Function at 0x180002d70
Capabilities:
Create directory
Delete directory
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov r13, qword [0x1800550a0]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], al
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], bl
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], bl
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], bl
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rbp + 0x100]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x180002e26
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.180004570
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [0x18004e668]
movups xmmword [rbp - 0x28], xmm1
mov ecx, dword [0x18004e678]
mov dword [rbp - 0x18], ecx
movzx ecx, byte [0x18004e67c]
mov byte [rbp - 0x14], cl
mov ecx, eax
test eax, eax
jns 0x180002e7c
neg ecx
mov byte [rbp - 0x10], 0x2d
shr eax, 0x1f
mov r8d, eax
mov r9d, eax
nop word [rax + rax]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
movzx ecx, byte [rbp + rcx - 0x38]
mov byte [rbp + r8 - 0x10], cl
inc r9d
inc r8
mov ecx, edx
test edx, edx
jne 0x180002e90
movsxd rcx, r9d
mov byte [rbp + rcx - 0x10], dl
mov ecx, ebx
cmp byte [rbp - 0x10], 0x2d
sete cl
sub r9d, ecx
lea eax, [r9 - 1]
cdq
sub eax, edx
sar eax, 1
mov edx, ecx
movsxd r9, eax
cmp rdx, r9
jg 0x180002f0c
sub r8, rdx
lea r8, [rbp + r8 - 0x11]
nop word [rax + rax]
movzx ecx, byte [rbp + rdx - 0x10]
movzx eax, byte [r8]
mov byte [rbp + rdx - 0x10], al
mov byte [r8], cl
inc rdx
lea r8, [r8 - 1]
cmp rdx, r9
jle 0x180002ef0
lea rax, [rbp - 0x10]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180002f10
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180002f60
lea rax, [rdi + rcx]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
xor ebx, ebx
jmp 0x180002f76
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180004aa0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r12, qword [rsp + 0x30]
movabs rdi, 0x7fffffffffffffff
movabs rdx, 0x8000000000000000
mov r15, qword [rsp + 0x68]
cmp r14, r15
ja 0x180002ff6
lea rbx, [rsp + 0x50]
cmp r15, 0xf
cmova rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], r14
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
mov rbx, qword [rsp + 0x50]
jmp 0x1800030d9
cmp r14, rdi
ja 0x180003636
mov rsi, r14
or rsi, 0xf
cmp rsi, rdi
jbe 0x180003014
mov rsi, rdi
lea rcx, [rdx + 0x27]
jmp 0x180003057
mov rcx, r15
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r15, rax
jbe 0x18000302e
mov rsi, rdi
lea rcx, [rdx + 0x27]
jmp 0x180003057
lea rax, [rcx + r15]
cmp rsi, rax
cmovb rsi, rax
lea rax, [rsi + 1]
test rax, rax
je 0x18000307e
cmp rax, 0x1000
jb 0x180003073
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x18000363c
call fcn.18002e23c
test rax, rax
je 0x18000342c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000307e
mov rcx, rax
call fcn.18002e23c
mov rbx, rax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rsi
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
cmp r15, 0xf
jbe 0x1800030d4
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800030cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000342c
call fcn.18002e234
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180003124
lea rax, [rcx + 6]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 6
lea rdx, str....._
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
jmp 0x180003143
mov qword [rsp + 0x20], 6
lea r9, str....._
mov edx, 6
lea rcx, [rsp + 0x50]
call fcn.180004aa0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r12, qword [rsp + 0x30]
mov r15, qword [rbp - 0x58]
cmp r14, r15
ja 0x1800031aa
lea rbx, [rbp - 0x70]
cmp r15, 0xf
cmova rbx, qword [rbp - 0x70]
mov qword [rbp - 0x60], r14
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r14], 0
mov rbx, qword [rbp - 0x70]
jmp 0x18000328e
cmp r14, rdi
ja 0x180003636
mov rsi, r14
or rsi, 0xf
cmp rsi, rdi
jbe 0x1800031d2
mov rsi, rdi
movabs rcx, 0x8000000000000000
add rcx, 0x27
jmp 0x180003210
mov rcx, r15
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r15, rax
ja 0x1800031bf
lea rax, [rcx + r15]
cmp rsi, rax
cmovb rsi, rax
lea rax, [rsi + 1]
test rax, rax
jne 0x1800031fb
xor ebx, ebx
jmp 0x180003237
cmp rax, 0x1000
jb 0x18000322c
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x18000363c
call fcn.18002e23c
test rax, rax
je 0x18000342c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180003237
mov rcx, rax
call fcn.18002e23c
mov rbx, rax
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rsi
mov r8, r14
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
cmp r15, 0xf
jbe 0x18000328a
lea rdx, [r15 + 1]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003285
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000342c
call fcn.18002e234
mov qword [rbp - 0x70], rbx
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x1800032d5
lea rax, [rcx + 0x13]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 0x13
lea rdx, str.....TemporaryFile
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], 0
jmp 0x1800032f3
mov qword [rsp + 0x20], 0x13
lea r9, str.....TemporaryFile
mov edx, 0x13
lea rcx, [rbp - 0x70]
call fcn.180004aa0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rsi, qword [rsp + 0x40]
lea r15, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r15, qword [rsp + 0x30]
mov r14, qword [rbp - 0x78]
cmp rsi, r14
ja 0x180003358
lea rbx, [rsp + 0x70]
cmp r14, 0xf
cmova rbx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rsi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x70]
jmp 0x18000343d
cmp rsi, rdi
ja 0x180003636
mov rcx, rsi
or rcx, 0xf
cmp rcx, rdi
ja 0x1800033b1
mov rdx, r14
shr rdx, 1
mov rax, rdi
sub rax, rdx
cmp r14, rax
ja 0x1800033b1
lea rax, [rdx + r14]
mov rdi, rcx
cmp rcx, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x180003399
xor ebx, ebx
jmp 0x1800033e2
cmp rcx, 0x1000
jb 0x1800033da
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000363c
jmp 0x1800033bf
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18002e23c
test rax, rax
je 0x18000342c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800033e2
call fcn.18002e23c
mov rbx, rax
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
cmp r14, 0xf
jbe 0x180003438
lea rdx, [r14 + 1]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003433
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003433
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e234
mov qword [rsp + 0x70], rbx
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x180003485
lea rax, [rcx + 0xe]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp rdx, 0xf
cmova rax, rbx
lea rbx, [rax + rcx]
mov r8d, 0xe
lea rdx, str.TemporaryFile
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
jmp 0x1800034a4
mov qword [rsp + 0x20], 0xe
lea r9, str.TemporaryFile
mov edx, 0xe
lea rcx, [rsp + 0x70]
call fcn.180004aa0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x180003522
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000351d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000351d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e234
xor ebx, ebx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x180003572
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000356d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000356d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e234
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1800035c2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800035bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800035bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e234
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180003615
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003610
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003610
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18002e234
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180001510
nop
call fcn.180001470
int3