Function at 0x180009e68
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x50
mov ebx, edx
test edx, edx
je 0x180009e81
mov eax, 0x5f642942
mov dword [0x180102cc4], eax
jmp 0x180009e87
mov eax, dword [0x180102cc4]
cmp eax, 0xb7a70374
jne 0x18000a065
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
and qword [rsp + 0x30], 0
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharLowerW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PrintWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
and qword [rsp + 0x28], 0
lea r9, str.vqXLefdeP9KxPx3a86RP
and dword [rsp + 0x20], 0
lea rdx, str.heswCHV8Qw5ZVquXxc6lXrXu
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowModuleFileNameW]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAscii]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowEnabled]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp ebx, 1
jne 0x18000a097
mov ecx, 0x1fe
lea rax, [0x1800097bc]
mov dword [rsp + 0x48], ecx
add rax, rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e79c
mov eax, 1
add rsp, 0x50
pop rbx
ret