Function at 0x140096ec0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.1401f4630
sub rsp, rax
xor r15d, r15d
mov r13, rdx
mov eax, r15d
mov rbp, rcx
mov r8, rcx
cmp byte [rcx], al
je 0x140096f04
cmp eax, 0x80000000
jae 0x140096f04
inc r8
inc eax
cmp byte [r8], r15b
jne 0x140096ef3
btr eax, 0x1f
mov rcx, r13
lea r12d, [rax + 1]
mov eax, r15d
mov esi, r12d
cmp byte [rdx], al
je 0x140096f31
nop dword [rax]
cmp eax, 0x80000000
jae 0x140096f31
inc rcx
inc eax
cmp byte [rcx], r15b
jne 0x140096f20
btr eax, 0x1f
mov qword [rsp + 0x68], rdi
inc eax
mov dword [rsp + 0x60], eax
mov r14d, eax
lea rcx, [rax + r12]
add rcx, rcx
call fcn.1402027ac
mov rbx, rax
test rax, rax
je 0x1400971ac
mov dword [rsp + 0x28], r12d
lea rdi, [rax + r12*2]
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov r8, rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140097040
mov rcx, r15
test r12d, r12d
je 0x140097040
cmp rsi, 0x20
jb 0x140097030
lea rax, [rbp - 1]
add rax, rsi
lea rdx, [r12 - 1]
lea rdx, [rbx + rdx*2]
cmp rbx, rax
ja 0x140096fb1
cmp rdx, rbp
jae 0x140097030
mov r8, rsi
and r8, 0xffffffffffffffe0
lea rax, [rbp + 0x10]
lea rdx, [rbx + 0x20]
movq xmm0, qword [rax - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x20]
punpcklbw xmm0, xmm0
add rcx, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rax - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rax - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rcx, r8
jb 0x140096fc0
cmp rcx, rsi
jae 0x140097040
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + rbp]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rsi
jb 0x140097030
mov r9d, dword [rsp + 0x60]
mov r8, r13
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140097131
mov rax, r15
test r14, r14
je 0x140097131
cmp r14, 0x20
jb 0x140097120
lea rcx, [r13 - 1]
add rcx, r14
lea rdx, [rdi - 2]
lea rdx, [rdx + r14*2]
cmp rdi, rcx
ja 0x140097097
cmp rdx, r13
jae 0x140097120
mov r8, r14
and r8, 0xffffffffffffffe0
lea rcx, [r13 + 0x10]
lea rdx, [rdi + 0x20]
nop word [rax + rax]
movq xmm0, qword [rcx - 0x10]
lea rdx, [rdx + 0x40]
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x20]
punpcklbw xmm0, xmm0
add rax, 0x20
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rcx - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rcx - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rax, r8
jb 0x1400970b0
cmp rax, r14
jae 0x140097131
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rax + r13]
mov word [rdi + rax*2], cx
inc rax
cmp rax, r14
jb 0x140097120
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400971b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x140097155
cmp eax, 0x50
jne 0x14009717a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140097172
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400971b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea eax, [rcx - 2]
cmp eax, 1
jbe 0x1400971a1
cmp ecx, 5
jne 0x140097194
call fcn.14020167c
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x1400971ac
call fcn.14020167c
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x1400971ac
call fcn.14020167c
mov dword [rax], 2
mov r15d, 0xffffffff
test rbx, rbx
je 0x1400971c4
cmp rbx, rbp
je 0x1400971c4
mov rcx, rbx
call fcn.140202798
mov rdi, qword [rsp + 0x68]
mov eax, r15d
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret