Function at 0x1400056e0
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xb40], rbx
mov rax, qword [0x1402a87a8]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r13, r8
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov r12, qword [rbp + 0xa60]
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], r12
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp - 0x40]
call fcn.1401b8ea0
mov dword [rsp + 0x50], ebx
mov rax, qword [r13]
mov edx, dword [rax - 0x10]
test edx, edx
js 0x140005e88
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x14000577d
mov rcx, r13
call fcn.140003970
mov r15, qword [r13]
call fcn.140032a84
mov rcx, rax
test rax, rax
je 0x140005e93
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edx, 0x5c
mov rcx, qword [r14]
call fcn.1401b8070
mov edi, 0xffffffff
test rax, rax
jne 0x1400057bc
mov eax, edi
jmp 0x1400057c2
sub rax, qword [r14]
sar rax, 1
test eax, eax
cmovns ebx, eax
mov rcx, qword [r14]
cmp ebx, dword [rcx - 0x10]
jl 0x1400057e3
add rcx, 0xffffffffffffffe8
call fcn.140007af0
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x14000581d
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x1400057f7
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140005805
call fcn.140032a84
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, ebx
mov rdx, qword [r14]
lea rcx, [rsp + 0x70]
call fcn.140007550
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], 1
call fcn.140032a84
mov rcx, rax
test rax, rax
je 0x140005e9e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.OldExecutable.bak
lea rcx, [rsp + 0x58]
cmp rdx, 0x10000
jae 0x140005864
movzx edx, dx
call fcn.140003670
jmp 0x140005870
mov r8d, 0x11
call fcn.140003aa0
nop
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000588a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000589b
call fcn.140032a84
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140005ea9
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 3
mov eax, 0x5c
mov word [rsp + 0x40], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400075f0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140007330
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000591f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000593d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r15
call fcn.14002a0f0
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140005ba8
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rdx, [0x140260d90]
mov rcx, rax
call fcn.14002a290
test eax, eax
jne 0x140005ba8
lea rdx, str.Moss.fut
lea rcx, [rbp - 0x70]
call fcn.140003bc0
mov r15, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400059ab
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400059bc
call fcn.140032a84
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140005eb4
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 9
mov eax, 0x5c
mov word [rsp + 0x44], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x44]
mov r8d, dword [rbx - 0x10]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.1400075f0
nop
mov rbx, qword [rsp + 0x78]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x140005a27
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140005a38
call fcn.140032a84
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140005e7d
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x19
mov r9, qword [r15]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1400075f0
mov rdx, qword [rbp - 0x80]
lea rbx, [rdx - 0x18]
mov r15, qword [rsp + 0x38]
add r15, 0xffffffffffffffe8
cmp rbx, r15
je 0x140005ada
cmp dword [r15 + 0x10], 0
jl 0x140005acc
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x140005acc
mov rcx, rbx
call fcn.140007af0
mov qword [rbp - 0x78], rax
mov ecx, edi
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x140005ac1
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, qword [rbp - 0x78]
add rax, 0x18
mov qword [rsp + 0x38], rax
jmp 0x140005ada
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140003aa0
mov dword [rsp + 0x30], 9
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140005afb
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x140005b17
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx - 8], 1
jle 0x140005b8c
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140003860
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], 1
je 0x140005c81
mov dword [0x1403bbc54], 0x80000
mov r12, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005bc7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140005be0
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005bff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005c1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005c3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140005c55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1401b2ef0
mov rbx, qword [rsp + 0xb40]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8, rbx
mov edx, dword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call fcn.140029c60
mov dword [0x1403bbc54], eax
test eax, eax
jne 0x140005ba3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1f0]
call fcn.1401b8ea0
cmp dword [rbx - 8], 1
jle 0x140005cd6
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140003860
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.140020340
mov r8d, 2
mov rdx, qword [rsp + 0x48]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140005da0
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d20
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140005d39
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
jmp 0x140005c3e
mov r8d, 2
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
mov ebx, 0
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005de3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140005dfc
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005e1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005e38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005e56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140005e76
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x140005c57
mov ecx, 0x80004005
call fcn.140003a80
nop
mov ecx, 0x80070057
call fcn.140003a80
int3
mov ecx, 0x80004005
call fcn.140003a80
nop
mov ecx, 0x80004005
call fcn.140003a80
nop
mov ecx, 0x80004005
call fcn.140003a80
nop
mov ecx, 0x80004005
call fcn.140003a80
int3