Function at 0x100029028
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r15d, r15d
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov edi, r15d
mov rcx, qword [0x1001653b8]
lea r14, [0x1001653b8]
cmp rcx, r14
je 0x10002909b
test byte [rcx + 0x1c], 1
je 0x10002909b
cmp byte [rcx + 0x19], 4
jb 0x10002909b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x126
call fcn.10001c854
mov ecx, dword [r12 + 0x14c]
or rbp, 0xffffffffffffffff
mov rbx, r15
mov qword [rsp + 0x68], r15
mov rsi, r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x50], r15
mov r13, r15
mov qword [rsp + 0x60], r15
call fcn.1000a35bc
test al, 8
jne 0x100029125
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000291e1
test byte [rcx + 0x1c], 1
je 0x1000291e1
cmp byte [rcx + 0x19], 4
jb 0x1000291e1
mov r9d, dword [r12 + 0x14c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x127
call fcn.10001c878
jmp 0x1000291e1
cmp qword [r12 + 0x1d8], r15
jne 0x10002916f
mov edi, 0x80070057
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000291e1
test byte [rcx + 0x1c], 1
je 0x1000291e1
cmp byte [rcx + 0x19], 2
jb 0x1000291e1
mov edx, 0x128
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
call fcn.10001c854
jmp 0x1000291e1
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.100027dac
cmp eax, r15d
mov edi, eax
jge 0x100029214
mov rcx, qword [0x1001653b8]
cmp rcx, r14
je 0x1000291b7
test byte [rcx + 0x1c], 1
je 0x1000291b7
cmp byte [rcx + 0x19], 2
jb 0x1000291b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x129
mov r9d, eax
call fcn.10001c878
mov r14, qword [rsp + 0x50]
cmp r14, r15
je 0x1000291d2
mov rcx, r14
call fcn.1000a94fc
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbp, 0xffffffffffffffff
je 0x1000291e1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r14, qword [rsp + 0x50]
cmp r14, r15
jne 0x100029247
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000291e1
test byte [rcx + 0x1c], 1
je 0x1000291e1
cmp byte [rcx + 0x19], 4
jb 0x1000291e1
mov edx, 0x12a
jmp 0x10002915d
mov rcx, qword [r12 + 0x1d8]
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.100120c14
cmp eax, r15d
mov edi, eax
jl 0x10002982a
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
xor r9d, r9d
call fcn.10010bd44
cmp eax, r15d
mov edi, eax
jge 0x1000292d3
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000292c4
test byte [rcx + 0x1c], 1
je 0x1000292c4
cmp byte [rcx + 0x19], 2
jb 0x1000292c4
mov r9, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x12b
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
jmp 0x10002982a
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbp
cmp rbx, r15
je 0x100029808
movdqu xmm0, xmmword [0x10000f0f8]
movdqu xmmword [rsp + 0xf0], xmm0
cmp rsi, r15
je 0x10002930f
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x48], r15
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
je 0x10002932a
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x80], r15
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.1000a0168
cmp eax, r15d
mov edi, eax
jl 0x100029883
mov rsi, qword [rsp + 0x48]
lea rdx, [0x100004aa0]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r15d
jne 0x10002939f
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000297c2
test byte [rcx + 0x1c], 1
je 0x1000297c2
cmp byte [rcx + 0x19], 4
jb 0x1000297c2
mov edx, 0x12c
jmp 0x100029434
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x24
jae 0x1000293e9
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000297c2
test byte [rcx + 0x1c], 1
je 0x1000297c2
cmp byte [rcx + 0x19], 4
jb 0x1000297c2
mov edx, 0x12d
jmp 0x100029434
lea rdx, [rsp + 0xf0]
mov rcx, rsi
mov word [rsi + 0x48], r15w
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
cmp eax, r15d
je 0x10002944c
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000297c2
test byte [rcx + 0x1c], 1
je 0x1000297c2
cmp byte [rcx + 0x19], 4
jb 0x1000297c2
mov edx, 0x12e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov r9, rbx
call fcn.10001db08
jmp 0x1000297c2
lea rax, [rsp + 0xf0]
lea rcx, [0x10000f0f8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x100029472
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x100029472
mov eax, r15d
jmp 0x100029477
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
je 0x1000297c2
mov r8, qword [rsp + 0x50]
mov ebp, r15d
mov dword [rsp + 0x78], r15d
mov edi, dword [r8 + 0x40]
mov r14, r15
cmp edi, r15d
jbe 0x1000294d9
mov eax, ebp
lea rcx, [rsp + 0xf0]
imul rax, rax, 0x78
add rax, qword [r8 + 0x48]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000294c2
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000294c2
mov eax, r15d
jmp 0x1000294c7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r15d
je 0x1000294d5
inc ebp
inc r14
cmp ebp, edi
jb 0x100029499
mov dword [rsp + 0x78], ebp
cmp ebp, edi
jb 0x100029525
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000297bd
test byte [rcx + 0x1c], 1
je 0x1000297bd
cmp byte [rcx + 0x19], 3
jb 0x1000297bd
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x12f
mov r9, rbx
call fcn.10001db08
jmp 0x1000297bd
mov r12d, dword [r12 + 0x170]
xor edi, edi
mov esi, r15d
cmp r12d, edi
jbe 0x10002959f
mov rdi, qword [rsp + 0x70]
mov rbx, qword [r8 + 0x48]
imul r14, r14, 0x78
mov rdi, qword [rdi + 0xd8]
movzx r13d, word [r14 + rbx + 0x44]
add rdi, 0x70
xor ebp, ebp
cmp r13w, word [rdi - 6]
jne 0x100029579
cmp r13w, bp
je 0x100029579
mov rdx, qword [rdi]
mov rcx, qword [r14 + rbx + 0x48]
movzx r8d, r13w
call sub.msvcrt.dll_memcmp
cmp eax, ebp
je 0x10002958a
inc esi
inc r15
add rdi, 0x160
cmp esi, r12d
jb 0x100029557
mov rbx, qword [rsp + 0x58]
mov ebp, dword [rsp + 0x78]
mov r13, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
xor edi, edi
cmp esi, r12d
jne 0x100029606
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x1000295f9
test byte [rax + 0x1c], 1
je 0x1000295f9
cmp byte [rax + 0x19], 4
jb 0x1000295f9
mov edx, ebp
lea rcx, [rsp + 0x88]
imul rdx, rdx, 0x78
add rdx, qword [r8 + 0x48]
call fcn.10009b894
mov rcx, qword [0x1001653b8]
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x130
mov r9, rax
call fcn.10001db08
mov r12, qword [rsp + 0x70]
xor r15d, r15d
jmp 0x1000297b8
mov r12, qword [rsp + 0x70]
imul rsi, rsi, 0x160
mov rax, qword [r12 + 0xd8]
lea rcx, [rsi + rax + 0x44]
mov eax, ebp
imul rax, rax, 0x78
add rax, qword [r8 + 0x48]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10002963f
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10002963f
mov eax, edi
jmp 0x100029644
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x100029684
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000295fe
test byte [rcx + 0x1c], 1
je 0x1000295fe
cmp byte [rcx + 0x19], 4
jb 0x1000295fe
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x131
mov r9, rbx
call fcn.10001db08
jmp 0x1000295fe
cmp r13, rdi
je 0x100029697
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x60], rdi
mov rax, qword [r12 + 0xd8]
mov rcx, qword [r12 + 0x1d8]
imul r15, r15, 0x160
mov r8d, dword [rax + r15 + 0x54]
lea rdx, [rax + rsi + 0x44]
lea r9, [rsp + 0x60]
call fcn.100120c14
mov edi, eax
xor eax, eax
cmp edi, eax
jl 0x100029874
mov rax, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rax, rdi
je 0x100029759
test byte [rax + 0x1c], 1
je 0x100029759
cmp byte [rax + 0x19], 4
jb 0x100029759
mov rcx, qword [r12 + 0xd8]
lea rdi, [0x100005928]
mov rax, qword [rcx + r15 + 0x58]
lea rdx, [rsi + rcx + 0x44]
xor r15d, r15d
cmp rax, r15
lea rcx, [rsp + 0x88]
cmovne rdi, rax
call fcn.10009b894
mov rcx, qword [0x1001653b8]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x100003cc8]
mov edx, 0x132
mov r9, rbx
mov qword [rsp + 0x20], r13
call fcn.10001e1e0
lea rdi, [0x1001653b8]
jmp 0x100029761
mov r13, qword [rsp + 0x60]
xor r15d, r15d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r15d
jne 0x1000297b8
mov rax, qword [0x1001653b8]
cmp rax, rdi
je 0x1000297b8
test byte [rax + 0x1c], 1
je 0x1000297b8
cmp byte [rax + 0x19], 3
jb 0x1000297b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov edx, 0x133
mov r9, rbx
mov qword [rsp + 0x20], r13
call fcn.10001e39c
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
cmp rbx, r15
je 0x1000297d5
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x58], r15
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x58]
xor r9d, r9d
mov rdx, rbp
call fcn.10010bf68
mov rbx, qword [rsp + 0x58]
cmp eax, r15d
mov edi, eax
jl 0x100029883
cmp rbx, r15
jne 0x1000292eb
mov r14, qword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
or rbp, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x100029825
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x48]
cmp qword [rsp + 0x68], r15
je 0x10002983c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbx, r15
je 0x10002984a
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rsi, r15
je 0x100029858
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
je 0x1000291bc
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1000291bc
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
xor r15d, r15d
jmp 0x100029815
mov r14, qword [rsp + 0x50]
jmp 0x100029815