Function at 0x140027d5c
Capabilities:
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x10e0
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov rdi, qword [rsp + 0x1130]
mov rbp, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x14002850b
mov rcx, qword [rcx]
cmp qword [rdi], rcx
jne 0x14002850b
mov eax, dword [rdi + 0x10]
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp eax, 0xfffffe34
je 0x1400283e5
cmp eax, 0xfffffe35
je 0x140028388
cmp eax, 0xfffffe36
je 0x14002833b
cmp eax, 0xfffffe3a
je 0x1400282a6
cmp eax, 0xfffffe3d
je 0x140027f23
cmp eax, 0xfffffe64
je 0x140027ee2
cmp eax, 0xfffffffb
jne 0x14002850b
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx]
mov qword [rsp + 0x98], rdx
lea r9, [rsp + 0x98]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rsp + 0xa8]
cmp r9, r13
je 0x14002850b
mov rcx, qword [rbx]
lea r8d, [r13 + 9]
mov edx, 0x110b
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0xa0], 4
je 0x14002850b
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
je 0x14002850b
mov r8, qword [rsp + 0x78]
cmp r8, r13
je 0x14002850b
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400263f8
jmp 0x14002850b
movzx eax, word [rdi + 0x18]
cmp eax, 0x2e
je 0x140027f16
cmp eax, 0x71
je 0x140027f09
cmp eax, 0x74
jne 0x14002850b
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.140027b04
jmp 0x14002850b
mov rcx, rbx
call fcn.140026ea4
jmp 0x14002850b
mov rcx, rbx
call fcn.140027bf4
jmp 0x14002850b
mov rsi, qword [rdi + 0x88]
mov word [rsp + 0x8d0], r13w
cmp rsi, r13
jne 0x14002809e
mov rbp, qword [rdi + 0x60]
lea rax, [rsp + 0xd0]
mov esi, 0x113e
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x400
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
je 0x14002850b
or r12, 0xffffffffffffffff
mov rcx, qword [rbx]
mov r9, rbp
mov edx, 0x110a
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx]
mov rbp, rax
cmp rax, r13
je 0x140028179
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r13
je 0x14002805b
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x8d0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x3ff
jae 0x14002805b
cmp word [rsp + 0x8d0], r13w
je 0x14002803e
lea rcx, [rsp + 0xd0]
call fcn.14005254c
xor eax, eax
lea rdi, [rsp + 0xd0]
mov rcx, r12
lea rdx, [rsp + 0x8d0]
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x14002802c
mov rcx, r13
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x8ce], ax
cmp ax, r13w
jne 0x140028041
mov rcx, qword [rbx]
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, esi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x68], 0x400
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, r13d
jne 0x140027f84
jmp 0x14002850b
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x14002818c
cmp word [0x1400e9010], r13w
jne 0x1400280f9
lea r8, [rsp + 0x30]
mov edx, 0x13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400e9010]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [0x1401276f0]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400e9010]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x8d0]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x1400e9010]
call fcn.1400ab004
cmp eax, r13d
jne 0x140028164
lea r8, [rsi + 8]
lea r9, [rsp + 0xd0]
mov rdx, rsi
mov rcx, rbp
call fcn.140026f78
cmp al, r13b
je 0x140028176
mov rcx, r13
movzx eax, word [rsp + rcx + 0xd0]
add rcx, 2
mov word [rsp + rcx + 0x8ce], ax
cmp ax, r13w
jne 0x140028148
jmp 0x140028176
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0x8d0]
jmp 0x140028290
call fcn.14003ec88
cmp eax, 0x601
jb 0x14002850b
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r13
je 0x14002850b
lea rdx, str.SHCreateItemFromIDList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r13
je 0x14002850b
mov rcx, qword [rsi + 0x10]
lea r8, [rsp + 0x88]
lea rdx, [0x1400c5478]
call rax
cmp eax, r13d
jne 0x14002850b
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x90]
lea r8, [0x1400c5430]
xor edx, edx
call fcn.140026ee4
cmp eax, r13d
jne 0x14002850b
mov rcx, qword [rsp + 0x90]
lea r9, [rsp + 0x80]
lea r8, [0x1400c5478]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x48]
cmp eax, r13d
jne 0x14002850b
mov rcx, qword [rsp + 0x80]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp eax, r13d
jne 0x14002850b
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xd0]
mov r8d, 0x400
call fcn.14006b580
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetParent]
lea r9, [rsp + 0xd0]
mov rcx, rax
mov edx, 0x40a
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14002850b
test byte [rdi + 0x68], 0x40
jne 0x14002850b
mov rsi, qword [rdi + 0x88]
cmp rsi, r13
je 0x14002850b
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
lea r9, [0x1400cd3b8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsi + 8]
xor r8d, r8d
call qword [rax + 0x28]
cmp eax, r13d
jl 0x140028303
mov rax, qword [rdi + 0x60]
mov r9, qword [rsi + 0x10]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140026858
mov rax, qword [rdi + 0x60]
mov rcx, qword [rbx]
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb0], rax
lea rax, [0x140026b8c]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov edx, 0x1115
jmp 0x140028298
mov rdi, qword [rdi + 0x50]
cmp rdi, r13
je 0x14002850b
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401276f0]
mov rdx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x1401276f0]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x1401276f0]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x14002850b
mov rcx, qword [rdi + 0x48]
cmp rcx, r13
jne 0x1400283a0
movabs rax, 1
jmp 0x14002850d
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x140028391
lea rcx, [rsp + 0x8d0]
call fcn.140031110
cmp al, r13b
je 0x140028391
lea rcx, [rsp + 0x8d0]
call fcn.140052abc
cmp word [rax], r13w
je 0x140028391
mov byte [rbx + 0x11], 1
jmp 0x14002850b
mov byte [rbx + 0x11], r13b
cmp qword [rdi + 0x30], r13
je 0x14002850b
mov rcx, qword [rdi + 0x48]
cmp rcx, r13
je 0x14002850b
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x8d0]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, r13d
je 0x14002850b
mov rcx, r13
movzx eax, word [rsp + rcx + 0x8d0]
add rcx, 2
mov word [rsp + rcx + 0xce], ax
cmp ax, r13w
jne 0x14002841e
lea rcx, [rsp + 0xd0]
call fcn.140052abc
or r12, 0xffffffffffffffff
mov word [rax], r13w
mov r8, qword [rdi + 0x30]
xor eax, eax
mov rdi, r8
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0xd0]
not rcx
lea rdx, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, 0x400
jae 0x14002850d
lea rdi, [rsp + 0xd0]
mov rcx, r12
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r8 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140028497
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call fcn.1400310a8
cmp al, r13b
je 0x1400284d2
mov ecx, 0x50d
call fcn.140061d2c
mov rcx, rax
call fcn.140095e68
jmp 0x14002850b
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, r13d
je 0x14002850b
mov dl, byte [rbx + 0x10]
mov rcx, rbx
call fcn.140027b04
lea rdx, [rsp + 0xd0]
mov r8b, 1
mov rcx, rbx
call fcn.140027450
xor eax, eax
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.1400a8530
mov rbx, qword [rsp + 0x1120]
add rsp, 0x10e0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret