Function at 0x1400b2730
Capabilities:
Delete file
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6f0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov rbx, qword [rsp + 0x750]
mov byte [rsp + 0x58], 0
xor eax, eax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov dword [rsp + 0x71], eax
mov word [rsp + 0x75], ax
mov byte [rsp + 0x77], al
mov byte [rsp + 0x5d0], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x5d1]
call fcn.1400c2840
mov byte [rsp + 0x3b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x3b1]
call fcn.1400c2840
mov byte [rsp + 0x38], 0
xor eax, eax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov dword [rsp + 0x51], eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov byte [rsp + 0x190], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x191]
call fcn.1400c2840
mov byte [rsp + 0x80], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x81]
call fcn.1400c2840
mov byte [rsp + 0x4c0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x4c1]
call fcn.1400c2840
mov byte [rsp + 0x2a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2a1]
call fcn.1400c2840
mov r13d, 1
mov dword [rsp + 0x20], r13d
xor eax, eax
mov dword [rdi], eax
test rsi, rsi
je 0x1400b2dad
test r15, r15
je 0x1400b2dad
test r14, r14
je 0x1400b2896
test rbx, rbx
je 0x1400b289b
jmp 0x1400b28a5
test rbx, rbx
je 0x1400b28a5
mov eax, 1
jmp 0x1400b2dbc
mov rcx, r15
lea rdx, [rsp + 0x4c0]
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b28b0
mov edx, 0x5c
lea rcx, [rsp + 0x4c0]
call fcn.1400c2dd0
test rax, rax
je 0x1400b28e8
mov byte [rax], 0
lea rcx, [rsp + 0x4c0]
call fcn.1400b68d0
lea rcx, [rsp + 0x4c0]
call fcn.1400b3390
test rbx, rbx
je 0x1400b2955
mov rcx, rbx
lea rdx, [rsp + 0x2a0]
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b2910
mov edx, 0x5c
lea rcx, [rsp + 0x2a0]
call fcn.1400c2dd0
test rax, rax
je 0x1400b2948
mov byte [rax], 0
lea rcx, [rsp + 0x2a0]
call fcn.1400b68d0
lea rcx, [rsp + 0x2a0]
call fcn.1400b3390
lea rcx, [rsp + 0x38]
call fcn.1400b23b0
lea rdi, [rsp + 0x38]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x1400fd43c]
mov byte [rdi + 3], al
lea rcx, [rsp + 0x4c0]
lea rdx, [rsp + 0x190]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b2990
lea rdi, [rsp + 0x190]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x38]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b29c0
lea rcx, [rsp + 0x58]
call fcn.1400b23b0
lea rdi, [rsp + 0x58]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..dll]
mov dword [rdi - 1], eax
movzx eax, byte [0x1400fd43c]
mov byte [rdi + 3], al
lea rcx, [rsp + 0x4c0]
lea rdx, [rsp + 0x5d0]
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b2a10
lea rdi, [rsp + 0x5d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x58]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b2a40
test rbx, rbx
je 0x1400b2b00
lea rcx, [rsp + 0x2a0]
lea rdx, [rsp + 0x80]
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b2a70
lea rdi, [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x38]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b2aa0
lea rcx, [rsp + 0x2a0]
lea rdx, [rsp + 0x3b0]
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400b2ac0
lea rdi, [rsp + 0x3b0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x58]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400b2af0
lea rcx, [rsp + 0x190]
call fcn.1400b6a90
test eax, eax
jne 0x1400b2955
lea rcx, [rsp + 0x5d0]
call fcn.1400b6a90
test eax, eax
jne 0x1400b2955
test r14, r14
je 0x1400b2b59
lea rcx, [rsp + 0x80]
call fcn.1400b6a90
test eax, eax
jne 0x1400b2955
lea rcx, [rsp + 0x3b0]
call fcn.1400b6a90
test eax, eax
jne 0x1400b2955
mov rcx, rsi
call fcn.140001360
mov rdi, rax
test rax, rax
je 0x1400b2bc8
mov rcx, rax
call fcn.1400b2300
mov r12d, eax
or r8d, 0xffffffff
or edx, r8d
mov rcx, rdi
call fcn.140001d50
mov rsi, rax
test rax, rax
je 0x1400b2b96
mov rcx, rdi
call fcn.14008c4f0
mov rdi, rsi
mov rcx, rdi
call fcn.140001c80
mov rdx, rdi
lea rcx, [rsp + 0x190]
call fcn.140001930
test eax, eax
mov eax, 0
cmove r13d, eax
mov dword [rsp + 0x20], r13d
mov rcx, rdi
call fcn.14008c4f0
jmp 0x1400b2bcd
mov r12d, dword [rsp + 0x28]
test r13d, r13d
jne 0x1400b2d85
test r14, r14
je 0x1400b2c55
mov r13d, 1
mov dword [rsp + 0x20], r13d
mov rcx, r14
call fcn.140001360
mov rdi, rax
test rax, rax
je 0x1400b2d85
or r8d, 0xffffffff
or edx, r8d
mov rcx, rax
call fcn.140001d50
mov rsi, rax
test rax, rax
je 0x1400b2c1c
mov rcx, rdi
call fcn.14008c4f0
mov rdi, rsi
mov rcx, rdi
call fcn.140001c80
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.140001930
test eax, eax
mov eax, 0
cmove r13d, eax
mov dword [rsp + 0x20], r13d
mov rcx, rdi
call fcn.14008c4f0
test r13d, r13d
jne 0x1400b2d85
lea rdx, [rsp + 0x5d0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1400b2d5d
mov rdx, r15
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1400b2d24
xor edx, edx
lea rcx, [rsp + 0x5d0]
call fcn.1400b8880
mov rdx, qword [rsp + 0x28]
mov dword [rdx], r12d
test rbx, rbx
je 0x1400b2d1f
lea rdx, [rsp + 0x3b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1400b2d07
mov rdx, rbx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x1400b2cde
xor edx, edx
lea rcx, [rsp + 0x3b0]
call fcn.1400b8880
jmp 0x1400b2d1f
mov rdx, rbx
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x1400b2dbc
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x1400b2dbc
jmp 0x1400b2db9
mov rdx, r15
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test rbx, rbx
je 0x1400b2d56
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x1400b2dbc
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test rbx, rbx
je 0x1400b2d7e
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x1400b2dbc
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test rbx, rbx
je 0x1400b2da6
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x1400b2dbc
mov eax, 1
jmp 0x1400b2dbc
mov eax, r13d
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x6f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret