Function at 0x140032738
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x20e0
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x20d0], rax
mov rdi, qword [rsp + 0x2130]
mov r12, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x140032ef9
mov rcx, qword [rcx]
cmp qword [rdi], rcx
jne 0x140032ef9
mov eax, dword [rdi + 0x10]
xor r14d, r14d
mov qword [rsp + 0x40], r14
cmp eax, 0xfffffe34
je 0x140032dd4
cmp eax, 0xfffffe35
je 0x140032d77
cmp eax, 0xfffffe36
je 0x140032d2a
cmp eax, 0xfffffe3a
je 0x140032c6d
cmp eax, 0xfffffe3d
je 0x1400328ff
cmp eax, 0xfffffe64
je 0x1400328be
cmp eax, 0xfffffffb
jne 0x140032ef9
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx]
mov qword [rsp + 0x98], rdx
lea r9, [rsp + 0x98]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0xa8]
cmp r9, r14
je 0x140032ef9
mov rcx, qword [rbx]
lea r8d, [r14 + 9]
mov edx, 0x110b
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0xa0], 4
je 0x140032ef9
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
je 0x140032ef9
mov r8, qword [rsp + 0x78]
cmp r8, r14
je 0x140032ef9
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140030db4
jmp 0x140032ef9
movzx eax, word [rdi + 0x18]
cmp eax, 0x2e
je 0x1400328f2
cmp eax, 0x71
je 0x1400328e5
cmp eax, 0x74
jne 0x140032ef9
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.1400324dc
jmp 0x140032ef9
mov rcx, rbx
call fcn.14003186c
jmp 0x140032ef9
mov rcx, rbx
call fcn.1400325d0
jmp 0x140032ef9
mov rsi, qword [rdi + 0x88]
mov word [rsp + 0x10d0], r14w
cmp rsi, r14
jne 0x140032a65
mov r12, qword [rdi + 0x60]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
mov esi, 0x800
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
je 0x140032ef9
or rbp, 0xffffffffffffffff
mov rcx, qword [rbx]
mov r9, r12
mov edx, 0x110a
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
mov r12, rax
cmp rax, r14
je 0x140032b40
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r14
je 0x140032a23
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x10d0]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x7ff
jae 0x140032a23
cmp word [rsp + 0x10d0], r14w
je 0x140032a0b
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.14006119c
lea rdx, [rsp + 0x10d0]
lea rcx, [rsp + 0xd0]
mov r8, rsi
call fcn.1400805dc
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x10d0]
mov r8, rsi
call fcn.1400805a0
mov rcx, qword [rbx]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x68], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r14d
jne 0x14003295f
jmp 0x140032ef9
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x140032b53
cmp word [0x140131360], r14w
jne 0x140032ac0
lea r8, [rsp + 0x30]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140131360]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [0x140188d30]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140131360]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x10d0]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x140131360]
call fcn.1400c94cc
cmp eax, r14d
jne 0x140032b2b
lea r8, [rsi + 8]
lea r9, [rsp + 0xd0]
mov rdx, rsi
mov rcx, r12
call fcn.140031940
cmp al, r14b
je 0x140032b3d
mov rcx, r14
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x10ce], ax
cmp ax, r14w
jne 0x140032b0f
jmp 0x140032b3d
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x10d0]
jmp 0x140032c57
call fcn.14004b0ac
cmp eax, 0x601
jb 0x140032ef9
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r14
je 0x140032ef9
lea rdx, str.SHCreateItemFromIDList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r14
je 0x140032ef9
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x88]
lea rdx, [0x1400e2db0]
call rax
cmp eax, r14d
jne 0x140032ef9
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x90]
lea r8, [0x1400e2d68]
xor edx, edx
call fcn.1400318ac
cmp eax, r14d
jne 0x140032ef9
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x80]
lea r8, [0x1400e2db0]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x48]
cmp eax, r14d
jne 0x140032ef9
mov rcx, qword [rsp + 0x80]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp eax, r14d
jne 0x140032ef9
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xd0]
mov r8d, 0x800
call fcn.1400805a0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0xd0]
mov rcx, rax
xor r8d, r8d
mov edx, 0x800b
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140032ef9
test byte [rdi + 0x68], 0x40
jne 0x140032ef9
mov rsi, qword [rdi + 0x88]
cmp rsi, r14
je 0x140032ef9
mov eax, dword [0x140131358]
mov ecx, eax
inc eax
mov dword [0x140131358], eax
cmp ecx, r14d
ja 0x140032ef9
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
lea r9, [0x1400ec038]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsi + 8]
xor r8d, r8d
call qword [rax + 0x28]
cmp eax, r14d
jl 0x140032ce3
mov rax, qword [rdi + 0x60]
mov r9, qword [rsi + 0x10]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140031214
mov rax, qword [rdi + 0x60]
mov rcx, qword [rbx]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0xb0], rax
lea rax, [0x140031550]
xor r8d, r8d
mov edx, 0x1115
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
dec dword [0x140131358]
jmp 0x140032ef9
mov rdi, qword [rdi + 0x50]
cmp rdi, r14
je 0x140032ef9
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140188d30]
mov rdx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x140188d30]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x140188d30]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x140032ef9
mov rcx, qword [rdi + 0x48]
cmp rcx, r14
jne 0x140032d8f
movabs rax, 1
jmp 0x140032efb
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x140032d80
lea rcx, [rsp + 0x10d0]
call fcn.14003c3d4
cmp al, r14b
je 0x140032d80
lea rcx, [rsp + 0x10d0]
call fcn.1400615e8
cmp word [rax], r14w
je 0x140032d80
mov byte [rbx + 0x11], 1
jmp 0x140032ef9
mov byte [rbx + 0x11], r14b
cmp qword [rdi + 0x30], r14
je 0x140032ef9
mov rcx, qword [rdi + 0x48]
cmp rcx, r14
je 0x140032ef9
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x10d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r14d
je 0x140032ef9
mov rcx, r14
movzx eax, word [rsp + rcx + 0x10d0]
add rcx, 2
mov word [rsp + rcx + 0xce], ax
cmp ax, r14w
jne 0x140032e0d
lea rcx, [rsp + 0xd0]
call fcn.1400615e8
or rbp, 0xffffffffffffffff
mov esi, 0x800
mov word [rax], r14w
mov r8, qword [rdi + 0x30]
xor eax, eax
mov rdi, r8
mov rcx, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0xd0]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, rsi
jae 0x140032efb
lea rdi, [rsp + 0xd0]
mov rcx, rbp
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r8 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140032e87
lea rcx, [rsp + 0xd0]
call fcn.14003c3d4
cmp al, r14b
je 0x140032ec0
mov ecx, 0x50d
call fcn.140076080
mov rcx, rax
call fcn.1400b189c
jmp 0x140032ef9
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r14d
je 0x140032ef9
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.1400324dc
lea rdx, [rsp + 0xd0]
mov r8b, 1
mov rcx, rbx
call fcn.140031e3c
xor eax, eax
mov rcx, qword [rsp + 0x20d0]
xor rcx, rsp
call fcn.1400c6350
mov rbx, qword [rsp + 0x2120]
add rsp, 0x20e0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret