Function at 0x140013b30
Capabilities:
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x448]
sub rsp, 0x548
mov rax, qword [0x1400590c0]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov dword [rsp + 0x70], ecx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
cmp ecx, dword [0x140059080]
jl 0x14001444a
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x68], rax
mov ecx, 0x800
mov r15d, 0x400
call fcn.14001dde0
mov rbx, rax
mov qword [rsp + 0x78], rax
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14001447e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov edi, 0x14
mov r14d, r15d
call fcn.140006530
mov r12, rax
mov rsi, 0xffffffffffffffff
nop
dec edi
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov rcx, qword [rbp + 0x498]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8, r14
mov rdx, rbx
mov rcx, qword [r12]
call fcn.140028934
test eax, eax
cmovs eax, esi
test eax, eax
js 0x140013c4e
test rbx, rbx
jne 0x140013c31
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400048b0
jmp 0x140013c94
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x140013c34
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400048b0
jmp 0x140013c94
call fcn.140023c08
cmp dword [rax], 0x22
jne 0x140014419
lea eax, [r15 + r15]
movsxd r15, eax
mov r14, r15
mov eax, 2
mul r15
cmovb rax, rsi
mov rcx, rax
call fcn.14001dde0
mov rcx, rbx
mov rbx, rax
mov qword [rsp + 0x78], rax
test rcx, rcx
je 0x140013c94
mov edx, 2
call fcn.14001d5ec
test edi, edi
jg 0x140013be0
xor ecx, ecx
call fcn.14002ba54
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movsd qword [rbp - 0x68], xmm0
mov dword [rbp - 0x60], r13d
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.14000c000
lea r8, str._Y__m__d__H:_M:_S_t
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call fcn.14000f5b0
mov r13, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140013cf4
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x140013d05
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140014489
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 1
mov rdi, qword [rsp + 0x60]
movsxd r12, dword [rdi - 0x10]
mov r13, qword [r13]
movsxd r15, dword [r13 - 0x10]
lea r14d, [r12 + r15]
test r14d, r14d
js 0x140014473
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x140013d67
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1400045e0
mov rbx, qword [rsp + 0x48]
add r15, r15
je 0x140013d9d
test rbx, rbx
je 0x140013d8d
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x140013d86
mov rdx, r13
call fcn.14003f6b0
jmp 0x140013d9d
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
mov r8, r12
add r8, r8
lea rcx, [r15 + rbx]
je 0x140013dc8
test rcx, rcx
jne 0x140013dc0
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x140013dc8
mov rdx, rdi
call fcn.14003f6b0
cmp r14d, dword [rbx - 0xc]
jg 0x140014473
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r15d, r15d
mov word [rbx + rax*2], r15w
lea r14, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp r14, rdi
je 0x140013e3f
cmp dword [rdi + 0x10], r15d
jl 0x140013e2e
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x140013e2e
mov rcx, r14
call fcn.140002eb0
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140013e23
mov rcx, qword [rdi]
mov rdx, qword [rcx]
mov r8, qword [rdx + 8]
mov rdx, rdi
call r8
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140013e3f
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400048b0
mov dword [rsp + 0x40], r15d
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140013e5e
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013e7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x68]
call fcn.140011dd0
nop
lea r8, str.UpdateUpdate.log
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140002620
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140013eba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ecx, dword [0x14005a764]
inc ecx
mov dword [0x14005a764], ecx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
cmp ecx, eax
jne 0x14001405f
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14001405f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rbp + 0x200], 0xa00000
jbe 0x14001405f
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140013f37
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140013f48
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140014494
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x20
lea r12, [0x140044cdc]
mov rdi, rsi
inc rdi
cmp word [r12 + rdi*2], 0
jne 0x140013f72
mov r13, qword [rsp + 0x58]
movsxd r15, dword [r13 - 0x10]
lea r14d, [rdi + r15]
test r14d, r14d
js 0x14001449f
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x140013fb7
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1400045e0
mov rbx, qword [rsp + 0x48]
add r15, r15
je 0x140013fed
test rbx, rbx
je 0x140013fdd
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x140013fd6
mov rdx, r13
call fcn.14003f6b0
jmp 0x140013fed
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x140014018
test rcx, rcx
jne 0x140014010
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x140014018
mov rdx, r12
call fcn.14003f6b0
cmp r14d, dword [rbx - 0xc]
jg 0x14001449f
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r15d, r15d
mov word [rbx + rax*2], r15w
mov r8d, 9
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001405f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400143fa
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, 1
lea rcx, [rbp - 0x50]
call fcn.14000a600
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.14000c100
lea rdx, [0x140044ce4]
lea rcx, [rbp - 0x50]
call fcn.140007d90
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x140043ba0]
movdqu xmmword [rbp + 0x1d0], xmm1
mov byte [rbp + 0x1c0], 0
mov dword [rsp + 0x40], 8
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp + 0x28]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140014144
mov rax, qword [rbp - 8]
mov r8, qword [rax]
test r8, r8
je 0x140014144
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
mov qword [rbp - 0x80], rdx
cmp r8, qword [rbp + 0x20]
cmovb r8, qword [rbp + 0x20]
sub r8, rdx
mov qword [rbp - 0x78], r8
jmp 0x14001417b
test cl, 4
jne 0x140014173
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x140014173
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov qword [rbp - 0x80], rdx
mov rax, qword [rbp + 8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
mov qword [rbp - 0x78], r8
jmp 0x14001417b
mov r8, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x14001418d
lea rcx, [rbp + 0x1c0]
call fcn.140016aa0
nop
mov dword [rsp + 0x40], 4
lea rax, [rbp + 0x138]
mov qword [rbp + 0x130], rax
mov r8d, 3
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x130]
call fcn.140006fb0
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x1400144aa
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x14
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x14001424d
sub ecx, 2
je 0x14001422d
sub ecx, 1
je 0x140014211
cmp ecx, 1
jne 0x140014275
lea rdx, str.Error
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140014204
jmp 0x14001426b
lea rdx, str.Warn
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140014220
jmp 0x14001426b
lea rdx, str.Info
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140014240
jmp 0x14001426b
lea rdx, str.Debug
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140014260
lea rcx, [rsp + 0x48]
call fcn.1400048b0
lea rax, [rbp + 0xa8]
mov qword [rbp + 0xa0], rax
mov r8d, 3
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140006fb0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400142b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0xf
cmova rdx, qword [rbp + 0x1c0]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov r8d, dword [rbp + 0x1d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0xa0]
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400142f2
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0x130]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140014320
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [0x140044ce8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0xa8]
mov rcx, qword [rbp + 0xa0]
cmp rcx, rax
je 0x14001437f
call fcn.1400244d4
nop
lea rax, [rbp + 0x138]
mov rcx, qword [rbp + 0x130]
cmp rcx, rax
je 0x140014398
call fcn.1400244d4
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x1400143d9
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400143d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001446d
call fcn.14001d5ec
movdqa xmm0, xmmword [0x140043ba0]
movdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
lea rcx, [rbp - 0x50]
call fcn.14000c4b0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140014419
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140014436
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14001444a
mov edx, 2
call fcn.14001d5ec
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.14001d590
add rsp, 0x548
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140023b04
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
int3