8, r14
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0xb0]
call fcn.100015ab0
mov edi, eax
test eax, eax
js 0x1000176b2
cmp ebp, 1
je 0x10001740b
cmp ebp, 6
je 0x10001740b
mov rdi, qword [rsp + 0xb0]
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.10001df80
mov esi, eax
test eax, eax
je 0x1000173ff
or esi, 0x84990000
jmp 0x100017401
xor esi, esi
test esi, esi
js 0x10001754c
jmp 0x10001742b
mov rdi, qword [rsp + 0xb0]
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.100014a90
mov esi, eax
test eax, eax
js 0x100017674
and qword [rsp + 0xb0], 0
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.100015958
mov esi, eax
test eax, eax
js 0x10001763e
mov rsi, qword [rsp + 0xb0]
movzx edx, si
mov rax, rsi
shr rax, 0x10
movzx ecx, ax
mov rax, rsi
shr rax, 0x20
movzx r9d, ax
mov r8, rsi
shr r8, 0x30
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov rdx, r14
lea rcx, [0x100008f18]
call fcn.10001288c
mov rax, qword [rsp + 0x40]
mov r11, qword [r12 + rax*8 + 0x68]
movabs rax, 0x270f270f270f270f
cmp r11, rax
je 0x1000174d5
cmp rsi, r11
jae 0x1000174cc
mov rcx, rbx
mov rbx, rdi
mov qword [rsp + 0xc8], rbx
test rcx, rcx
je 0x100017385
call qword [sym.imp.msvcrt.dll_free]
jmp 0x100017385
cmp rsi, r11
ja 0x10001759e
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000174f1
call fcn.100027b98
mov esi, eax
jmp 0x1000174f3
xor esi, esi
test esi, esi
js 0x100017605
test rdi, rdi
je 0x10001750a
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x10001752a
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
jmp 0x10001753a
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
inc rbp
cmp rbp, 9
jae 0x100017779
jmp 0x1000172c6
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x100008e80]
call fcn.10001288c
mov qword [rsp + 0x20], rdi
mov r9, r13
mov r8, rbx
lea rdx, [0x100008ed8]
mov ecx, esi
call fcn.1000128bc
nop
test rdi, rdi
je 0x100017589
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x100017597
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
movzx r10d, si
mov rax, rsi
shr rax, 0x10
movzx edx, ax
mov rax, rsi
shr rax, 0x20
movzx ecx, ax
shr rsi, 0x30
mov r9d, esi
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov r8, r14
lea rdx, [0x100008f50]
mov esi, 0x80070670
mov ecx, esi
call fcn.1000128bc
nop
test rdi, rdi
je 0x1000175f0
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x1000175fe
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
mov r9, r15
mov r8, rdi
lea rdx, [0x100009008]
mov ecx, esi
call fcn.1000128bc
nop
test rdi, rdi
je 0x100017629
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x100017637
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
mov r8, rdi
lea rdx, [0x100008db0]
mov ecx, eax
call fcn.1000128bc
nop
test rdi, rdi
je 0x10001765f
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x10001766d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
mov qword [rsp + 0x20], rdi
mov r9, r13
mov r8, rbx
lea rdx, [0x100008e48]
mov ecx, eax
call fcn.1000128bc
nop
test rdi, rdi
je 0x10001769d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x1000176ab
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1000176c6
call qword [sym.imp.msvcrt.dll_free]
nop
test rbx, rbx
je 0x1000176d4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x10001777b
movzx edx, si
mov rax, rsi
shr rax, 0x10
movzx ecx, ax
mov rax, rsi
shr rax, 0x20
movzx r9d, ax
shr rsi, 0x30
mov r8d, esi
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [0x100008de0]
mov esi, 0x80070670
mov ecx, esi
call fcn.1000128bc
nop
test rbx, rbx
je 0x100017724
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x10001777b
mov r8, rbx
lea rdx, [0x100008db0]
mov ecx, eax
call fcn.1000128bc
nop
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x10001777b
mov r8, r14
lea rdx, [0x100008d78]
mov esi, 0x80070670
mov ecx, esi
call fcn.1000128bc
nop
mov eax, esi
jmp 0x10001777b
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x100017775
call qword [sym.imp.msvcrt.dll_free]
mov eax, ebx
jmp 0x10001777b
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret