Function at 0x140027d8c
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x10e0
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov rdi, qword [rsp + 0x1130]
mov rbp, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x14002853b
mov rcx, qword [rcx]
cmp qword [rdi], rcx
jne 0x14002853b
mov eax, dword [rdi + 0x10]
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp eax, 0xfffffe34
je 0x140028415
cmp eax, 0xfffffe35
je 0x1400283b8
cmp eax, 0xfffffe36
je 0x14002836b
cmp eax, 0xfffffe3a
je 0x1400282d6
cmp eax, 0xfffffe3d
je 0x140027f53
cmp eax, 0xfffffe64
je 0x140027f12
cmp eax, 0xfffffffb
jne 0x14002853b
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx]
mov qword [rsp + 0x98], rdx
lea r9, [rsp + 0x98]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0xa8]
cmp r9, r13
je 0x14002853b
mov rcx, qword [rbx]
lea r8d, [r13 + 9]
mov edx, 0x110b
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0xa0], 4
je 0x14002853b
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
je 0x14002853b
mov r8, qword [rsp + 0x78]
cmp r8, r13
je 0x14002853b
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140026428
jmp 0x14002853b
movzx eax, word [rdi + 0x18]
cmp eax, 0x2e
je 0x140027f46
cmp eax, 0x71
je 0x140027f39
cmp eax, 0x74
jne 0x14002853b
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.140027b34
jmp 0x14002853b
mov rcx, rbx
call fcn.140026ed4
jmp 0x14002853b
mov rcx, rbx
call fcn.140027c24
jmp 0x14002853b
mov rsi, qword [rdi + 0x88]
mov word [rsp + 0x8d0], r13w
cmp rsi, r13
jne 0x1400280ce
mov rbp, qword [rdi + 0x60]
lea rax, [rsp + 0xd0]
mov esi, 0x113e
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x400
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
je 0x14002853b
or r12, 0xffffffffffffffff
mov rcx, qword [rbx]
mov r9, rbp
mov edx, 0x110a
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
mov rbp, rax
cmp rax, r13
je 0x1400281a9
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r13
je 0x14002808b
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x8d0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x3ff
jae 0x14002808b
cmp word [rsp + 0x8d0], r13w
je 0x14002806e
lea rcx, [rsp + 0xd0]
call fcn.140052588
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, r12
lea rdx, [rsp + 0x8d0]
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x14002805c
mov rcx, r13
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x8ce], ax
cmp ax, r13w
jne 0x140028071
mov rcx, qword [rbx]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x68], 0x400
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
jne 0x140027fb4
jmp 0x14002853b
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x1400281bc
cmp word [0x1400e9010], r13w
jne 0x140028129
lea r8, [rsp + 0x30]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400e9010]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [0x140126b70]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400e9010]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x8d0]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x1400e9010]
call fcn.1400ab1b4
cmp eax, r13d
jne 0x140028194
lea r8, [rsi + 8]
lea r9, [rsp + 0xd0]
mov rdx, rsi
mov rcx, rbp
call fcn.140026fa8
cmp al, r13b
je 0x1400281a6
mov rcx, r13
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x8ce], ax
cmp ax, r13w
jne 0x140028178
jmp 0x1400281a6
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x8d0]
jmp 0x1400282c0
call fcn.14003ed2c
cmp eax, 0x601
jb 0x14002853b
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r13
je 0x14002853b
lea rdx, str.SHCreateItemFromIDList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r13
je 0x14002853b
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x88]
lea rdx, [0x1400c5478]
call rax
cmp eax, r13d
jne 0x14002853b
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x90]
lea r8, [0x1400c5430]
xor edx, edx
call fcn.140026f14
cmp eax, r13d
jne 0x14002853b
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x80]
lea r8, [0x1400c5478]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x48]
cmp eax, r13d
jne 0x14002853b
mov rcx, qword [rsp + 0x80]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp eax, r13d
jne 0x14002853b
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xd0]
mov r8d, 0x400
call fcn.14006b658
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0xd0]
mov rcx, rax
mov edx, 0x40a
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14002853b
test byte [rdi + 0x68], 0x40
jne 0x14002853b
mov rsi, qword [rdi + 0x88]
cmp rsi, r13
je 0x14002853b
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
lea r9, [0x1400cd3c8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsi + 8]
xor r8d, r8d
call qword [rax + 0x28]
cmp eax, r13d
jl 0x140028333
mov rax, qword [rdi + 0x60]
mov r9, qword [rsi + 0x10]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140026888
mov rax, qword [rdi + 0x60]
mov rcx, qword [rbx]
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb0], rax
lea rax, [0x140026bbc]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov edx, 0x1115
jmp 0x1400282c8
mov rdi, qword [rdi + 0x50]
cmp rdi, r13
je 0x14002853b
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140126b70]
mov rdx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x140126b70]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x140126b70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14002853b
mov rcx, qword [rdi + 0x48]
cmp rcx, r13
jne 0x1400283d0
movabs rax, 1
jmp 0x14002853d
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x1400283c1
lea rcx, [rsp + 0x8d0]
call fcn.140031164
cmp al, r13b
je 0x1400283c1
lea rcx, [rsp + 0x8d0]
call fcn.140052af8
cmp word [rax], r13w
je 0x1400283c1
mov byte [rbx + 0x11], 1
jmp 0x14002853b
mov byte [rbx + 0x11], r13b
cmp qword [rdi + 0x30], r13
je 0x14002853b
mov rcx, qword [rdi + 0x48]
cmp rcx, r13
je 0x14002853b
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x14002853b
mov rcx, r13
movzx eax, word [rsp + rcx + 0x8d0]
add rcx, 2
mov word [rsp + rcx + 0xce], ax
cmp ax, r13w
jne 0x14002844e
lea rcx, [rsp + 0xd0]
call fcn.140052af8
or r12, 0xffffffffffffffff
mov word [rax], r13w
mov r8, qword [rdi + 0x30]
xor eax, eax
mov rdi, r8
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0xd0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x400
jae 0x14002853d
lea rdi, [rsp + 0xd0]
mov rcx, r12
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r8 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x1400284c7
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call fcn.1400310fc
cmp al, r13b
je 0x140028502
mov ecx, 0x50d
call fcn.140061d94
mov rcx, rax
call fcn.140096028
jmp 0x14002853b
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r13d
je 0x14002853b
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.140027b34
lea rdx, [rsp + 0xd0]
mov r8b, 1
mov rcx, rbx
call fcn.140027480
xor eax, eax
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.1400a86e0
mov rbx, qword [rsp + 0x1120]
add rsp, 0x10e0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret