Function at 0x1400e9630
Capabilities:
Delete file
Move file

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.1400e7180
lea rcx, [rbx + 0x78]
lea rdx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_ostream_char__struct_std::char_traits_char__::tellp_void____ptr64]
mov rdx, qword [rax + 8]
add rdx, qword [rax]
movsxd rax, dword [rbx + 0x1d0]
cmp rdx, rax
jle 0x1400e746f
mov dl, 1
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp 0x1400e9630
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x140653828]
xor rax, rsp
mov qword [rsp + 0xd0], rax
movzx edi, dl
mov r14, rcx
xor r15d, r15d
call fcn.1400b5530
mov r13, rax
mov ebx, r15d
mov qword [rsp + 0x48], rbx
lea r12, [r14 + 0x78]
lea rcx, [r12 + 8]
call fcn.1400c23f0
test rax, rax
jne 0x1400e96a0
mov rax, qword [r12]
movsxd rcx, dword [rax + 4]
add rcx, r12
xor r8d, r8d
lea edx, [r15 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [r12]
movsxd rcx, dword [rax + 4]
add rcx, 0x78
add rcx, r14
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
cmp byte [r14 + 0x58], 0
je 0x1400e974d
test dil, dil
jne 0x1400e96f2
mov rdx, qword [r14 + 0x50]
lea rcx, [rsp + 0x48]
call fcn.1400ce170
mov rbx, qword [rsp + 0x48]
jmp 0x1400e96f2
lea rcx, [rsp + 0x50]
call fcn.1400d1310
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x64], r15d
lea rdi, [r14 + 0x180]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400e18f0
cmp eax, 0xffffffff
je 0x1400e972c
mov eax, dword [r14 + 0x1d0]
cmp dword [rsp + 0x64], eax
jge 0x1400e9754
mov edx, 6
mov rcx, r14
call fcn.1400e8b70
mov r8, rdi
mov rdx, r12
mov rcx, r13
call fcn.1400e83c0
nop
jmp 0x1400e9b9a
lea rdi, [r14 + 0x180]
mov edx, dword [r14 + 0x1d4]
test edx, edx
jle 0x1400e9ad8
mov rcx, rdi
call fcn.1400e9bf0
mov rcx, qword [rdi + 0x10]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 2
jb 0x1400e9bd5
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400e9796
mov r9, qword [rdi]
mov qword [rsp + 0x30], 2
lea rax, [0x1401e9d5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400a13a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x1400e97e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rdi + 0x10]
sub rsi, rcx
cmp rsi, 0xe
jb 0x1400e9bdb
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400e9802
mov rax, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohl
lea r9, str.Renaming_file
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1400a13a0
nop
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x1400e9885
lea rax, [rcx + 4]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x90]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x90]
mov dword [rax + rcx], 0x206f7420
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x90]
jmp 0x1400e98a9
mov qword [rsp + 0x20], 4
lea r9, str._to
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x90]
call fcn.140003cd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.140006350
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.1400b5a20
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x1400e9994
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e998f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e998f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131388
movdqa xmm0, xmmword [0x14014dec0]
movdqu xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0xb0], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x1400e99f0
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e99eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e99eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131388
movdqa xmm0, xmmword [0x14014dec0]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400e9a4c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e9a47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131388
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400e9a6a
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
test eax, eax
je 0x1400e9a7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r15d, dword [rax]
mov r9d, r15d
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.1400e84c0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400e9b7e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e9b79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rdi + 0x10]
movabs rsi, 0x7fffffffffffffff
sub rsi, rax
cmp rsi, 0x19
jb 0x1400e9be1
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400e9b00
mov r9, qword [rdi]
mov qword [rsp + 0x30], 0x19
lea rcx, str._has_no_backups_specified
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400a13a0
nop
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.1400b5a20
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x1400e9b7e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e9b79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131388
mov edx, send
mov rcx, r14
call fcn.1400e8b70
mov r8, rdi
mov rdx, r12
mov rcx, r13
call fcn.1400e83c0
nop
test rbx, rbx
je 0x1400e9ba8
mov rcx, rbx
call fcn.1400e3c20
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140131030
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140005540
nop
call fcn.140005540
nop
call fcn.140005540
int3