Function at 0x14007bf60
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
xor r14b, r14b
xor eax, eax
mov dword [rbp - 0x19], eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rbp - 1], xmm1
mov word [rbp - 0x11], ax
lea r8d, [rax + 0xc]
lea rdx, str.mbshlext.dll
lea rcx, [rbp - 0x11]
call fcn.14000d3a0
nop
lea r8, [rbp - 0x11]
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.140082ed0
nop
lea rcx, [rbp - 0x11]
call fcn.14000c340
lea rcx, [0x140469ab0]
call fcn.14007c4a0
test al, al
jne 0x14007c007
lea rcx, [0x140469ab0]
call fcn.14007c530
test al, al
je 0x14007c3ce
xor r8d, r8d
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x17]
call fcn.140098560
test al, al
je 0x14007c3ce
cmp dword [rbp - 0x21], 0
jne 0x14007c3ce
mov byte [rbp - 0x29], 0
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400d5610
test eax, eax
jne 0x14007c28c
cmp byte [rbp - 0x29], al
je 0x14007c28c
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x14007c118
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
call fcn.14000b590
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, rbx
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatrupdateutils.cpp
call fcn.140036d30
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.140036d30
mov rcx, rax
mov edx, 0x3dc
call fcn.140028560
mov rcx, rax
lea rdx, str.:_Unable_to_load_shell_extension_module:
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
xor r14b, r14b
jmp 0x14007c3d1
lea rdx, str.DllUnregisterServer
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14007c1d5
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
call fcn.14000b590
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, rbx
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatrupdateutils.cpp
call fcn.140036d30
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.140036d30
mov rcx, rax
mov edx, 0x3e2
call fcn.140028560
mov rcx, rax
lea rdx, str.:_Unable_to_get_shell_extension_unregister_function:
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14007c30e
call rax
mov ebx, eax
test eax, eax
jns 0x14007c27b
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatrupdateutils.cpp
call fcn.140036d30
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.140036d30
mov rcx, rax
mov edx, 0x3e7
call fcn.140028560
mov rcx, rax
lea rdx, str.:_Unregister_function_failed:
call fcn.140036d30
mov rcx, rax
mov edx, ebx
call fcn.140028560
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14007c30e
mov r14b, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14007c30e
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatrupdateutils.cpp
call fcn.140036d30
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.140036d30
mov rcx, rax
mov edx, 0x3f1
call fcn.140028560
mov rcx, rax
lea rdx, str.:_VerifyFile_failed
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
lea r8, [rbp - 0x19]
xor edx, edx
lea rcx, [rbp + 0x17]
call fcn.1400927b0
test al, al
jne 0x14007c3d1
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x11]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcmbupdatrupdateutils.cpp
call fcn.140036d30
mov rcx, rax
lea rdx, [0x1403b9014]
call fcn.140036d30
mov rcx, rax
mov edx, 0x3f6
call fcn.140028560
mov rcx, rax
lea rdx, str.:_Delete_shell_extension_DLL_failed:
call fcn.140036d30
mov rcx, rax
mov edx, dword [rbp - 0x19]
call fcn.1400283a0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14007c3d1
mov r14b, 1
lea rcx, [rbp + 0x17]
call fcn.14000c340
movzx eax, r14b
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret