Function at 0x14002da00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rax, qword [0x14022ff58]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rbp + 0x7f]
cmp r8d, 0x4e
jne 0x14002dd85
mov rax, qword [rcx]
cmp qword [rsi], rax
jne 0x14002dd85
xor r15d, r15d
mov qword [rbp - 0x79], r15
mov eax, dword [rsi + 0x10]
cmp eax, 0xfffffe34
je 0x14002df63
cmp eax, 0xfffffe35
je 0x14002de45
cmp eax, 0xfffffe36
je 0x14002dde0
cmp eax, 0xfffffe38
je 0x14002dd07
cmp eax, 0xfffffe3a
je 0x14002dc5a
cmp eax, 0xfffffe3d
je 0x14002dbac
cmp eax, 0xfffffe64
je 0x14002db72
cmp eax, 0xfffffffb
jne 0x14002dd85
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x71], rax
lea r9, [rbp - 0x71]
xor r8d, r8d
mov edx, 0x1111
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp - 0x61]
test r9, r9
je 0x14002dd85
mov edx, 0x110b
lea r8d, [r15 + 9]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rbp - 0x69], 4
je 0x14002dd85
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov dword [rbp - 0x41], 4
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x39], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14002dd85
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x14002dd85
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [r8 + 8]
mov r8, qword [r8]
mov rdx, rbx
mov rcx, rdi
call fcn.14002c6d8
jmp 0x14002dd85
cmp word [rsi + 0x18], 0x2e
je 0x14002dba2
cmp word [rsi + 0x18], 0x71
je 0x14002db98
cmp word [rsi + 0x18], 0x74
jne 0x14002dd85
mov dl, byte [rcx + 0x10]
call fcn.14002f1a0
jmp 0x14002dd85
call fcn.14002e98c
jmp 0x14002dd85
call fcn.14002c50c
jmp 0x14002dd85
lea r8, [rsi + 0x58]
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea r9, [rbp - 0x41]
call fcn.14002d414
test al, al
je 0x14002dc07
lea rbx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rbx, qword [rbp - 0x41]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov r9, rbx
xor r8d, r8d
mov edx, 0x800b
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002dc48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002dc43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1b9
call fcn.1401addcc
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x31], xmm0
jmp 0x14002dd80
test byte [rsi + 0x68], 0x40
jne 0x14002dd85
mov rbx, qword [rsi + 0x88]
test rbx, rbx
je 0x14002dd85
mov eax, dword [0x140230e40]
mov ecx, eax
inc eax
mov dword [0x140230e40], eax
test ecx, ecx
jne 0x14002dd85
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov qword [rsp + 0x20], rdx
lea r9, [0x1401f3510]
xor r8d, r8d
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f0cf3.0]
test eax, eax
js 0x14002dcd3
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0x10]
mov r8, qword [rbp - 0x79]
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.14002c914
mov rax, qword [rsi + 0x60]
mov qword [rbp - 0x59], rax
lea rax, [0x14002f170]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], r15
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x1115
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
dec dword [0x140230e40]
jmp 0x14002dd85
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea r8, [rsi + 0x58]
lea r9, [rbp - 0x41]
call fcn.14002d414
test al, al
jne 0x14002ddae
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002dd78
mov ebx, 0x1000
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002dd73
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1bf
call fcn.1401addcc
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401adee0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rbp - 0x31], r15
jne 0x14002ddcd
cmp byte [0x140231ad4], r15b
je 0x14002ddcd
lea rdx, [0x1401da2d0]
lea rcx, [rbp - 0x41]
call fcn.140012f6c
lea rdx, [rbp - 0x41]
mov ecx, 1
call fcn.140029af8
jmp 0x14002dd37
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14002dd85
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400f0cf3.0]
mov rcx, qword [0x140256f70]
mov rax, qword [rcx]
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f0cf3.0]
mov rcx, qword [0x140256f70]
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f0cf3.0]
mov rcx, qword [0x140256f70]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x1400f0cf3.0]
jmp 0x14002dd85
mov rcx, qword [rsi + 0x48]
test rcx, rcx
jne 0x14002de56
lea eax, [rcx + 1]
jmp 0x14002dd87
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e29f8
test al, al
je 0x14002df02
lea rcx, [rbp - 0x41]
call fcn.1400cb2c4
test al, al
je 0x14002df02
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 9]
call fcn.1400e2880
nop
mov rbx, qword [rax + 0x10]
lea rcx, [rbp - 9]
call fcn.140006b84
test rbx, rbx
je 0x14002df02
mov r8d, 1
mov byte [rdi + 0x11], r8b
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002defd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002def8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1c5
call fcn.1401addcc
mov r8, r15
jmp 0x14002df49
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002df43
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002df3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1c5
call fcn.1401addcc
mov r8d, 1
movdqa xmm0, xmmword [0x1401da070]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r15w
mov rax, r8
jmp 0x14002dd87
mov byte [rcx + 0x11], r15b
cmp qword [rsi + 0x30], r15
je 0x14002dd85
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14002dd85
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e29f8
mov ebx, 0x1000
test al, al
je 0x14002e145
mov qword [rbp - 9], r15
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r15
mov r15, qword [rbp - 0x31]
lea r12, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r12, qword [rbp - 0x41]
movabs r13, 0x7ffffffffffffffe
cmp r15, r13
ja 0x14002e1cb
mov qword [rbp + 0xf], r14
cmp r15, 8
jae 0x14002e008
mov qword [rbp + 7], r15
lea r8d, [r14 + 9]
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.1401aff80
jmp 0x14002e086
mov rax, r15
or rax, r14
cmp rax, r13
jbe 0x14002e023
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14002e051
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002e1a7
add rcx, rcx
cmp rcx, rbx
jb 0x14002e058
call fcn.14000416c
jmp 0x14002e066
test rcx, rcx
je 0x14002e064
call fcn.1401add90
jmp 0x14002e066
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r13
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1401aff80
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400e0f04
mov rdx, qword [rsi + 0x30]
or r8, 0xffffffffffffffff
xor r15d, r15d
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14002e09e
lea rcx, [rbp - 9]
call fcn.140006c14
lea rcx, [rbp - 9]
call fcn.1400cb2c4
test al, al
je 0x14002e0d2
mov ecx, 0x50d
call fcn.1400f5fe0
mov rcx, rax
call fcn.1401687cc
jmp 0x14002e0fc
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14002e185
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14002e138
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
cmp rdx, rbx
mov rax, rcx
jb 0x14002e133
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1b3
call fcn.1401addcc
mov word [rbp - 9], r15w
mov qword [rbp + 0xf], r14
mov qword [rbp + 7], r15
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002dd78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002dd73
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e1ad
jmp 0x14002dd73
mov dl, byte [rdi + 0x10]
mov rcx, rdi
call fcn.14002f1a0
mov r8d, 1
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.14002efd8
jmp 0x14002e0fc
call fcn.140006b64
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
nop
call fcn.1401b4fa4
int3
call fcn.1401b4fa4
int3
call fcn.1401b4fa4
nop
call fcn.140006be8
int3